0e432a16d518b1e14f501faa212323e362daa674d542698f23e05e83a6065a0c

Modify Registry

Processes:

svcr.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2bf41070-b2b1-21d1-b5c1-0305f4055515}	svcr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2bf41070-b2b1-21d1-b5c1-0305f4055515}\StubPath = "C:\\windows\\svcr.exe"	svcr.exe

Checks BIOS information in registry 2 TTPs 3 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

751acdffdab84a688d4cebf79852b049.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	751acdffdab84a688d4cebf79852b049.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	751acdffdab84a688d4cebf79852b049.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	751acdffdab84a688d4cebf79852b049.exe

Executes dropped EXE 3 IoCs

Processes:

svcr.exeFB3.exesvcr.exe

pid	Process
2756	svcr.exe
2732	FB3.exe
2504	svcr.exe

Identifies Wine through registry keys 2 TTPs 3 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

T1497

Processes:

751acdffdab84a688d4cebf79852b049.exesvcr.exesvcr.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Wine	751acdffdab84a688d4cebf79852b049.exe
Key opened	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Wine	svcr.exe
Key opened	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Wine	svcr.exe

Loads dropped DLL 4 IoCs

Processes:

751acdffdab84a688d4cebf79852b049.exe

pid	Process
2956	751acdffdab84a688d4cebf79852b049.exe
2956	751acdffdab84a688d4cebf79852b049.exe
2956	751acdffdab84a688d4cebf79852b049.exe
2956	751acdffdab84a688d4cebf79852b049.exe

Themida packer 12 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/files/0x000b000000012223-13.dat	themida
behavioral1/files/0x000b000000012223-15.dat	themida
behavioral1/files/0x000b000000012223-22.dat	themida
behavioral1/files/0x000b000000012223-17.dat	themida
behavioral1/memory/2756-31-0x0000000000400000-0x000000000056E000-memory.dmp	themida
behavioral1/memory/2756-36-0x0000000000400000-0x000000000056E000-memory.dmp	themida
behavioral1/memory/2504-59-0x0000000000400000-0x000000000056E000-memory.dmp	themida
behavioral1/files/0x0027000000014c1d-57.dat	themida
behavioral1/memory/2504-77-0x0000000000400000-0x000000000056E000-memory.dmp	themida
behavioral1/memory/2504-60-0x0000000000400000-0x000000000056E000-memory.dmp	themida
behavioral1/memory/2756-55-0x0000000000400000-0x000000000056E000-memory.dmp	themida
behavioral1/files/0x000b000000012223-45.dat	themida

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

svcr.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Windows\\svcr.exe"	svcr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Windows\\svcr.exe"	svcr.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

751acdffdab84a688d4cebf79852b049.exesvcr.exesvcr.exe

pid	Process
2956	751acdffdab84a688d4cebf79852b049.exe
2756	svcr.exe
2504	svcr.exe

Drops file in Windows directory 2 IoCs

Processes:

svcr.exe

description	ioc	Process
File opened for modification	C:\Windows\svcr.exe	svcr.exe
File created	C:\Windows\svcr.exe	svcr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

751acdffdab84a688d4cebf79852b049.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	751acdffdab84a688d4cebf79852b049.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	751acdffdab84a688d4cebf79852b049.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

System Information Discovery

Processes:

751acdffdab84a688d4cebf79852b049.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosDate	751acdffdab84a688d4cebf79852b049.exe

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

Processes:

IEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DCA63261-BBA7-11EE-BD5F-6E3D54FB2439} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412365882"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

751acdffdab84a688d4cebf79852b049.exesvcr.exesvcr.exe

pid	Process
2956	751acdffdab84a688d4cebf79852b049.exe
2756	svcr.exe
2756	svcr.exe
2504	svcr.exe
2504	svcr.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svcr.exe

description	pid	Process
Token: SeDebugPrivilege	2504	svcr.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

IEXPLORE.EXE

pid	Process
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 11 IoCs

Processes:

751acdffdab84a688d4cebf79852b049.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

pid	Process
2956	751acdffdab84a688d4cebf79852b049.exe
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE
1628	IEXPLORE.EXE
1628	IEXPLORE.EXE
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE
1408	IEXPLORE.EXE
1408	IEXPLORE.EXE
1408	IEXPLORE.EXE
1408	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

751acdffdab84a688d4cebf79852b049.exesvcr.exeIEXPLORE.EXEIEXPLORE.EXEsvcr.exeIEXPLORE.EXE

description	pid	Process	procid_target
PID 2956 wrote to memory of 2756	2956	751acdffdab84a688d4cebf79852b049.exe	28
PID 2956 wrote to memory of 2756	2956	751acdffdab84a688d4cebf79852b049.exe	28
PID 2956 wrote to memory of 2756	2956	751acdffdab84a688d4cebf79852b049.exe	28
PID 2956 wrote to memory of 2756	2956	751acdffdab84a688d4cebf79852b049.exe	28
PID 2956 wrote to memory of 2732	2956	751acdffdab84a688d4cebf79852b049.exe	29
PID 2956 wrote to memory of 2732	2956	751acdffdab84a688d4cebf79852b049.exe	29
PID 2956 wrote to memory of 2732	2956	751acdffdab84a688d4cebf79852b049.exe	29
PID 2956 wrote to memory of 2732	2956	751acdffdab84a688d4cebf79852b049.exe	29
PID 2756 wrote to memory of 280	2756	svcr.exe	30
PID 2756 wrote to memory of 280	2756	svcr.exe	30
PID 2756 wrote to memory of 280	2756	svcr.exe	30
PID 2756 wrote to memory of 280	2756	svcr.exe	30
PID 280 wrote to memory of 2904	280	IEXPLORE.EXE	31
PID 280 wrote to memory of 2904	280	IEXPLORE.EXE	31
PID 280 wrote to memory of 2904	280	IEXPLORE.EXE	31
PID 280 wrote to memory of 2904	280	IEXPLORE.EXE	31
PID 2904 wrote to memory of 1628	2904	IEXPLORE.EXE	37
PID 2904 wrote to memory of 1628	2904	IEXPLORE.EXE	37
PID 2904 wrote to memory of 1628	2904	IEXPLORE.EXE	37
PID 2904 wrote to memory of 1628	2904	IEXPLORE.EXE	37
PID 2756 wrote to memory of 2504	2756	svcr.exe	36
PID 2756 wrote to memory of 2504	2756	svcr.exe	36
PID 2756 wrote to memory of 2504	2756	svcr.exe	36
PID 2756 wrote to memory of 2504	2756	svcr.exe	36
PID 2504 wrote to memory of 832	2504	svcr.exe	35
PID 2504 wrote to memory of 832	2504	svcr.exe	35
PID 2504 wrote to memory of 832	2504	svcr.exe	35
PID 2504 wrote to memory of 832	2504	svcr.exe	35
PID 832 wrote to memory of 1340	832	IEXPLORE.EXE	33
PID 832 wrote to memory of 1340	832	IEXPLORE.EXE	33
PID 832 wrote to memory of 1340	832	IEXPLORE.EXE	33
PID 832 wrote to memory of 1340	832	IEXPLORE.EXE	33
PID 2904 wrote to memory of 1408	2904	IEXPLORE.EXE	34
PID 2904 wrote to memory of 1408	2904	IEXPLORE.EXE	34
PID 2904 wrote to memory of 1408	2904	IEXPLORE.EXE	34
PID 2904 wrote to memory of 1408	2904	IEXPLORE.EXE	34
PID 2504 wrote to memory of 1340	2504	svcr.exe	33
PID 2504 wrote to memory of 1340	2504	svcr.exe	33
PID 2504 wrote to memory of 1340	2504	svcr.exe	33
PID 2504 wrote to memory of 1340	2504	svcr.exe	33
PID 2504 wrote to memory of 1340	2504	svcr.exe	33
PID 2504 wrote to memory of 1340	2504	svcr.exe	33
PID 2504 wrote to memory of 1340	2504	svcr.exe	33
PID 2504 wrote to memory of 1340	2504	svcr.exe	33
PID 2504 wrote to memory of 1340	2504	svcr.exe	33
PID 2504 wrote to memory of 1340	2504	svcr.exe	33
PID 2504 wrote to memory of 1340	2504	svcr.exe	33
PID 2504 wrote to memory of 1340	2504	svcr.exe	33
PID 2504 wrote to memory of 1340	2504	svcr.exe	33
PID 2504 wrote to memory of 1340	2504	svcr.exe	33
PID 2504 wrote to memory of 1340	2504	svcr.exe	33
PID 2504 wrote to memory of 1340	2504	svcr.exe	33
PID 2504 wrote to memory of 1340	2504	svcr.exe	33
PID 2504 wrote to memory of 1340	2504	svcr.exe	33
PID 2504 wrote to memory of 1340	2504	svcr.exe	33
PID 2504 wrote to memory of 1340	2504	svcr.exe	33
PID 2504 wrote to memory of 1340	2504	svcr.exe	33
PID 2504 wrote to memory of 1340	2504	svcr.exe	33
PID 2504 wrote to memory of 1340	2504	svcr.exe	33
PID 2504 wrote to memory of 1340	2504	svcr.exe	33
PID 2504 wrote to memory of 1340	2504	svcr.exe	33
PID 2504 wrote to memory of 1340	2504	svcr.exe	33
PID 2504 wrote to memory of 1340	2504	svcr.exe	33
PID 2504 wrote to memory of 1340	2504	svcr.exe	33

C:\Users\Admin\AppData\Local\Temp\751acdffdab84a688d4cebf79852b049.exe
"C:\Users\Admin\AppData\Local\Temp\751acdffdab84a688d4cebf79852b049.exe"
1⤵
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Users\Admin\AppData\Local\Temp\svcr.exe
  "C:\Users\Admin\AppData\Local\Temp\svcr.exe"
  2⤵
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:280
  - - C:\Program Files\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2904
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2904 CREDAT:275465 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1408
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2904 CREDAT:275457 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1628
- - C:\Windows\svcr.exe
    "C:\Windows\svcr.exe" "C:\Users\Admin\AppData\Local\Temp\svcr.exe"
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2504
- C:\Users\Admin\AppData\Local\Temp\FB3.exe
  "C:\Users\Admin\AppData\Local\Temp\FB3.exe"
  2⤵
  - Executes dropped EXE
  PID:2732

C:\Program Files\Internet Explorer\IEXPLORE.EXE
"C:\Program Files\Internet Explorer\IEXPLORE.EXE"
1⤵
PID:1340

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"
1⤵
- Suspicious use of WriteProcessMemory
PID:832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

System Information Discovery