amadey | 5a6fa11b465317c253d25419ecac2c822656b904b4714baaa009c626978048a6

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	A1FA.exe

Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2428	netsh.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	A1FA.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	A1FA.exe

Deletes itself 1 IoCs

pid	Process
1180	Process not Found

Executes dropped EXE 4 IoCs

pid	Process
2496	A1FA.exe
2280	D338.exe
600	4A2C.exe
640	57D4.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Wine	A1FA.exe

Loads dropped DLL 8 IoCs

pid	Process
1564	WerFault.exe
1564	WerFault.exe
1564	WerFault.exe
1564	WerFault.exe
1564	WerFault.exe
2164	WerFault.exe
2164	WerFault.exe
2164	WerFault.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000500000001924d-228.dat	upx
behavioral1/files/0x000500000001924d-232.dat	upx
behavioral1/files/0x000500000001924d-237.dat	upx
behavioral1/files/0x000500000001924d-233.dat	upx
behavioral1/files/0x000500000001924d-241.dat	upx

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	57D4.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2496	A1FA.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorgu.job	A1FA.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1564	2280	WerFault.exe	31
2164	600	WerFault.exe	32
2360	320	WerFault.exe	69

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	5a6fa11b465317c253d25419ecac2c822656b904b4714baaa009c626978048a6.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	5a6fa11b465317c253d25419ecac2c822656b904b4714baaa009c626978048a6.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	5a6fa11b465317c253d25419ecac2c822656b904b4714baaa009c626978048a6.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
560	schtasks.exe
2184	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2664	5a6fa11b465317c253d25419ecac2c822656b904b4714baaa009c626978048a6.exe
2664	5a6fa11b465317c253d25419ecac2c822656b904b4714baaa009c626978048a6.exe
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found
1180	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2664	5a6fa11b465317c253d25419ecac2c822656b904b4714baaa009c626978048a6.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1180	Process not Found
Token: SeShutdownPrivilege	1180	Process not Found

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2496	A1FA.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 2496	1180	Process not Found	28
PID 1180 wrote to memory of 2496	1180	Process not Found	28
PID 1180 wrote to memory of 2496	1180	Process not Found	28
PID 1180 wrote to memory of 2496	1180	Process not Found	28
PID 1180 wrote to memory of 2280	1180	Process not Found	31
PID 1180 wrote to memory of 2280	1180	Process not Found	31
PID 1180 wrote to memory of 2280	1180	Process not Found	31
PID 1180 wrote to memory of 2280	1180	Process not Found	31
PID 1180 wrote to memory of 600	1180	Process not Found	32
PID 1180 wrote to memory of 600	1180	Process not Found	32
PID 1180 wrote to memory of 600	1180	Process not Found	32
PID 1180 wrote to memory of 600	1180	Process not Found	32
PID 2280 wrote to memory of 1564	2280	D338.exe	33
PID 2280 wrote to memory of 1564	2280	D338.exe	33
PID 2280 wrote to memory of 1564	2280	D338.exe	33
PID 2280 wrote to memory of 1564	2280	D338.exe	33
PID 600 wrote to memory of 2164	600	4A2C.exe	34
PID 600 wrote to memory of 2164	600	4A2C.exe	34
PID 600 wrote to memory of 2164	600	4A2C.exe	34
PID 600 wrote to memory of 2164	600	4A2C.exe	34
PID 1180 wrote to memory of 640	1180	Process not Found	35
PID 1180 wrote to memory of 640	1180	Process not Found	35
PID 1180 wrote to memory of 640	1180	Process not Found	35
PID 1180 wrote to memory of 640	1180	Process not Found	35

C:\Users\Admin\AppData\Local\Temp\5a6fa11b465317c253d25419ecac2c822656b904b4714baaa009c626978048a6.exe
"C:\Users\Admin\AppData\Local\Temp\5a6fa11b465317c253d25419ecac2c822656b904b4714baaa009c626978048a6.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2664

C:\Users\Admin\AppData\Local\Temp\A1FA.exe
C:\Users\Admin\AppData\Local\Temp\A1FA.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
PID:2496

C:\Users\Admin\AppData\Local\Temp\D338.exe
C:\Users\Admin\AppData\Local\Temp\D338.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 564
  2⤵
  - Loads dropped DLL
  - Program crash
  PID:1564

C:\Users\Admin\AppData\Local\Temp\4A2C.exe
C:\Users\Admin\AppData\Local\Temp\4A2C.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 600 -s 124
  2⤵
  - Loads dropped DLL
  - Program crash
  PID:2164

C:\Users\Admin\AppData\Local\Temp\57D4.exe
C:\Users\Admin\AppData\Local\Temp\57D4.exe
1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:640

C:\Users\Admin\AppData\Local\Temp\7E29.exe
C:\Users\Admin\AppData\Local\Temp\7E29.exe
1⤵
PID:2976
- C:\Users\Admin\AppData\Local\Temp\InstallSetup_four.exe
  "C:\Users\Admin\AppData\Local\Temp\InstallSetup_four.exe"
  2⤵
  PID:2848
- - C:\Users\Admin\AppData\Local\Temp\u274.0.exe
    "C:\Users\Admin\AppData\Local\Temp\u274.0.exe"
    3⤵
    PID:2924
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\FCGIJDBAFC.exe"
      4⤵
      PID:1300
    - - C:\Users\Admin\AppData\Local\Temp\FCGIJDBAFC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\FCGIJDBAFC.exe"
        5⤵
        
        PID:3040
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\DGDBAKKJKK.exe"
      4⤵
      PID:3052
- - C:\Users\Admin\AppData\Local\Temp\u274.1.exe
    "C:\Users\Admin\AppData\Local\Temp\u274.1.exe"
    3⤵
    PID:1412
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
      4⤵
      PID:2856
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 1251
        5⤵
        
        PID:2276
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
        5⤵
        Creates scheduled task(s)
        
        PID:560
- C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
  "C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"
  2⤵
  PID:1268
- - C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
    "C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"
    3⤵
    PID:2832
  - - C:\Windows\system32\cmd.exe
      C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
      4⤵
      PID:336
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:2428
  - - C:\Windows\rss\csrss.exe
      C:\Windows\rss\csrss.exe
      4⤵
      PID:2004
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        5⤵
        Creates scheduled task(s)
        
        PID:2184
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        5⤵
        
        PID:1236
    - - C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
        
        "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
        5⤵
        
        PID:1584
    - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        5⤵
        
        PID:1616
- C:\Users\Admin\AppData\Local\Temp\april.exe
  "C:\Users\Admin\AppData\Local\Temp\april.exe"
  2⤵
  PID:2072
- - C:\Users\Admin\AppData\Local\Temp\is-SBRMS.tmp\april.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-SBRMS.tmp\april.tmp" /SL5="$501B2,1478464,54272,C:\Users\Admin\AppData\Local\Temp\april.exe"
    3⤵
    PID:692

C:\Windows\system32\makecab.exe
"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240315010528.log C:\Windows\Logs\CBS\CbsPersist_20240315010528.cab
1⤵
PID:1580

C:\Users\Admin\AppData\Local\Temp\988D.exe
C:\Users\Admin\AppData\Local\Temp\988D.exe
1⤵
PID:2460
- C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
  "C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe"
  2⤵
  PID:2352
- - C:\Users\Admin\AppData\Local\Temp\1000836001\osminog.exe
    "C:\Users\Admin\AppData\Local\Temp\1000836001\osminog.exe"
    3⤵
    PID:2504
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:320
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 320 -s 256
        5⤵
        Program crash
        
        PID:2360
- - C:\Users\Admin\AppData\Local\Temp\1000837001\goldprime1234.exe
    "C:\Users\Admin\AppData\Local\Temp\1000837001\goldprime1234.exe"
    3⤵
    PID:2092
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:1876
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
    3⤵
    PID:1956
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
      4⤵
      PID:1428
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        5⤵
        
        PID:876
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\298544033322_Desktop.zip' -CompressionLevel Optimal
        5⤵
        
        PID:1588
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
    3⤵
    PID:2288
- - C:\Users\Admin\AppData\Local\Temp\1000838001\judith1234.exe
    "C:\Users\Admin\AppData\Local\Temp\1000838001\judith1234.exe"
    3⤵
    PID:2228
  - - C:\Users\Admin\AppData\Local\Temp\onefile_2228_133549384104526000\stub.exe
      "C:\Users\Admin\AppData\Local\Temp\1000838001\judith1234.exe"
      4⤵
      PID:2884
- - C:\Users\Admin\AppData\Local\Temp\1000858001\alex12341.exe
    "C:\Users\Admin\AppData\Local\Temp\1000858001\alex12341.exe"
    3⤵
    PID:2552
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:2512
- - C:\Users\Admin\AppData\Local\Temp\1000865001\TeamFour.exe
    "C:\Users\Admin\AppData\Local\Temp\1000865001\TeamFour.exe"
    3⤵
    PID:1428
- - C:\Users\Admin\AppData\Local\Temp\1000873001\random.exe
    "C:\Users\Admin\AppData\Local\Temp\1000873001\random.exe"
    3⤵
    PID:2852
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\1000874021\random.cmd" "
    3⤵
    PID:1692
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://accounts.google.com/
      4⤵
      PID:2564
- - C:\Users\Admin\AppData\Local\Temp\1000875001\amadka.exe
    "C:\Users\Admin\AppData\Local\Temp\1000875001\amadka.exe"
    3⤵
    PID:3004
  - - C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
      "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
      4⤵
      PID:2788
- - C:\Users\Admin\AppData\Local\Temp\1000903001\lummahelp.exe
    "C:\Users\Admin\AppData\Local\Temp\1000903001\lummahelp.exe"
    3⤵
    PID:2196

C:\Users\Admin\AppData\Local\Temp\CCE6.exe
C:\Users\Admin\AppData\Local\Temp\CCE6.exe
1⤵
PID:2892

C:\Users\Admin\AppData\Local\Temp\DFCB.exe
C:\Users\Admin\AppData\Local\Temp\DFCB.exe
1⤵
PID:1504
- C:\Users\Admin\AppData\Local\Temp\is-BK57R.tmp\DFCB.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-BK57R.tmp\DFCB.tmp" /SL5="$80164,1528077,54272,C:\Users\Admin\AppData\Local\Temp\DFCB.exe"
  2⤵
  PID:2052

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3C4D.dll
1⤵
PID:1488
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3C4D.dll
  2⤵
  PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

T1082

Virtualization/Sandbox Evasion