dcrat | 21fffcc4d1db45ed2362be06f4abbdfa33ed59a19d353b4fcc523452c6798286

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	5bebc27d3f01693f84851b07591bbfa7.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	spoolsv.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	5bebc27d3f01693f84851b07591bbfa7.exe

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	5bebc27d3f01693f84851b07591bbfa7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	5bebc27d3f01693f84851b07591bbfa7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	5bebc27d3f01693f84851b07591bbfa7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	5bebc27d3f01693f84851b07591bbfa7.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	5bebc27d3f01693f84851b07591bbfa7.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	5bebc27d3f01693f84851b07591bbfa7.exe

Executes dropped EXE 1 IoCs

pid	Process
4824	spoolsv.exe

Identifies Wine through registry keys 2 TTPs 3 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Wine	5bebc27d3f01693f84851b07591bbfa7.exe
Key opened	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Wine	5bebc27d3f01693f84851b07591bbfa7.exe
Key opened	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Wine	spoolsv.exe

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WaaSMedicAgent = "\"C:\\Windows\\tracing\\WaaSMedicAgent.exe\""	5bebc27d3f01693f84851b07591bbfa7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Windows\\SystemApps\\Microsoft.Windows.Search_cw5n1h2txyewy\\Cortana.Search\\SearchApp.exe\""	5bebc27d3f01693f84851b07591bbfa7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WaaSMedicAgent = "\"C:\\Windows\\System32\\devmgmt\\WaaSMedicAgent.exe\""	5bebc27d3f01693f84851b07591bbfa7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\System32\\HdcpHandler\\spoolsv.exe\""	5bebc27d3f01693f84851b07591bbfa7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\InputApp\\TextInputCommon\\TextInputHost.exe\""	5bebc27d3f01693f84851b07591bbfa7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\System32\\dsauth\\fontdrvhost.exe\""	5bebc27d3f01693f84851b07591bbfa7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\System32\\w32topl\\dwm.exe\""	5bebc27d3f01693f84851b07591bbfa7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\msvcrt\\dllhost.exe\""	5bebc27d3f01693f84851b07591bbfa7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\PerfLogs\\backgroundTaskHost.exe\""	5bebc27d3f01693f84851b07591bbfa7.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\HdcpHandler\f3b6ecef712a24f33798f5d2fb3790c3d9b894c4	5bebc27d3f01693f84851b07591bbfa7.exe
File created	C:\Windows\SysWOW64\dsauth\5b884080fd4f94e2695da25c503f9e33b9605b83	5bebc27d3f01693f84851b07591bbfa7.exe
File created	C:\Windows\SysWOW64\w32topl\dwm.exe	5bebc27d3f01693f84851b07591bbfa7.exe
File created	C:\Windows\SysWOW64\msvcrt\5940a34987c99120d96dace90a3f93f329dcad63	5bebc27d3f01693f84851b07591bbfa7.exe
File created	C:\Windows\SysWOW64\devmgmt\WaaSMedicAgent.exe	5bebc27d3f01693f84851b07591bbfa7.exe
File opened for modification	C:\Windows\SysWOW64\HdcpHandler\spoolsv.exe	5bebc27d3f01693f84851b07591bbfa7.exe
File created	C:\Windows\SysWOW64\dsauth\fontdrvhost.exe	5bebc27d3f01693f84851b07591bbfa7.exe
File created	C:\Windows\SysWOW64\w32topl\6cb0b6c459d5d3455a3da700e713f2e2529862ff	5bebc27d3f01693f84851b07591bbfa7.exe
File created	C:\Windows\SysWOW64\msvcrt\dllhost.exe	5bebc27d3f01693f84851b07591bbfa7.exe
File created	C:\Windows\SysWOW64\devmgmt\c82b8037eab33d1fe33ed5c436875fcafdbefbee	5bebc27d3f01693f84851b07591bbfa7.exe
File created	C:\Windows\SysWOW64\HdcpHandler\spoolsv.exe	5bebc27d3f01693f84851b07591bbfa7.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
4620	5bebc27d3f01693f84851b07591bbfa7.exe
4252	5bebc27d3f01693f84851b07591bbfa7.exe
4824	spoolsv.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputCommon\22eafd247d37c30fed3795ee41d259ec72bb351c	5bebc27d3f01693f84851b07591bbfa7.exe
File created	C:\Windows\tracing\WaaSMedicAgent.exe	5bebc27d3f01693f84851b07591bbfa7.exe
File created	C:\Windows\tracing\c82b8037eab33d1fe33ed5c436875fcafdbefbee	5bebc27d3f01693f84851b07591bbfa7.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Cortana.Search\SearchApp.exe	5bebc27d3f01693f84851b07591bbfa7.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Cortana.Search\SearchApp.exe	5bebc27d3f01693f84851b07591bbfa7.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Cortana.Search\38384e6a620884a6b69bcc56f80d556f9200171c	5bebc27d3f01693f84851b07591bbfa7.exe
File created	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputCommon\TextInputHost.exe	5bebc27d3f01693f84851b07591bbfa7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
2104	schtasks.exe
3796	schtasks.exe
2856	schtasks.exe
1020	schtasks.exe
2716	schtasks.exe
4692	schtasks.exe
3552	schtasks.exe
2068	schtasks.exe
1088	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings	5bebc27d3f01693f84851b07591bbfa7.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings	5bebc27d3f01693f84851b07591bbfa7.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
4620	5bebc27d3f01693f84851b07591bbfa7.exe
4620	5bebc27d3f01693f84851b07591bbfa7.exe
4620	5bebc27d3f01693f84851b07591bbfa7.exe
4252	5bebc27d3f01693f84851b07591bbfa7.exe
4252	5bebc27d3f01693f84851b07591bbfa7.exe
4252	5bebc27d3f01693f84851b07591bbfa7.exe
4252	5bebc27d3f01693f84851b07591bbfa7.exe
4252	5bebc27d3f01693f84851b07591bbfa7.exe
4252	5bebc27d3f01693f84851b07591bbfa7.exe
4252	5bebc27d3f01693f84851b07591bbfa7.exe
4252	5bebc27d3f01693f84851b07591bbfa7.exe
4824	spoolsv.exe
4824	spoolsv.exe
4824	spoolsv.exe
4824	spoolsv.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4620	5bebc27d3f01693f84851b07591bbfa7.exe
Token: SeDebugPrivilege	4252	5bebc27d3f01693f84851b07591bbfa7.exe
Token: SeDebugPrivilege	4824	spoolsv.exe
Token: SeManageVolumePrivilege	3904	svchost.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4620 wrote to memory of 3292	4620	5bebc27d3f01693f84851b07591bbfa7.exe	101
PID 4620 wrote to memory of 3292	4620	5bebc27d3f01693f84851b07591bbfa7.exe	101
PID 4620 wrote to memory of 3292	4620	5bebc27d3f01693f84851b07591bbfa7.exe	101
PID 3292 wrote to memory of 2328	3292	cmd.exe	100
PID 3292 wrote to memory of 2328	3292	cmd.exe	100
PID 3292 wrote to memory of 2328	3292	cmd.exe	100
PID 3292 wrote to memory of 4884	3292	cmd.exe	103
PID 3292 wrote to memory of 4884	3292	cmd.exe	103
PID 3292 wrote to memory of 4884	3292	cmd.exe	103
PID 4884 wrote to memory of 4712	4884	w32tm.exe	102
PID 4884 wrote to memory of 4712	4884	w32tm.exe	102
PID 3292 wrote to memory of 4252	3292	cmd.exe	106
PID 3292 wrote to memory of 4252	3292	cmd.exe	106
PID 3292 wrote to memory of 4252	3292	cmd.exe	106
PID 4252 wrote to memory of 1240	4252	5bebc27d3f01693f84851b07591bbfa7.exe	115
PID 4252 wrote to memory of 1240	4252	5bebc27d3f01693f84851b07591bbfa7.exe	115
PID 4252 wrote to memory of 1240	4252	5bebc27d3f01693f84851b07591bbfa7.exe	115
PID 1240 wrote to memory of 5068	1240	cmd.exe	118
PID 1240 wrote to memory of 5068	1240	cmd.exe	118
PID 1240 wrote to memory of 5068	1240	cmd.exe	118
PID 1240 wrote to memory of 3204	1240	cmd.exe	116
PID 1240 wrote to memory of 3204	1240	cmd.exe	116
PID 1240 wrote to memory of 3204	1240	cmd.exe	116
PID 3204 wrote to memory of 4688	3204	w32tm.exe	117
PID 3204 wrote to memory of 4688	3204	w32tm.exe	117
PID 1240 wrote to memory of 4824	1240	cmd.exe	120
PID 1240 wrote to memory of 4824	1240	cmd.exe	120
PID 1240 wrote to memory of 4824	1240	cmd.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\5bebc27d3f01693f84851b07591bbfa7.exe
"C:\Users\Admin\AppData\Local\Temp\5bebc27d3f01693f84851b07591bbfa7.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\oUzQYIcK02.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3292
- - C:\Windows\SysWOW64\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4884
- - C:\Users\Admin\AppData\Local\Temp\5bebc27d3f01693f84851b07591bbfa7.exe
    "C:\Users\Admin\AppData\Local\Temp\5bebc27d3f01693f84851b07591bbfa7.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Checks computer location settings
    - Identifies Wine through registry keys
    - Adds Run key to start application
    - Drops file in System32 directory
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4252
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4f9KPB39Ec.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1240
    - - C:\Windows\SysWOW64\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3204
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:4688
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        5⤵
        
        PID:5068
    - - C:\Windows\SysWOW64\HdcpHandler\spoolsv.exe
        
        "C:\Windows\System32\HdcpHandler\spoolsv.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Cortana.Search\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\System32\w32topl\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\msvcrt\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Windows\System32\devmgmt\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1088

C:\Windows\SysWOW64\chcp.com
chcp 65001
1⤵
PID:2328

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
1⤵
PID:4712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\System32\HdcpHandler\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputCommon\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\System32\dsauth\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Windows\tracing\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\PerfLogs\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4692

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:5016

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

T1082

Virtualization/Sandbox Evasion