amadey | 3c16fa4ebcf3fbab654c0fde73d78375ffa91e38ee9113725b2e5eecbf647b09

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	File300un.exe

Windows security bypass 2 TTPs 2 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	File300un.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\1000147001\File300un.exe = "0"	File300un.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	3c16fa4ebcf3fbab654c0fde73d78375ffa91e38ee9113725b2e5eecbf647b09.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorgu.exe

Blocklisted process makes network request 2 IoCs

flow	pid	Process
34	1064	rundll32.exe
53	448	rundll32.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3c16fa4ebcf3fbab654c0fde73d78375ffa91e38ee9113725b2e5eecbf647b09.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3c16fa4ebcf3fbab654c0fde73d78375ffa91e38ee9113725b2e5eecbf647b09.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorgu.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	explorgu.exe
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	File300un.exe

Executes dropped EXE 2 IoCs

pid	Process
4316	explorgu.exe
4508	File300un.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Wine	3c16fa4ebcf3fbab654c0fde73d78375ffa91e38ee9113725b2e5eecbf647b09.exe
Key opened	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Wine	explorgu.exe

Loads dropped DLL 3 IoCs

pid	Process
4288	rundll32.exe
1064	rundll32.exe
448	rundll32.exe

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Windows security modification 2 TTPs 3 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	File300un.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	File300un.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\1000147001\File300un.exe = "0"	File300un.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	File300un.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	File300un.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1368	3c16fa4ebcf3fbab654c0fde73d78375ffa91e38ee9113725b2e5eecbf647b09.exe
4316	explorgu.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4508 set thread context of 2872	4508	File300un.exe	95

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorgu.job	3c16fa4ebcf3fbab654c0fde73d78375ffa91e38ee9113725b2e5eecbf647b09.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1368	3c16fa4ebcf3fbab654c0fde73d78375ffa91e38ee9113725b2e5eecbf647b09.exe
1368	3c16fa4ebcf3fbab654c0fde73d78375ffa91e38ee9113725b2e5eecbf647b09.exe
4316	explorgu.exe
4316	explorgu.exe
4792	powershell.exe
4792	powershell.exe
1064	rundll32.exe
1064	rundll32.exe
1064	rundll32.exe
1064	rundll32.exe
1064	rundll32.exe
1064	rundll32.exe
1064	rundll32.exe
1064	rundll32.exe
1064	rundll32.exe
1064	rundll32.exe
4164	powershell.exe
4164	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4792	powershell.exe
Token: SeDebugPrivilege	4164	powershell.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 4508	4316	explorgu.exe	92
PID 4316 wrote to memory of 4508	4316	explorgu.exe	92
PID 4316 wrote to memory of 4508	4316	explorgu.exe	92
PID 4508 wrote to memory of 4792	4508	File300un.exe	93
PID 4508 wrote to memory of 4792	4508	File300un.exe	93
PID 4508 wrote to memory of 4792	4508	File300un.exe	93
PID 4508 wrote to memory of 2872	4508	File300un.exe	95
PID 4508 wrote to memory of 2872	4508	File300un.exe	95
PID 4508 wrote to memory of 2872	4508	File300un.exe	95
PID 4508 wrote to memory of 2872	4508	File300un.exe	95
PID 4508 wrote to memory of 2872	4508	File300un.exe	95
PID 4508 wrote to memory of 2872	4508	File300un.exe	95
PID 4508 wrote to memory of 2872	4508	File300un.exe	95
PID 4508 wrote to memory of 2872	4508	File300un.exe	95
PID 4508 wrote to memory of 2872	4508	File300un.exe	95
PID 4508 wrote to memory of 2872	4508	File300un.exe	95
PID 4508 wrote to memory of 2872	4508	File300un.exe	95
PID 4316 wrote to memory of 4288	4316	explorgu.exe	96
PID 4316 wrote to memory of 4288	4316	explorgu.exe	96
PID 4316 wrote to memory of 4288	4316	explorgu.exe	96
PID 4288 wrote to memory of 1064	4288	rundll32.exe	97
PID 4288 wrote to memory of 1064	4288	rundll32.exe	97
PID 1064 wrote to memory of 2996	1064	rundll32.exe	98
PID 1064 wrote to memory of 2996	1064	rundll32.exe	98
PID 1064 wrote to memory of 4164	1064	rundll32.exe	100
PID 1064 wrote to memory of 4164	1064	rundll32.exe	100
PID 4316 wrote to memory of 448	4316	explorgu.exe	103
PID 4316 wrote to memory of 448	4316	explorgu.exe	103
PID 4316 wrote to memory of 448	4316	explorgu.exe	103

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	File300un.exe

C:\Users\Admin\AppData\Local\Temp\3c16fa4ebcf3fbab654c0fde73d78375ffa91e38ee9113725b2e5eecbf647b09.exe
"C:\Users\Admin\AppData\Local\Temp\3c16fa4ebcf3fbab654c0fde73d78375ffa91e38ee9113725b2e5eecbf647b09.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1368

C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Users\Admin\AppData\Local\Temp\1000147001\File300un.exe
  "C:\Users\Admin\AppData\Local\Temp\1000147001\File300un.exe"
  2⤵
  - UAC bypass
  - Windows security bypass
  - Checks computer location settings
  - Executes dropped EXE
  - Windows security modification
  - Checks whether UAC is enabled
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4508
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000147001\File300un.exe" -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4792
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\SYSWOW64\calc.exe"
    3⤵
    PID:2872
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4288
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1064
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      PID:2996
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\683043812824_Desktop.zip' -CompressionLevel Optimal
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4164
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion