djvu | c6d317e1eb756b3577414068ac20fc445921f4edd86bef21dbab2d89920e4649

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\svchost.exe = "0"	svchost.exe

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

Processes:

8ED3.exesvchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	8ED3.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	svchost.exe

Downloads MZ/PE file

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

Processes:

8ED3.exesvchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	8ED3.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	svchost.exe

.NET Reactor proctector 11 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource	yara_rule
behavioral2/memory/448-86-0x0000000004D60000-0x0000000004E10000-memory.dmp	net_reactor
behavioral2/memory/448-92-0x0000000004C10000-0x0000000004CBE000-memory.dmp	net_reactor
behavioral2/memory/448-96-0x0000000004C10000-0x0000000004CB9000-memory.dmp	net_reactor
behavioral2/memory/448-98-0x0000000004C10000-0x0000000004CB9000-memory.dmp	net_reactor
behavioral2/memory/448-102-0x0000000004C10000-0x0000000004CB9000-memory.dmp	net_reactor
behavioral2/memory/448-107-0x0000000004C10000-0x0000000004CB9000-memory.dmp	net_reactor
behavioral2/memory/448-112-0x0000000004C10000-0x0000000004CB9000-memory.dmp	net_reactor
behavioral2/memory/448-118-0x0000000004C10000-0x0000000004CB9000-memory.dmp	net_reactor
behavioral2/memory/448-124-0x0000000004C10000-0x0000000004CB9000-memory.dmp	net_reactor
behavioral2/memory/448-137-0x0000000004C10000-0x0000000004CB9000-memory.dmp	net_reactor
behavioral2/memory/448-130-0x0000000004C10000-0x0000000004CB9000-memory.dmp	net_reactor

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

8ED3.exesvchost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8ED3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	8ED3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svchost.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

828C.exeDAF0.exe8ED3.exesvchost.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	828C.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	DAF0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	8ED3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	svchost.exe

Deletes itself 1 IoCs

Processes:

pid process

3420
Drops startup file 1 IoCs

Processes:

828C.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe 828C.exe
Executes dropped EXE 11 IoCs

Processes:

C60F.exeDAF0.exeDAF0.exeDAF0.exeDAF0.exe6E86.exe828C.exe89E0.exe8ED3.exesvchost.exeqemu-ga.exe

pid process

2240 C60F.exe
1568 DAF0.exe
1528 DAF0.exe
3832 DAF0.exe
1720 DAF0.exe
4980 6E86.exe
448 828C.exe
4384 89E0.exe
4028 8ED3.exe
3204 svchost.exe
1600 qemu-ga.exe
Loads dropped DLL 2 IoCs

Processes:

ping.exe

pid process

3376 ping.exe
3376 ping.exe
Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

1524 icacls.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
3420

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe	828C.exe

pid	process
2240	C60F.exe
1568	DAF0.exe
1528	DAF0.exe
3832	DAF0.exe
1720	DAF0.exe
4980	6E86.exe
448	828C.exe
4384	89E0.exe
4028	8ED3.exe
3204	svchost.exe
1600	qemu-ga.exe

pid	process
3376	ping.exe
3376	ping.exe

pid	process
1524	icacls.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\svchost.exe = "0"	svchost.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Processes:

DAF0.exe8ED3.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\8a693bba-b6d2-4101-a9c8-94cbc8138233\\DAF0.exe\" --AutoStart"	DAF0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\""	8ED3.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

Processes:

svchost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

85 api.2ip.ua
86 api.2ip.ua

flow	ioc
85	api.2ip.ua
86	api.2ip.ua

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

8ED3.exesvchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	8ED3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	8ED3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	svchost.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

DAF0.exeDAF0.exesvchost.exe

description	pid	process	target process
PID 1568 set thread context of 1528	1568	DAF0.exe	DAF0.exe
PID 3832 set thread context of 1720	3832	DAF0.exe	DAF0.exe
PID 3204 set thread context of 3376	3204	svchost.exe	ping.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4432	1720	WerFault.exe	DAF0.exe
4852	4980	WerFault.exe	6E86.exe
2696	4980	WerFault.exe	6E86.exe
4852	3376	WerFault.exe	ping.exe
4076	448	WerFault.exe	828C.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

69d761d941e1a7a4721e267e91167b3a.exeC60F.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	69d761d941e1a7a4721e267e91167b3a.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	69d761d941e1a7a4721e267e91167b3a.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	69d761d941e1a7a4721e267e91167b3a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	C60F.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	C60F.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	C60F.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

3348 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

3192 timeout.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

ping.exe

pid process

3376 ping.exe

pid	process
3348	schtasks.exe

pid	process
3192	timeout.exe

pid	process
3376	ping.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

69d761d941e1a7a4721e267e91167b3a.exe

pid	process
1784	69d761d941e1a7a4721e267e91167b3a.exe
1784	69d761d941e1a7a4721e267e91167b3a.exe
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

69d761d941e1a7a4721e267e91167b3a.exeC60F.exe

pid process

1784 69d761d941e1a7a4721e267e91167b3a.exe
2240 C60F.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

Processes:

828C.exe89E0.exe8ED3.exesvchost.exepowershell.exe

description	pid	process
Token: SeShutdownPrivilege	3420
Token: SeCreatePagefilePrivilege	3420
Token: SeShutdownPrivilege	3420
Token: SeCreatePagefilePrivilege	3420
Token: SeShutdownPrivilege	3420
Token: SeCreatePagefilePrivilege	3420
Token: SeShutdownPrivilege	3420
Token: SeCreatePagefilePrivilege	3420
Token: SeDebugPrivilege	448	828C.exe
Token: SeDebugPrivilege	4384	89E0.exe
Token: SeShutdownPrivilege	3420
Token: SeCreatePagefilePrivilege	3420
Token: SeDebugPrivilege	4028	8ED3.exe
Token: SeShutdownPrivilege	3420
Token: SeCreatePagefilePrivilege	3420
Token: SeShutdownPrivilege	3420
Token: SeCreatePagefilePrivilege	3420
Token: SeShutdownPrivilege	3420
Token: SeCreatePagefilePrivilege	3420
Token: SeDebugPrivilege	3204	svchost.exe
Token: SeShutdownPrivilege	3420
Token: SeCreatePagefilePrivilege	3420
Token: SeShutdownPrivilege	3420
Token: SeCreatePagefilePrivilege	3420
Token: SeDebugPrivilege	2496	powershell.exe
Token: SeShutdownPrivilege	3420
Token: SeCreatePagefilePrivilege	3420
Token: SeShutdownPrivilege	3420
Token: SeCreatePagefilePrivilege	3420
Token: SeShutdownPrivilege	3420
Token: SeCreatePagefilePrivilege	3420
Token: SeShutdownPrivilege	3420
Token: SeCreatePagefilePrivilege	3420
Token: SeShutdownPrivilege	3420
Token: SeCreatePagefilePrivilege	3420

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

DAF0.exeDAF0.exeDAF0.exe8ED3.execmd.execmd.exesvchost.exe

description	pid	process	target process
PID 3420 wrote to memory of 2240	3420		C60F.exe
PID 3420 wrote to memory of 2240	3420		C60F.exe
PID 3420 wrote to memory of 2240	3420		C60F.exe
PID 3420 wrote to memory of 1568	3420		DAF0.exe
PID 3420 wrote to memory of 1568	3420		DAF0.exe
PID 3420 wrote to memory of 1568	3420		DAF0.exe
PID 1568 wrote to memory of 1528	1568	DAF0.exe	DAF0.exe
PID 1568 wrote to memory of 1528	1568	DAF0.exe	DAF0.exe
PID 1568 wrote to memory of 1528	1568	DAF0.exe	DAF0.exe
PID 1568 wrote to memory of 1528	1568	DAF0.exe	DAF0.exe
PID 1568 wrote to memory of 1528	1568	DAF0.exe	DAF0.exe
PID 1568 wrote to memory of 1528	1568	DAF0.exe	DAF0.exe
PID 1568 wrote to memory of 1528	1568	DAF0.exe	DAF0.exe
PID 1568 wrote to memory of 1528	1568	DAF0.exe	DAF0.exe
PID 1568 wrote to memory of 1528	1568	DAF0.exe	DAF0.exe
PID 1568 wrote to memory of 1528	1568	DAF0.exe	DAF0.exe
PID 1528 wrote to memory of 1524	1528	DAF0.exe	icacls.exe
PID 1528 wrote to memory of 1524	1528	DAF0.exe	icacls.exe
PID 1528 wrote to memory of 1524	1528	DAF0.exe	icacls.exe
PID 1528 wrote to memory of 3832	1528	DAF0.exe	DAF0.exe
PID 1528 wrote to memory of 3832	1528	DAF0.exe	DAF0.exe
PID 1528 wrote to memory of 3832	1528	DAF0.exe	DAF0.exe
PID 3832 wrote to memory of 1720	3832	DAF0.exe	DAF0.exe
PID 3832 wrote to memory of 1720	3832	DAF0.exe	DAF0.exe
PID 3832 wrote to memory of 1720	3832	DAF0.exe	DAF0.exe
PID 3832 wrote to memory of 1720	3832	DAF0.exe	DAF0.exe
PID 3832 wrote to memory of 1720	3832	DAF0.exe	DAF0.exe
PID 3832 wrote to memory of 1720	3832	DAF0.exe	DAF0.exe
PID 3832 wrote to memory of 1720	3832	DAF0.exe	DAF0.exe
PID 3832 wrote to memory of 1720	3832	DAF0.exe	DAF0.exe
PID 3832 wrote to memory of 1720	3832	DAF0.exe	DAF0.exe
PID 3832 wrote to memory of 1720	3832	DAF0.exe	DAF0.exe
PID 3420 wrote to memory of 4980	3420		6E86.exe
PID 3420 wrote to memory of 4980	3420		6E86.exe
PID 3420 wrote to memory of 4980	3420		6E86.exe
PID 3420 wrote to memory of 448	3420		828C.exe
PID 3420 wrote to memory of 448	3420		828C.exe
PID 3420 wrote to memory of 448	3420		828C.exe
PID 3420 wrote to memory of 4384	3420		89E0.exe
PID 3420 wrote to memory of 4384	3420		89E0.exe
PID 3420 wrote to memory of 4384	3420		89E0.exe
PID 3420 wrote to memory of 4028	3420		8ED3.exe
PID 3420 wrote to memory of 4028	3420		8ED3.exe
PID 3420 wrote to memory of 4028	3420		8ED3.exe
PID 4028 wrote to memory of 3880	4028	8ED3.exe	cmd.exe
PID 4028 wrote to memory of 3880	4028	8ED3.exe	cmd.exe
PID 4028 wrote to memory of 3880	4028	8ED3.exe	cmd.exe
PID 4028 wrote to memory of 5060	4028	8ED3.exe	cmd.exe
PID 4028 wrote to memory of 5060	4028	8ED3.exe	cmd.exe
PID 4028 wrote to memory of 5060	4028	8ED3.exe	cmd.exe
PID 3880 wrote to memory of 3348	3880	cmd.exe	schtasks.exe
PID 3880 wrote to memory of 3348	3880	cmd.exe	schtasks.exe
PID 3880 wrote to memory of 3348	3880	cmd.exe	schtasks.exe
PID 5060 wrote to memory of 3192	5060	cmd.exe	timeout.exe
PID 5060 wrote to memory of 3192	5060	cmd.exe	timeout.exe
PID 5060 wrote to memory of 3192	5060	cmd.exe	timeout.exe
PID 5060 wrote to memory of 3204	5060	cmd.exe	svchost.exe
PID 5060 wrote to memory of 3204	5060	cmd.exe	svchost.exe
PID 5060 wrote to memory of 3204	5060	cmd.exe	svchost.exe
PID 3204 wrote to memory of 2496	3204	svchost.exe	powershell.exe
PID 3204 wrote to memory of 2496	3204	svchost.exe	powershell.exe
PID 3204 wrote to memory of 2496	3204	svchost.exe	powershell.exe
PID 3204 wrote to memory of 1204	3204	svchost.exe	calc.exe
PID 3204 wrote to memory of 1204	3204	svchost.exe	calc.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

svchost.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe

C:\Users\Admin\AppData\Local\Temp\69d761d941e1a7a4721e267e91167b3a.exe
"C:\Users\Admin\AppData\Local\Temp\69d761d941e1a7a4721e267e91167b3a.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1784

C:\Users\Admin\AppData\Local\Temp\C60F.exe
C:\Users\Admin\AppData\Local\Temp\C60F.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2240

C:\Users\Admin\AppData\Local\Temp\DAF0.exe
C:\Users\Admin\AppData\Local\Temp\DAF0.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1568

C:\Users\Admin\AppData\Local\Temp\DAF0.exe
C:\Users\Admin\AppData\Local\Temp\DAF0.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1528

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\8a693bba-b6d2-4101-a9c8-94cbc8138233" /deny *S-1-1-0:(OI)(CI)(DE,DC)
3⤵
- Modifies file permissions
PID:1524

C:\Users\Admin\AppData\Local\Temp\DAF0.exe
"C:\Users\Admin\AppData\Local\Temp\DAF0.exe" --Admin IsNotAutoStart IsNotTask
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3832

C:\Users\Admin\AppData\Local\Temp\DAF0.exe
"C:\Users\Admin\AppData\Local\Temp\DAF0.exe" --Admin IsNotAutoStart IsNotTask
4⤵
- Executes dropped EXE
PID:1720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 568
5⤵
- Program crash
PID:4432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1720 -ip 1720
1⤵
PID:2140

C:\Users\Admin\AppData\Local\Temp\6E86.exe
C:\Users\Admin\AppData\Local\Temp\6E86.exe
1⤵
- Executes dropped EXE
PID:4980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 372
2⤵
- Program crash
PID:4852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 1112
2⤵
- Program crash
PID:2696

C:\Users\Admin\AppData\Local\Temp\828C.exe
C:\Users\Admin\AppData\Local\Temp\828C.exe
1⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:448

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe"
2⤵
- Executes dropped EXE
PID:1600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 1224
2⤵
- Program crash
PID:4076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4980 -ip 4980
1⤵
PID:1060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4980 -ip 4980
1⤵
PID:1064

C:\Users\Admin\AppData\Local\Temp\89E0.exe
C:\Users\Admin\AppData\Local\Temp\89E0.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4384

C:\Users\Admin\AppData\Local\Temp\8ED3.exe
C:\Users\Admin\AppData\Local\Temp\8ED3.exe
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4028

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:3880

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'
3⤵
- Creates scheduled task(s)
PID:3348

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpA36F.tmp.bat""
2⤵
- Suspicious use of WriteProcessMemory
PID:5060

C:\Windows\SysWOW64\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:3192

C:\Users\Admin\AppData\Roaming\svchost.exe
"C:\Users\Admin\AppData\Roaming\svchost.exe"
3⤵
- UAC bypass
- Windows security bypass
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3204

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\svchost.exe" -Force
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2496

C:\Windows\SysWOW64\ping.exe
"C:\Windows\SYSWOW64\ping.exe"
4⤵
- Loads dropped DLL
- Runs ping.exe
PID:3376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 908
5⤵
- Program crash
PID:4852

C:\Windows\SysWOW64\calc.exe
"C:\Windows\SYSWOW64\calc.exe"
4⤵
PID:1204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3376 -ip 3376
1⤵
PID:3444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 448 -ip 448
1⤵
PID:4260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery

Virtualization/Sandbox Evasion