amadey | 6e95e17675b684ab0248beae17c5979c0dd060a9f94459bded1181b6c7fdcf22

Virtualization/Sandbox Evasion

Processes:

0e616bcbeeb7aefbb8e197ab039d271d.exeexplorgu.exelegun.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	0e616bcbeeb7aefbb8e197ab039d271d.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorgu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	legun.exe

Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exerundll32.exe

flow pid process

90 1036 rundll32.exe
93 4212 rundll32.exe

flow	pid	process
90	1036	rundll32.exe
93	4212	rundll32.exe

Dave packer 1 IoCs

Detects executable using a packer named 'Dave' by the community, based on a string at the end.

dave

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\1000817001\win.exe	dave

Downloads MZ/PE file
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

2828 netsh.exe

pid	process
2828	netsh.exe

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

explorgu.exelegun.exe0e616bcbeeb7aefbb8e197ab039d271d.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	legun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	legun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	0e616bcbeeb7aefbb8e197ab039d271d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	0e616bcbeeb7aefbb8e197ab039d271d.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

newsun.exeRegAsm.exeSTAR.exeexplorgu.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	newsun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	STAR.exe
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	explorgu.exe

Executes dropped EXE 25 IoCs

Processes:

explorgu.exelegun.exeosminog.exegoldprime123.exelumma28282828.exejuditttt.exestub.exedaisy123.exejokerpos.exenewsun.exe4767d2e713f2021e8fe856e3ea638b58.exewin.exesad182772.exealexlll.exeSTAR.exeolehpsp.exeInstallSetup3.exe4767d2e713f2021e8fe856e3ea638b58.exensvB7F4.tmpqemu-ga.execsrss.exeinjector.exenewsun.exewindefender.exewindefender.exe

pid	process
2304	explorgu.exe
4244	legun.exe
4764	osminog.exe
3800	goldprime123.exe
4352	lumma28282828.exe
3784	juditttt.exe
3552	stub.exe
1480	daisy123.exe
2496	jokerpos.exe
2072	newsun.exe
2552	4767d2e713f2021e8fe856e3ea638b58.exe
8	win.exe
4172	sad182772.exe
3488	alexlll.exe
4824	STAR.exe
4132	olehpsp.exe
2860	InstallSetup3.exe
4108	4767d2e713f2021e8fe856e3ea638b58.exe
1336	nsvB7F4.tmp
3632	qemu-ga.exe
1924	csrss.exe
3112	injector.exe
4444	newsun.exe
3412	windefender.exe
2468	windefender.exe

Identifies Wine through registry keys 2 TTPs 3 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

Processes:

legun.exe0e616bcbeeb7aefbb8e197ab039d271d.exeexplorgu.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Wine	legun.exe
Key opened	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Wine	0e616bcbeeb7aefbb8e197ab039d271d.exe
Key opened	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Wine	explorgu.exe

Loads dropped DLL 45 IoCs

Processes:

rundll32.exerundll32.exestub.exerundll32.exeRegAsm.exeInstallSetup3.exeRegAsm.exensvB7F4.tmp

pid	process
4016	rundll32.exe
1036	rundll32.exe
3552	stub.exe
3552	stub.exe
3552	stub.exe
3552	stub.exe
3552	stub.exe
3552	stub.exe
3552	stub.exe
3552	stub.exe
3552	stub.exe
3552	stub.exe
3552	stub.exe
3552	stub.exe
3552	stub.exe
3552	stub.exe
3552	stub.exe
3552	stub.exe
3552	stub.exe
3552	stub.exe
3552	stub.exe
3552	stub.exe
3552	stub.exe
3552	stub.exe
3552	stub.exe
3552	stub.exe
3552	stub.exe
3552	stub.exe
3552	stub.exe
3552	stub.exe
3552	stub.exe
3552	stub.exe
3552	stub.exe
4212	rundll32.exe
2576	RegAsm.exe
2576	RegAsm.exe
2860	InstallSetup3.exe
2860	InstallSetup3.exe
2860	InstallSetup3.exe
5080	RegAsm.exe
5080	RegAsm.exe
1336	nsvB7F4.tmp
1336	nsvB7F4.tmp
2860	InstallSetup3.exe
2860	InstallSetup3.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorgu.exe4767d2e713f2021e8fe856e3ea638b58.execsrss.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\legun.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000805001\\legun.exe"	explorgu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
rootkit evasion

Processes:

csrss.exe

description ioc process

File opened for modification \??\WinMonFS csrss.exe

description	ioc	process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 7 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

0e616bcbeeb7aefbb8e197ab039d271d.exeexplorgu.exelegun.exe

pid process

1308 0e616bcbeeb7aefbb8e197ab039d271d.exe
2304 explorgu.exe
4244 legun.exe

Suspicious use of SetThreadContext 7 IoCs

Processes:

osminog.exegoldprime123.exelumma28282828.exejokerpos.exedaisy123.exesad182772.exealexlll.exe

description	pid	process	target process
PID 4764 set thread context of 4680	4764	osminog.exe	RegAsm.exe
PID 3800 set thread context of 4516	3800	goldprime123.exe	RegAsm.exe
PID 4352 set thread context of 2488	4352	lumma28282828.exe	RegAsm.exe
PID 2496 set thread context of 2576	2496	jokerpos.exe	RegAsm.exe
PID 1480 set thread context of 4952	1480	daisy123.exe	RegAsm.exe
PID 4172 set thread context of 5080	4172	sad182772.exe	RegAsm.exe
PID 3488 set thread context of 1424	3488	alexlll.exe	RegAsm.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

4767d2e713f2021e8fe856e3ea638b58.exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN 4767d2e713f2021e8fe856e3ea638b58.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	4767d2e713f2021e8fe856e3ea638b58.exe

Drops file in Windows directory 5 IoCs

Processes:

0e616bcbeeb7aefbb8e197ab039d271d.exe4767d2e713f2021e8fe856e3ea638b58.execsrss.exe

description	ioc	process
File created	C:\Windows\Tasks\explorgu.job	0e616bcbeeb7aefbb8e197ab039d271d.exe
File opened for modification	C:\Windows\rss	4767d2e713f2021e8fe856e3ea638b58.exe
File created	C:\Windows\rss\csrss.exe	4767d2e713f2021e8fe856e3ea638b58.exe
File created	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\windefender.exe	csrss.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

3776 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4832 1336 WerFault.exe nsvB7F4.tmp

pid	process
3776	sc.exe

pid	pid_target	process	target process
4832	1336	WerFault.exe	nsvB7F4.tmp

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

RegAsm.exeRegAsm.exensvB7F4.tmp

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	nsvB7F4.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	nsvB7F4.tmp
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe

Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

4132 schtasks.exe
2416 schtasks.exe
736 schtasks.exe
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.

System Information Discovery
T1082

Processes:

WMIC.exe

pid process

464 WMIC.exe
Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery
T1057

Processes:

tasklist.exetasklist.exe

pid process

2756 tasklist.exe
320 tasklist.exe

pid	process
4132	schtasks.exe
2416	schtasks.exe
736	schtasks.exe

pid	process
464	WMIC.exe

pid	process
2756	tasklist.exe
320	tasklist.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exe4767d2e713f2021e8fe856e3ea638b58.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-221 = "Alaskan Daylight Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2571 = "Turks and Caicos Daylight Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2511 = "Lord Howe Daylight Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2872 = "Magallanes Standard Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-371 = "Jerusalem Daylight Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1892 = "Russia TZ 3 Standard Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2431 = "Cuba Daylight Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1972 = "Belarus Standard Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2751 = "Tomsk Daylight Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2321 = "Sakhalin Daylight Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2162 = "Altai Standard Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time"	4767d2e713f2021e8fe856e3ea638b58.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

0e616bcbeeb7aefbb8e197ab039d271d.exeexplorgu.exelegun.exerundll32.exepowershell.exeRegAsm.exeRegAsm.exepowershell.exe4767d2e713f2021e8fe856e3ea638b58.exeSTAR.exepowershell.exeRegAsm.exe4767d2e713f2021e8fe856e3ea638b58.exeolehpsp.exepowershell.exepowershell.exepowershell.exe

pid	process
1308	0e616bcbeeb7aefbb8e197ab039d271d.exe
1308	0e616bcbeeb7aefbb8e197ab039d271d.exe
2304	explorgu.exe
2304	explorgu.exe
4244	legun.exe
4244	legun.exe
1036	rundll32.exe
1036	rundll32.exe
1036	rundll32.exe
1036	rundll32.exe
1036	rundll32.exe
1036	rundll32.exe
1036	rundll32.exe
1036	rundll32.exe
1036	rundll32.exe
1036	rundll32.exe
832	powershell.exe
832	powershell.exe
4516	RegAsm.exe
4516	RegAsm.exe
4516	RegAsm.exe
4516	RegAsm.exe
4516	RegAsm.exe
2576	RegAsm.exe
2576	RegAsm.exe
832	powershell.exe
832	powershell.exe
2576	RegAsm.exe
2576	RegAsm.exe
2552	4767d2e713f2021e8fe856e3ea638b58.exe
2552	4767d2e713f2021e8fe856e3ea638b58.exe
4824	STAR.exe
4824	STAR.exe
2496	powershell.exe
2496	powershell.exe
2496	powershell.exe
5080	RegAsm.exe
5080	RegAsm.exe
4108	4767d2e713f2021e8fe856e3ea638b58.exe
4108	4767d2e713f2021e8fe856e3ea638b58.exe
4108	4767d2e713f2021e8fe856e3ea638b58.exe
4108	4767d2e713f2021e8fe856e3ea638b58.exe
4108	4767d2e713f2021e8fe856e3ea638b58.exe
4108	4767d2e713f2021e8fe856e3ea638b58.exe
4108	4767d2e713f2021e8fe856e3ea638b58.exe
4108	4767d2e713f2021e8fe856e3ea638b58.exe
4108	4767d2e713f2021e8fe856e3ea638b58.exe
4108	4767d2e713f2021e8fe856e3ea638b58.exe
4132	olehpsp.exe
4132	olehpsp.exe
4132	olehpsp.exe
4132	olehpsp.exe
4168	powershell.exe
4168	powershell.exe
4168	powershell.exe
5080	RegAsm.exe
5080	RegAsm.exe
4132	olehpsp.exe
4132	olehpsp.exe
2428	powershell.exe
2428	powershell.exe
2428	powershell.exe
3600	powershell.exe
3600	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

goldprime123.exepowershell.exeRegAsm.exeWMIC.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	3800	goldprime123.exe
Token: SeDebugPrivilege	832	powershell.exe
Token: SeDebugPrivilege	4516	RegAsm.exe
Token: SeIncreaseQuotaPrivilege	464	WMIC.exe
Token: SeSecurityPrivilege	464	WMIC.exe
Token: SeTakeOwnershipPrivilege	464	WMIC.exe
Token: SeLoadDriverPrivilege	464	WMIC.exe
Token: SeSystemProfilePrivilege	464	WMIC.exe
Token: SeSystemtimePrivilege	464	WMIC.exe
Token: SeProfSingleProcessPrivilege	464	WMIC.exe
Token: SeIncBasePriorityPrivilege	464	WMIC.exe
Token: SeCreatePagefilePrivilege	464	WMIC.exe
Token: SeBackupPrivilege	464	WMIC.exe
Token: SeRestorePrivilege	464	WMIC.exe
Token: SeShutdownPrivilege	464	WMIC.exe
Token: SeDebugPrivilege	464	WMIC.exe
Token: SeSystemEnvironmentPrivilege	464	WMIC.exe
Token: SeRemoteShutdownPrivilege	464	WMIC.exe
Token: SeUndockPrivilege	464	WMIC.exe
Token: SeManageVolumePrivilege	464	WMIC.exe
Token: 33	464	WMIC.exe
Token: 34	464	WMIC.exe
Token: 35	464	WMIC.exe
Token: 36	464	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3448	WMIC.exe
Token: SeSecurityPrivilege	3448	WMIC.exe
Token: SeTakeOwnershipPrivilege	3448	WMIC.exe
Token: SeLoadDriverPrivilege	3448	WMIC.exe
Token: SeSystemProfilePrivilege	3448	WMIC.exe
Token: SeSystemtimePrivilege	3448	WMIC.exe
Token: SeProfSingleProcessPrivilege	3448	WMIC.exe
Token: SeIncBasePriorityPrivilege	3448	WMIC.exe
Token: SeCreatePagefilePrivilege	3448	WMIC.exe
Token: SeBackupPrivilege	3448	WMIC.exe
Token: SeRestorePrivilege	3448	WMIC.exe
Token: SeShutdownPrivilege	3448	WMIC.exe
Token: SeDebugPrivilege	3448	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3448	WMIC.exe
Token: SeRemoteShutdownPrivilege	3448	WMIC.exe
Token: SeUndockPrivilege	3448	WMIC.exe
Token: SeManageVolumePrivilege	3448	WMIC.exe
Token: 33	3448	WMIC.exe
Token: 34	3448	WMIC.exe
Token: 35	3448	WMIC.exe
Token: 36	3448	WMIC.exe
Token: SeIncreaseQuotaPrivilege	464	WMIC.exe
Token: SeSecurityPrivilege	464	WMIC.exe
Token: SeTakeOwnershipPrivilege	464	WMIC.exe
Token: SeLoadDriverPrivilege	464	WMIC.exe
Token: SeSystemProfilePrivilege	464	WMIC.exe
Token: SeSystemtimePrivilege	464	WMIC.exe
Token: SeProfSingleProcessPrivilege	464	WMIC.exe
Token: SeIncBasePriorityPrivilege	464	WMIC.exe
Token: SeCreatePagefilePrivilege	464	WMIC.exe
Token: SeBackupPrivilege	464	WMIC.exe
Token: SeRestorePrivilege	464	WMIC.exe
Token: SeShutdownPrivilege	464	WMIC.exe
Token: SeDebugPrivilege	464	WMIC.exe
Token: SeSystemEnvironmentPrivilege	464	WMIC.exe
Token: SeRemoteShutdownPrivilege	464	WMIC.exe
Token: SeUndockPrivilege	464	WMIC.exe
Token: SeManageVolumePrivilege	464	WMIC.exe
Token: 33	464	WMIC.exe
Token: 34	464	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

explorgu.exeosminog.exegoldprime123.exelumma28282828.exerundll32.exerundll32.exejuditttt.exestub.exe

description	pid	process	target process
PID 2304 wrote to memory of 4244	2304	explorgu.exe	legun.exe
PID 2304 wrote to memory of 4244	2304	explorgu.exe	legun.exe
PID 2304 wrote to memory of 4244	2304	explorgu.exe	legun.exe
PID 2304 wrote to memory of 4764	2304	explorgu.exe	osminog.exe
PID 2304 wrote to memory of 4764	2304	explorgu.exe	osminog.exe
PID 2304 wrote to memory of 4764	2304	explorgu.exe	osminog.exe
PID 4764 wrote to memory of 4680	4764	osminog.exe	RegAsm.exe
PID 4764 wrote to memory of 4680	4764	osminog.exe	RegAsm.exe
PID 4764 wrote to memory of 4680	4764	osminog.exe	RegAsm.exe
PID 4764 wrote to memory of 4680	4764	osminog.exe	RegAsm.exe
PID 4764 wrote to memory of 4680	4764	osminog.exe	RegAsm.exe
PID 4764 wrote to memory of 4680	4764	osminog.exe	RegAsm.exe
PID 4764 wrote to memory of 4680	4764	osminog.exe	RegAsm.exe
PID 4764 wrote to memory of 4680	4764	osminog.exe	RegAsm.exe
PID 4764 wrote to memory of 4680	4764	osminog.exe	RegAsm.exe
PID 2304 wrote to memory of 3800	2304	explorgu.exe	goldprime123.exe
PID 2304 wrote to memory of 3800	2304	explorgu.exe	goldprime123.exe
PID 2304 wrote to memory of 3800	2304	explorgu.exe	goldprime123.exe
PID 3800 wrote to memory of 4516	3800	goldprime123.exe	RegAsm.exe
PID 3800 wrote to memory of 4516	3800	goldprime123.exe	RegAsm.exe
PID 3800 wrote to memory of 4516	3800	goldprime123.exe	RegAsm.exe
PID 3800 wrote to memory of 4516	3800	goldprime123.exe	RegAsm.exe
PID 3800 wrote to memory of 4516	3800	goldprime123.exe	RegAsm.exe
PID 3800 wrote to memory of 4516	3800	goldprime123.exe	RegAsm.exe
PID 3800 wrote to memory of 4516	3800	goldprime123.exe	RegAsm.exe
PID 3800 wrote to memory of 4516	3800	goldprime123.exe	RegAsm.exe
PID 2304 wrote to memory of 4352	2304	explorgu.exe	lumma28282828.exe
PID 2304 wrote to memory of 4352	2304	explorgu.exe	lumma28282828.exe
PID 2304 wrote to memory of 4352	2304	explorgu.exe	lumma28282828.exe
PID 4352 wrote to memory of 2488	4352	lumma28282828.exe	RegAsm.exe
PID 4352 wrote to memory of 2488	4352	lumma28282828.exe	RegAsm.exe
PID 4352 wrote to memory of 2488	4352	lumma28282828.exe	RegAsm.exe
PID 4352 wrote to memory of 2488	4352	lumma28282828.exe	RegAsm.exe
PID 4352 wrote to memory of 2488	4352	lumma28282828.exe	RegAsm.exe
PID 4352 wrote to memory of 2488	4352	lumma28282828.exe	RegAsm.exe
PID 4352 wrote to memory of 2488	4352	lumma28282828.exe	RegAsm.exe
PID 4352 wrote to memory of 2488	4352	lumma28282828.exe	RegAsm.exe
PID 4352 wrote to memory of 2488	4352	lumma28282828.exe	RegAsm.exe
PID 2304 wrote to memory of 4016	2304	explorgu.exe	rundll32.exe
PID 2304 wrote to memory of 4016	2304	explorgu.exe	rundll32.exe
PID 2304 wrote to memory of 4016	2304	explorgu.exe	rundll32.exe
PID 4016 wrote to memory of 1036	4016	rundll32.exe	rundll32.exe
PID 4016 wrote to memory of 1036	4016	rundll32.exe	rundll32.exe
PID 1036 wrote to memory of 4768	1036	rundll32.exe	netsh.exe
PID 1036 wrote to memory of 4768	1036	rundll32.exe	netsh.exe
PID 1036 wrote to memory of 832	1036	rundll32.exe	powershell.exe
PID 1036 wrote to memory of 832	1036	rundll32.exe	powershell.exe
PID 2304 wrote to memory of 3784	2304	explorgu.exe	juditttt.exe
PID 2304 wrote to memory of 3784	2304	explorgu.exe	juditttt.exe
PID 3784 wrote to memory of 3552	3784	juditttt.exe	stub.exe
PID 3784 wrote to memory of 3552	3784	juditttt.exe	stub.exe
PID 2304 wrote to memory of 1480	2304	explorgu.exe	daisy123.exe
PID 2304 wrote to memory of 1480	2304	explorgu.exe	daisy123.exe
PID 2304 wrote to memory of 1480	2304	explorgu.exe	daisy123.exe
PID 3552 wrote to memory of 1452	3552	stub.exe	cmd.exe
PID 3552 wrote to memory of 1452	3552	stub.exe	cmd.exe
PID 3552 wrote to memory of 4164	3552	stub.exe	cmd.exe
PID 3552 wrote to memory of 4164	3552	stub.exe	cmd.exe
PID 3552 wrote to memory of 4680	3552	stub.exe	cmd.exe
PID 3552 wrote to memory of 4680	3552	stub.exe	cmd.exe
PID 3552 wrote to memory of 3236	3552	stub.exe	cmd.exe
PID 3552 wrote to memory of 3236	3552	stub.exe	cmd.exe
PID 3552 wrote to memory of 4220	3552	stub.exe	cmd.exe
PID 3552 wrote to memory of 4220	3552	stub.exe	cmd.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\0e616bcbeeb7aefbb8e197ab039d271d.exe
"C:\Users\Admin\AppData\Local\Temp\0e616bcbeeb7aefbb8e197ab039d271d.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1308

C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2304

C:\Users\Admin\AppData\Local\Temp\1000805001\legun.exe
"C:\Users\Admin\AppData\Local\Temp\1000805001\legun.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4244

C:\Users\Admin\AppData\Local\Temp\1000807001\osminog.exe
"C:\Users\Admin\AppData\Local\Temp\1000807001\osminog.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4764

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:4680

C:\Users\Admin\AppData\Local\Temp\1000810001\goldprime123.exe
"C:\Users\Admin\AppData\Local\Temp\1000810001\goldprime123.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3800

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4516

C:\Users\Admin\AppData\Local\Temp\1000811001\lumma28282828.exe
"C:\Users\Admin\AppData\Local\Temp\1000811001\lumma28282828.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4352

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:2488

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4016

C:\Windows\system32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1036

C:\Windows\system32\netsh.exe
netsh wlan show profiles
4⤵
PID:4768

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\831553292808_Desktop.zip' -CompressionLevel Optimal
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:832

C:\Users\Admin\AppData\Local\Temp\1000812001\juditttt.exe
"C:\Users\Admin\AppData\Local\Temp\1000812001\juditttt.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784

C:\Users\Admin\AppData\Local\Temp\onefile_3784_133538731401465048\stub.exe
"C:\Users\Admin\AppData\Local\Temp\1000812001\juditttt.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3552

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "ver"
4⤵
PID:1452

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
4⤵
PID:4164

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
5⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
PID:464

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
4⤵
PID:4680

C:\Windows\System32\Wbem\WMIC.exe
wmic computersystem get Manufacturer
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:3448

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "gdb --version"
4⤵
PID:3236

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist"
4⤵
PID:4220

C:\Windows\system32\tasklist.exe
tasklist
5⤵
- Enumerates processes with tasklist
PID:2756

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
4⤵
PID:3980

C:\Windows\System32\Wbem\WMIC.exe
wmic path Win32_ComputerSystem get Manufacturer
5⤵
PID:2788

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
4⤵
PID:1136

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
5⤵
PID:4116

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist"
4⤵
PID:1924

C:\Windows\system32\tasklist.exe
tasklist
5⤵
- Enumerates processes with tasklist
PID:320

C:\Users\Admin\AppData\Local\Temp\1000814001\daisy123.exe
"C:\Users\Admin\AppData\Local\Temp\1000814001\daisy123.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1480

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:4952

C:\Users\Admin\AppData\Local\Temp\1000815001\jokerpos.exe
"C:\Users\Admin\AppData\Local\Temp\1000815001\jokerpos.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2496

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2576

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:4212

C:\Users\Admin\AppData\Local\Temp\1000816001\newsun.exe
"C:\Users\Admin\AppData\Local\Temp\1000816001\newsun.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:2072

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN newsun.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000816001\newsun.exe" /F
3⤵
- Creates scheduled task(s)
PID:4132

C:\Users\Admin\AppData\Local\Temp\1000150001\4767d2e713f2021e8fe856e3ea638b58.exe
"C:\Users\Admin\AppData\Local\Temp\1000150001\4767d2e713f2021e8fe856e3ea638b58.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2552

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:832

C:\Users\Admin\AppData\Local\Temp\1000150001\4767d2e713f2021e8fe856e3ea638b58.exe
"C:\Users\Admin\AppData\Local\Temp\1000150001\4767d2e713f2021e8fe856e3ea638b58.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4108

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2496

C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
5⤵
PID:1152

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
6⤵
- Modifies Windows Firewall
PID:2828

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4168

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2428

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
PID:1924

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3600

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
6⤵
- Creates scheduled task(s)
PID:2416

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
6⤵
PID:1200

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1044

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4188

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
6⤵
- Executes dropped EXE
PID:3112

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
6⤵
- Creates scheduled task(s)
PID:736

C:\Windows\windefender.exe
"C:\Windows\windefender.exe"
6⤵
- Executes dropped EXE
PID:3412

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
7⤵
PID:652

C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
8⤵
- Launches sc.exe
PID:3776

C:\Users\Admin\AppData\Local\Temp\1000817001\win.exe
"C:\Users\Admin\AppData\Local\Temp\1000817001\win.exe"
2⤵
- Executes dropped EXE
PID:8

C:\Users\Admin\AppData\Local\Temp\1000818001\sad182772.exe
"C:\Users\Admin\AppData\Local\Temp\1000818001\sad182772.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4172

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:5080

C:\Users\Admin\AppData\Local\Temp\1000819001\alexlll.exe
"C:\Users\Admin\AppData\Local\Temp\1000819001\alexlll.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3488

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
- Checks computer location settings
PID:1424

C:\Users\Admin\AppData\Roaming\configurationValue\STAR.exe
"C:\Users\Admin\AppData\Roaming\configurationValue\STAR.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4824

C:\Users\Admin\AppData\Local\Temp\1000816001\qemu-ga.exe
"C:\Users\Admin\AppData\Local\Temp\1000816001\qemu-ga.exe"
5⤵
- Executes dropped EXE
PID:3632

C:\Users\Admin\AppData\Roaming\configurationValue\olehpsp.exe
"C:\Users\Admin\AppData\Roaming\configurationValue\olehpsp.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4132

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
4⤵
PID:736

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:5104

C:\Users\Admin\AppData\Local\Temp\1000826001\InstallSetup3.exe
"C:\Users\Admin\AppData\Local\Temp\1000826001\InstallSetup3.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2860

C:\Users\Admin\AppData\Local\Temp\nsvB7F4.tmp
C:\Users\Admin\AppData\Local\Temp\nsvB7F4.tmp
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:1336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 2044
4⤵
- Program crash
PID:4832

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:1136

C:\Users\Admin\AppData\Local\Temp\1000816001\newsun.exe
C:\Users\Admin\AppData\Local\Temp\1000816001\newsun.exe
1⤵
- Executes dropped EXE
PID:4444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1336 -ip 1336
1⤵
PID:4964

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
PID:2468

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Virtualization/Sandbox Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

Virtualization/Sandbox Evasion

System Information Discovery