amadey | 6e95e17675b684ab0248beae17c5979c0dd060a9f94459bded1181b6c7fdcf22

Virtualization/Sandbox Evasion

Processes:

0e616bcbeeb7aefbb8e197ab039d271d.exeexplorgu.exelegun.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	0e616bcbeeb7aefbb8e197ab039d271d.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorgu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	legun.exe

Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exerundll32.exe

flow pid process

76 2548 rundll32.exe
77 4948 rundll32.exe

flow	pid	process
76	2548	rundll32.exe
77	4948	rundll32.exe

Dave packer 1 IoCs

Detects executable using a packer named 'Dave' by the community, based on a string at the end.

dave

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\1000817001\win.exe	dave

Downloads MZ/PE file
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

836 netsh.exe

pid	process
836	netsh.exe

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

0e616bcbeeb7aefbb8e197ab039d271d.exeexplorgu.exelegun.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	0e616bcbeeb7aefbb8e197ab039d271d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	0e616bcbeeb7aefbb8e197ab039d271d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	legun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	legun.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

STAR.exeexplorgu.exenewsun.exeRegAsm.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	STAR.exe
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	explorgu.exe
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	newsun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	RegAsm.exe

Executes dropped EXE 22 IoCs

Processes:

explorgu.exelegun.exeosminog.exegoldprime123.exelumma28282828.exejuditttt.exedaisy123.exestub.exejokerpos.exenewsun.exe4767d2e713f2021e8fe856e3ea638b58.exewin.exesad182772.exealexlll.exeInstallSetup3.exeolehpsp.exeSTAR.exe4767d2e713f2021e8fe856e3ea638b58.exensl923C.tmpqemu-ga.exenewsun.execsrss.exe

pid	process
3884	explorgu.exe
2304	legun.exe
892	osminog.exe
3804	goldprime123.exe
1120	lumma28282828.exe
3064	juditttt.exe
4584	daisy123.exe
536	stub.exe
1844	jokerpos.exe
3808	newsun.exe
3720	4767d2e713f2021e8fe856e3ea638b58.exe
3068	win.exe
3568	sad182772.exe
4592	alexlll.exe
4260	InstallSetup3.exe
556	olehpsp.exe
1488	STAR.exe
2792	4767d2e713f2021e8fe856e3ea638b58.exe
4200	nsl923C.tmp
1120	qemu-ga.exe
2640	newsun.exe
1616	csrss.exe

Identifies Wine through registry keys 2 TTPs 3 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

Processes:

0e616bcbeeb7aefbb8e197ab039d271d.exeexplorgu.exelegun.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Software\Wine	0e616bcbeeb7aefbb8e197ab039d271d.exe
Key opened	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Software\Wine	explorgu.exe
Key opened	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Software\Wine	legun.exe

Loads dropped DLL 45 IoCs

Processes:

rundll32.exerundll32.exerundll32.exestub.exeRegAsm.exeInstallSetup3.exeRegAsm.exensl923C.tmp

pid	process
4456	rundll32.exe
2548	rundll32.exe
4948	rundll32.exe
536	stub.exe
536	stub.exe
536	stub.exe
536	stub.exe
536	stub.exe
536	stub.exe
536	stub.exe
536	stub.exe
536	stub.exe
536	stub.exe
536	stub.exe
536	stub.exe
536	stub.exe
536	stub.exe
536	stub.exe
536	stub.exe
536	stub.exe
536	stub.exe
536	stub.exe
536	stub.exe
536	stub.exe
536	stub.exe
536	stub.exe
536	stub.exe
536	stub.exe
536	stub.exe
536	stub.exe
536	stub.exe
536	stub.exe
536	stub.exe
536	stub.exe
1996	RegAsm.exe
1996	RegAsm.exe
4260	InstallSetup3.exe
2164	RegAsm.exe
2164	RegAsm.exe
4260	InstallSetup3.exe
4260	InstallSetup3.exe
4200	nsl923C.tmp
4200	nsl923C.tmp
4260	InstallSetup3.exe
4260	InstallSetup3.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

4767d2e713f2021e8fe856e3ea638b58.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	4767d2e713f2021e8fe856e3ea638b58.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

0e616bcbeeb7aefbb8e197ab039d271d.exeexplorgu.exelegun.exe

pid process

928 0e616bcbeeb7aefbb8e197ab039d271d.exe
3884 explorgu.exe
2304 legun.exe

Suspicious use of SetThreadContext 7 IoCs

Processes:

osminog.exegoldprime123.exelumma28282828.exedaisy123.exejokerpos.exesad182772.exealexlll.exe

description	pid	process	target process
PID 892 set thread context of 3984	892	osminog.exe	RegAsm.exe
PID 3804 set thread context of 1004	3804	goldprime123.exe	RegAsm.exe
PID 1120 set thread context of 2244	1120	lumma28282828.exe	RegAsm.exe
PID 4584 set thread context of 1728	4584	daisy123.exe	RegAsm.exe
PID 1844 set thread context of 1996	1844	jokerpos.exe	RegAsm.exe
PID 3568 set thread context of 2164	3568	sad182772.exe	RegAsm.exe
PID 4592 set thread context of 4252	4592	alexlll.exe	RegAsm.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

4767d2e713f2021e8fe856e3ea638b58.exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN 4767d2e713f2021e8fe856e3ea638b58.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	4767d2e713f2021e8fe856e3ea638b58.exe

Drops file in Windows directory 3 IoCs

Processes:

0e616bcbeeb7aefbb8e197ab039d271d.exe4767d2e713f2021e8fe856e3ea638b58.exe

description	ioc	process
File created	C:\Windows\Tasks\explorgu.job	0e616bcbeeb7aefbb8e197ab039d271d.exe
File opened for modification	C:\Windows\rss	4767d2e713f2021e8fe856e3ea638b58.exe
File created	C:\Windows\rss\csrss.exe	4767d2e713f2021e8fe856e3ea638b58.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

5020 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1124 4200 WerFault.exe nsl923C.tmp

pid	process
5020	sc.exe

pid	pid_target	process	target process
1124	4200	WerFault.exe	nsl923C.tmp

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

RegAsm.exensl923C.tmpRegAsm.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	nsl923C.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	nsl923C.tmp
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe

Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

4024 schtasks.exe
3420 schtasks.exe
4484 schtasks.exe
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.

System Information Discovery
T1082

Processes:

WMIC.exe

pid process

1288 WMIC.exe
Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery
T1057

Processes:

tasklist.exetasklist.exe

pid process

2468 tasklist.exe
3916 tasklist.exe

pid	process
4024	schtasks.exe
3420	schtasks.exe
4484	schtasks.exe

pid	process
1288	WMIC.exe

pid	process
2468	tasklist.exe
3916	tasklist.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

4767d2e713f2021e8fe856e3ea638b58.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-592 = "Malay Peninsula Standard Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2841 = "Saratov Daylight Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-371 = "Jerusalem Daylight Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-401 = "Arabic Daylight Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2491 = "Aus Central W. Daylight Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2631 = "Norfolk Daylight Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1501 = "Turkey Daylight Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2161 = "Altai Daylight Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1721 = "Libya Daylight Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)"	4767d2e713f2021e8fe856e3ea638b58.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2772 = "Omsk Standard Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-412 = "E. Africa Standard Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1801 = "Line Islands Daylight Time"	4767d2e713f2021e8fe856e3ea638b58.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

0e616bcbeeb7aefbb8e197ab039d271d.exeexplorgu.exelegun.exerundll32.exepowershell.exeRegAsm.exeRegAsm.exepowershell.exeRegAsm.exeSTAR.exe4767d2e713f2021e8fe856e3ea638b58.exepowershell.exensl923C.tmp4767d2e713f2021e8fe856e3ea638b58.exeolehpsp.exepowershell.exepowershell.exe

pid	process
928	0e616bcbeeb7aefbb8e197ab039d271d.exe
928	0e616bcbeeb7aefbb8e197ab039d271d.exe
3884	explorgu.exe
3884	explorgu.exe
2304	legun.exe
2304	legun.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
2548	rundll32.exe
3128	powershell.exe
3128	powershell.exe
3128	powershell.exe
1004	RegAsm.exe
1004	RegAsm.exe
1004	RegAsm.exe
1004	RegAsm.exe
1004	RegAsm.exe
1996	RegAsm.exe
1996	RegAsm.exe
1996	RegAsm.exe
1996	RegAsm.exe
4280	powershell.exe
4280	powershell.exe
4280	powershell.exe
2164	RegAsm.exe
2164	RegAsm.exe
2164	RegAsm.exe
2164	RegAsm.exe
1488	STAR.exe
1488	STAR.exe
3720	4767d2e713f2021e8fe856e3ea638b58.exe
3720	4767d2e713f2021e8fe856e3ea638b58.exe
2692	powershell.exe
2692	powershell.exe
2692	powershell.exe
4200	nsl923C.tmp
4200	nsl923C.tmp
2792	4767d2e713f2021e8fe856e3ea638b58.exe
2792	4767d2e713f2021e8fe856e3ea638b58.exe
2792	4767d2e713f2021e8fe856e3ea638b58.exe
2792	4767d2e713f2021e8fe856e3ea638b58.exe
556	olehpsp.exe
556	olehpsp.exe
2792	4767d2e713f2021e8fe856e3ea638b58.exe
2792	4767d2e713f2021e8fe856e3ea638b58.exe
2792	4767d2e713f2021e8fe856e3ea638b58.exe
2792	4767d2e713f2021e8fe856e3ea638b58.exe
556	olehpsp.exe
556	olehpsp.exe
2792	4767d2e713f2021e8fe856e3ea638b58.exe
2792	4767d2e713f2021e8fe856e3ea638b58.exe
3396	powershell.exe
3396	powershell.exe
3396	powershell.exe
2616	powershell.exe
2616	powershell.exe
2616	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

goldprime123.exepowershell.exeRegAsm.exeWMIC.exeWMIC.exetasklist.exe

description	pid	process
Token: SeDebugPrivilege	3804	goldprime123.exe
Token: SeDebugPrivilege	3128	powershell.exe
Token: SeDebugPrivilege	1004	RegAsm.exe
Token: SeIncreaseQuotaPrivilege	1524	WMIC.exe
Token: SeSecurityPrivilege	1524	WMIC.exe
Token: SeTakeOwnershipPrivilege	1524	WMIC.exe
Token: SeLoadDriverPrivilege	1524	WMIC.exe
Token: SeSystemProfilePrivilege	1524	WMIC.exe
Token: SeSystemtimePrivilege	1524	WMIC.exe
Token: SeProfSingleProcessPrivilege	1524	WMIC.exe
Token: SeIncBasePriorityPrivilege	1524	WMIC.exe
Token: SeCreatePagefilePrivilege	1524	WMIC.exe
Token: SeBackupPrivilege	1524	WMIC.exe
Token: SeRestorePrivilege	1524	WMIC.exe
Token: SeShutdownPrivilege	1524	WMIC.exe
Token: SeDebugPrivilege	1524	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1524	WMIC.exe
Token: SeRemoteShutdownPrivilege	1524	WMIC.exe
Token: SeUndockPrivilege	1524	WMIC.exe
Token: SeManageVolumePrivilege	1524	WMIC.exe
Token: 33	1524	WMIC.exe
Token: 34	1524	WMIC.exe
Token: 35	1524	WMIC.exe
Token: 36	1524	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1288	WMIC.exe
Token: SeSecurityPrivilege	1288	WMIC.exe
Token: SeTakeOwnershipPrivilege	1288	WMIC.exe
Token: SeLoadDriverPrivilege	1288	WMIC.exe
Token: SeSystemProfilePrivilege	1288	WMIC.exe
Token: SeSystemtimePrivilege	1288	WMIC.exe
Token: SeProfSingleProcessPrivilege	1288	WMIC.exe
Token: SeIncBasePriorityPrivilege	1288	WMIC.exe
Token: SeCreatePagefilePrivilege	1288	WMIC.exe
Token: SeBackupPrivilege	1288	WMIC.exe
Token: SeRestorePrivilege	1288	WMIC.exe
Token: SeShutdownPrivilege	1288	WMIC.exe
Token: SeDebugPrivilege	1288	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1288	WMIC.exe
Token: SeRemoteShutdownPrivilege	1288	WMIC.exe
Token: SeUndockPrivilege	1288	WMIC.exe
Token: SeManageVolumePrivilege	1288	WMIC.exe
Token: 33	1288	WMIC.exe
Token: 34	1288	WMIC.exe
Token: 35	1288	WMIC.exe
Token: 36	1288	WMIC.exe
Token: SeDebugPrivilege	3916	tasklist.exe
Token: SeIncreaseQuotaPrivilege	1288	WMIC.exe
Token: SeSecurityPrivilege	1288	WMIC.exe
Token: SeTakeOwnershipPrivilege	1288	WMIC.exe
Token: SeLoadDriverPrivilege	1288	WMIC.exe
Token: SeSystemProfilePrivilege	1288	WMIC.exe
Token: SeSystemtimePrivilege	1288	WMIC.exe
Token: SeProfSingleProcessPrivilege	1288	WMIC.exe
Token: SeIncBasePriorityPrivilege	1288	WMIC.exe
Token: SeCreatePagefilePrivilege	1288	WMIC.exe
Token: SeBackupPrivilege	1288	WMIC.exe
Token: SeRestorePrivilege	1288	WMIC.exe
Token: SeShutdownPrivilege	1288	WMIC.exe
Token: SeDebugPrivilege	1288	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1288	WMIC.exe
Token: SeRemoteShutdownPrivilege	1288	WMIC.exe
Token: SeUndockPrivilege	1288	WMIC.exe
Token: SeManageVolumePrivilege	1288	WMIC.exe
Token: 33	1288	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

0e616bcbeeb7aefbb8e197ab039d271d.exe

pid process

928 0e616bcbeeb7aefbb8e197ab039d271d.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

explorgu.exeosminog.exegoldprime123.exelumma28282828.exerundll32.exerundll32.exe

description	pid	process	target process
PID 3884 wrote to memory of 2304	3884	explorgu.exe	legun.exe
PID 3884 wrote to memory of 2304	3884	explorgu.exe	legun.exe
PID 3884 wrote to memory of 2304	3884	explorgu.exe	legun.exe
PID 3884 wrote to memory of 892	3884	explorgu.exe	osminog.exe
PID 3884 wrote to memory of 892	3884	explorgu.exe	osminog.exe
PID 3884 wrote to memory of 892	3884	explorgu.exe	osminog.exe
PID 892 wrote to memory of 1420	892	osminog.exe	RegAsm.exe
PID 892 wrote to memory of 1420	892	osminog.exe	RegAsm.exe
PID 892 wrote to memory of 1420	892	osminog.exe	RegAsm.exe
PID 892 wrote to memory of 3228	892	osminog.exe	RegAsm.exe
PID 892 wrote to memory of 3228	892	osminog.exe	RegAsm.exe
PID 892 wrote to memory of 3228	892	osminog.exe	RegAsm.exe
PID 892 wrote to memory of 4360	892	osminog.exe	RegAsm.exe
PID 892 wrote to memory of 4360	892	osminog.exe	RegAsm.exe
PID 892 wrote to memory of 4360	892	osminog.exe	RegAsm.exe
PID 892 wrote to memory of 3984	892	osminog.exe	RegAsm.exe
PID 892 wrote to memory of 3984	892	osminog.exe	RegAsm.exe
PID 892 wrote to memory of 3984	892	osminog.exe	RegAsm.exe
PID 892 wrote to memory of 3984	892	osminog.exe	RegAsm.exe
PID 892 wrote to memory of 3984	892	osminog.exe	RegAsm.exe
PID 892 wrote to memory of 3984	892	osminog.exe	RegAsm.exe
PID 892 wrote to memory of 3984	892	osminog.exe	RegAsm.exe
PID 892 wrote to memory of 3984	892	osminog.exe	RegAsm.exe
PID 892 wrote to memory of 3984	892	osminog.exe	RegAsm.exe
PID 3884 wrote to memory of 3804	3884	explorgu.exe	goldprime123.exe
PID 3884 wrote to memory of 3804	3884	explorgu.exe	goldprime123.exe
PID 3884 wrote to memory of 3804	3884	explorgu.exe	goldprime123.exe
PID 3804 wrote to memory of 1004	3804	goldprime123.exe	RegAsm.exe
PID 3804 wrote to memory of 1004	3804	goldprime123.exe	RegAsm.exe
PID 3804 wrote to memory of 1004	3804	goldprime123.exe	RegAsm.exe
PID 3804 wrote to memory of 1004	3804	goldprime123.exe	RegAsm.exe
PID 3804 wrote to memory of 1004	3804	goldprime123.exe	RegAsm.exe
PID 3804 wrote to memory of 1004	3804	goldprime123.exe	RegAsm.exe
PID 3804 wrote to memory of 1004	3804	goldprime123.exe	RegAsm.exe
PID 3804 wrote to memory of 1004	3804	goldprime123.exe	RegAsm.exe
PID 3884 wrote to memory of 1120	3884	explorgu.exe	lumma28282828.exe
PID 3884 wrote to memory of 1120	3884	explorgu.exe	lumma28282828.exe
PID 3884 wrote to memory of 1120	3884	explorgu.exe	lumma28282828.exe
PID 1120 wrote to memory of 2268	1120	lumma28282828.exe	RegAsm.exe
PID 1120 wrote to memory of 2268	1120	lumma28282828.exe	RegAsm.exe
PID 1120 wrote to memory of 2268	1120	lumma28282828.exe	RegAsm.exe
PID 1120 wrote to memory of 2244	1120	lumma28282828.exe	RegAsm.exe
PID 1120 wrote to memory of 2244	1120	lumma28282828.exe	RegAsm.exe
PID 1120 wrote to memory of 2244	1120	lumma28282828.exe	RegAsm.exe
PID 1120 wrote to memory of 2244	1120	lumma28282828.exe	RegAsm.exe
PID 1120 wrote to memory of 2244	1120	lumma28282828.exe	RegAsm.exe
PID 1120 wrote to memory of 2244	1120	lumma28282828.exe	RegAsm.exe
PID 1120 wrote to memory of 2244	1120	lumma28282828.exe	RegAsm.exe
PID 1120 wrote to memory of 2244	1120	lumma28282828.exe	RegAsm.exe
PID 1120 wrote to memory of 2244	1120	lumma28282828.exe	RegAsm.exe
PID 3884 wrote to memory of 4456	3884	explorgu.exe	rundll32.exe
PID 3884 wrote to memory of 4456	3884	explorgu.exe	rundll32.exe
PID 3884 wrote to memory of 4456	3884	explorgu.exe	rundll32.exe
PID 4456 wrote to memory of 2548	4456	rundll32.exe	rundll32.exe
PID 4456 wrote to memory of 2548	4456	rundll32.exe	rundll32.exe
PID 2548 wrote to memory of 816	2548	rundll32.exe	netsh.exe
PID 2548 wrote to memory of 816	2548	rundll32.exe	netsh.exe
PID 2548 wrote to memory of 3128	2548	rundll32.exe	powershell.exe
PID 2548 wrote to memory of 3128	2548	rundll32.exe	powershell.exe
PID 3884 wrote to memory of 4948	3884	explorgu.exe	rundll32.exe
PID 3884 wrote to memory of 4948	3884	explorgu.exe	rundll32.exe
PID 3884 wrote to memory of 4948	3884	explorgu.exe	rundll32.exe
PID 3884 wrote to memory of 3064	3884	explorgu.exe	juditttt.exe
PID 3884 wrote to memory of 3064	3884	explorgu.exe	juditttt.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\0e616bcbeeb7aefbb8e197ab039d271d.exe
"C:\Users\Admin\AppData\Local\Temp\0e616bcbeeb7aefbb8e197ab039d271d.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:928

C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3884

C:\Users\Admin\AppData\Local\Temp\1000805001\legun.exe
"C:\Users\Admin\AppData\Local\Temp\1000805001\legun.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2304

C:\Users\Admin\AppData\Local\Temp\1000807001\osminog.exe
"C:\Users\Admin\AppData\Local\Temp\1000807001\osminog.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:892

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:1420

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:3228

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:4360

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:3984

C:\Users\Admin\AppData\Local\Temp\1000810001\goldprime123.exe
"C:\Users\Admin\AppData\Local\Temp\1000810001\goldprime123.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3804

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1004

C:\Users\Admin\AppData\Local\Temp\1000811001\lumma28282828.exe
"C:\Users\Admin\AppData\Local\Temp\1000811001\lumma28282828.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1120

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:2268

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:2244

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4456

C:\Windows\system32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2548

C:\Windows\system32\netsh.exe
netsh wlan show profiles
4⤵
PID:816

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\134859772495_Desktop.zip' -CompressionLevel Optimal
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3128

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:4948

C:\Users\Admin\AppData\Local\Temp\1000812001\juditttt.exe
"C:\Users\Admin\AppData\Local\Temp\1000812001\juditttt.exe"
2⤵
- Executes dropped EXE
PID:3064

C:\Users\Admin\AppData\Local\Temp\onefile_3064_133538732096709171\stub.exe
"C:\Users\Admin\AppData\Local\Temp\1000812001\juditttt.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:536

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "ver"
4⤵
PID:2792

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
4⤵
PID:3720

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
5⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
PID:1288

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
4⤵
PID:1500

C:\Windows\System32\Wbem\WMIC.exe
wmic computersystem get Manufacturer
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1524

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "gdb --version"
4⤵
PID:1624

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist"
4⤵
PID:2548

C:\Windows\system32\tasklist.exe
tasklist
5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3916

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
4⤵
PID:2068

C:\Windows\System32\Wbem\WMIC.exe
wmic path Win32_ComputerSystem get Manufacturer
5⤵
PID:3240

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
4⤵
PID:2808

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
5⤵
PID:3844

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist"
4⤵
PID:1092

C:\Windows\system32\tasklist.exe
tasklist
5⤵
- Enumerates processes with tasklist
PID:2468

C:\Users\Admin\AppData\Local\Temp\1000814001\daisy123.exe
"C:\Users\Admin\AppData\Local\Temp\1000814001\daisy123.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4584

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:2472

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:1728

C:\Users\Admin\AppData\Local\Temp\1000815001\jokerpos.exe
"C:\Users\Admin\AppData\Local\Temp\1000815001\jokerpos.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1844

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1996

C:\Users\Admin\AppData\Local\Temp\1000816001\newsun.exe
"C:\Users\Admin\AppData\Local\Temp\1000816001\newsun.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:3808

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN newsun.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000816001\newsun.exe" /F
3⤵
- Creates scheduled task(s)
PID:4024

C:\Users\Admin\AppData\Local\Temp\1000150001\4767d2e713f2021e8fe856e3ea638b58.exe
"C:\Users\Admin\AppData\Local\Temp\1000150001\4767d2e713f2021e8fe856e3ea638b58.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3720

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4280

C:\Users\Admin\AppData\Local\Temp\1000150001\4767d2e713f2021e8fe856e3ea638b58.exe
"C:\Users\Admin\AppData\Local\Temp\1000150001\4767d2e713f2021e8fe856e3ea638b58.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2792

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2692

C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
5⤵
PID:844

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
6⤵
- Modifies Windows Firewall
PID:836

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3396

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2616

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
5⤵
- Executes dropped EXE
PID:1616

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:5028

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
6⤵
- Creates scheduled task(s)
PID:3420

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
6⤵
PID:1292

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2068

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
6⤵
- Modifies data under HKEY_USERS
PID:3056

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
6⤵
PID:3588

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
6⤵
- Creates scheduled task(s)
PID:4484

C:\Windows\windefender.exe
"C:\Windows\windefender.exe"
6⤵
PID:2616

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
7⤵
PID:4240

C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
8⤵
- Launches sc.exe
PID:5020

C:\Users\Admin\AppData\Local\Temp\1000817001\win.exe
"C:\Users\Admin\AppData\Local\Temp\1000817001\win.exe"
2⤵
- Executes dropped EXE
PID:3068

C:\Users\Admin\AppData\Local\Temp\1000818001\sad182772.exe
"C:\Users\Admin\AppData\Local\Temp\1000818001\sad182772.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3568

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2164

C:\Users\Admin\AppData\Local\Temp\1000819001\alexlll.exe
"C:\Users\Admin\AppData\Local\Temp\1000819001\alexlll.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4592

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:4444

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:4312

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
- Checks computer location settings
PID:4252

C:\Users\Admin\AppData\Roaming\configurationValue\olehpsp.exe
"C:\Users\Admin\AppData\Roaming\configurationValue\olehpsp.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:556

C:\Users\Admin\AppData\Roaming\configurationValue\STAR.exe
"C:\Users\Admin\AppData\Roaming\configurationValue\STAR.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1488

C:\Users\Admin\AppData\Local\Temp\1000816001\qemu-ga.exe
"C:\Users\Admin\AppData\Local\Temp\1000816001\qemu-ga.exe"
5⤵
- Executes dropped EXE
PID:1120

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
4⤵
PID:1036

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:1500

C:\Users\Admin\AppData\Local\Temp\1000826001\InstallSetup3.exe
"C:\Users\Admin\AppData\Local\Temp\1000826001\InstallSetup3.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4260

C:\Users\Admin\AppData\Local\Temp\nsl923C.tmp
C:\Users\Admin\AppData\Local\Temp\nsl923C.tmp
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4200 -s 2340
4⤵
- Program crash
PID:1124

C:\Users\Admin\AppData\Local\Temp\1000816001\newsun.exe
C:\Users\Admin\AppData\Local\Temp\1000816001\newsun.exe
1⤵
- Executes dropped EXE
PID:2640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4200 -ip 4200
1⤵
PID:4240

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
PID:2604

C:\Users\Admin\AppData\Local\Temp\1000816001\newsun.exe
C:\Users\Admin\AppData\Local\Temp\1000816001\newsun.exe
1⤵
PID:1448

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Virtualization/Sandbox Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

Virtualization/Sandbox Evasion

System Information Discovery