amadey | 43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825

Virtualization/Sandbox Evasion

Processes:

43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825.exe43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825.exe43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825.exe

Downloads MZ/PE file
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

1504 netsh.exe

pid	process
1504	netsh.exe

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825.exe

Executes dropped EXE 16 IoCs

Processes:

ISetup8.exeu29k.0.exetoolspub1.exeu29k.1.exeAAKKECFBGI.exe6D7B.exe6D7B.exe6D7B.exe6D7B.exe89BF.exebuild2.exebuild2.exebuild3.exe7086.exe8C8C.exeA082.exe

pid	process
2936	ISetup8.exe
652	u29k.0.exe
304	toolspub1.exe
2360	u29k.1.exe
1328	AAKKECFBGI.exe
32	6D7B.exe
4148	6D7B.exe
1656	6D7B.exe
2284	6D7B.exe
2776	89BF.exe
4840	build2.exe
4436	build2.exe
1724	build3.exe
3060	7086.exe
3704	8C8C.exe
3452	A082.exe

Identifies Wine through registry keys 2 TTPs 3 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

Processes:

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000\Software\Wine	43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825.exe
Key opened	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000\Software\Wine	43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825.exe
Key opened	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000\Software\Wine	43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825.exe

Loads dropped DLL 2 IoCs

Processes:

u29k.0.exe

pid process

652 u29k.0.exe
652 u29k.0.exe
Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

4016 icacls.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
652	u29k.0.exe
652	u29k.0.exe

pid	process
4016	icacls.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\windefender.exe	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

AAKKECFBGI.exe6D7B.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ledger-Live Updater = "C:\\Users\\Admin\\AppData\\Local\\Temp\\AAKKECFBGI.exe"	AAKKECFBGI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\33c275af-1600-4572-a418-42685e86f684\\6D7B.exe\" --AutoStart"	6D7B.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

104 drive.google.com
105 drive.google.com
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

31 api.2ip.ua
32 api.2ip.ua
43 api.2ip.ua
119 ip-api.com

flow	ioc
104	drive.google.com
105	drive.google.com

flow	ioc
31	api.2ip.ua
32	api.2ip.ua
43	api.2ip.ua
119	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

pid	process
4828	43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825.exe
2972	43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825.exe
3140	43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825.exe

Suspicious use of SetThreadContext 5 IoCs

Processes:

6D7B.exe6D7B.exe89BF.exebuild2.exe8C8C.exe

description	pid	process	target process
PID 32 set thread context of 4148	32	6D7B.exe	6D7B.exe
PID 1656 set thread context of 2284	1656	6D7B.exe	6D7B.exe
PID 2776 set thread context of 1136	2776	89BF.exe	RegAsm.exe
PID 4840 set thread context of 4436	4840	build2.exe	build2.exe
PID 3704 set thread context of 1592	3704	8C8C.exe	RegAsm.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

4948 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4948	sc.exe

Program crash 5 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
1880	1136	WerFault.exe	RegAsm.exe
2144	1136	WerFault.exe	RegAsm.exe
3076	4436	WerFault.exe	build2.exe
4884	3060	WerFault.exe	7086.exe
5092	3060	WerFault.exe	7086.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

u29k.1.exetoolspub1.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u29k.1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u29k.1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u29k.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

u29k.0.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	u29k.0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	u29k.0.exe

Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

3320 schtasks.exe
352 schtasks.exe
3844 schtasks.exe
2976 schtasks.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

4000 PING.EXE

pid	process
3320	schtasks.exe
352	schtasks.exe
3844	schtasks.exe
2976	schtasks.exe

pid	process
4000	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825.exetoolspub1.exeu29k.0.exe43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825.exe

pid	process
4828	43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825.exe
4828	43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825.exe
304	toolspub1.exe
304	toolspub1.exe
652	u29k.0.exe
652	u29k.0.exe
2972	43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825.exe
2972	43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825.exe
3416
3416
3416
3416
3416
3416
3416
3416
3416
3416
3416
3416
3416
3416
3416
3416
3416
3416
3416
3416
3416
3416
3416
3416
3416
3416
3416
3416
3416
3416
3416
3416
3416
3416
3416
3416
3416
3416
3416
3416
3416
3416
3416
3416
3416
3416
3416
3416
3416
3416
3416
3416
3416
3416
3416
3416

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

toolspub1.exe

pid process

304 toolspub1.exe

pid	process
304	toolspub1.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

AAKKECFBGI.exeSystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe

description	pid	process
Token: SeShutdownPrivilege	3416
Token: SeCreatePagefilePrivilege	3416
Token: SeShutdownPrivilege	3416
Token: SeCreatePagefilePrivilege	3416
Token: SeShutdownPrivilege	3416
Token: SeCreatePagefilePrivilege	3416
Token: SeShutdownPrivilege	3416
Token: SeCreatePagefilePrivilege	3416
Token: SeShutdownPrivilege	3416
Token: SeCreatePagefilePrivilege	3416
Token: SeShutdownPrivilege	3416
Token: SeCreatePagefilePrivilege	3416
Token: SeShutdownPrivilege	3416
Token: SeCreatePagefilePrivilege	3416
Token: SeDebugPrivilege	1328	AAKKECFBGI.exe
Token: SeShutdownPrivilege	3416
Token: SeCreatePagefilePrivilege	3416
Token: SeShutdownPrivilege	3416
Token: SeCreatePagefilePrivilege	3416
Token: SeShutdownPrivilege	3416
Token: SeCreatePagefilePrivilege	3416
Token: SeShutdownPrivilege	3416
Token: SeCreatePagefilePrivilege	3416
Token: SeShutdownPrivilege	3416
Token: SeCreatePagefilePrivilege	3416
Token: SeShutdownPrivilege	3416
Token: SeCreatePagefilePrivilege	3416
Token: SeDebugPrivilege	4156	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
Token: SeShutdownPrivilege	3416
Token: SeCreatePagefilePrivilege	3416
Token: SeShutdownPrivilege	3416
Token: SeCreatePagefilePrivilege	3416
Token: SeShutdownPrivilege	3416
Token: SeCreatePagefilePrivilege	3416
Token: SeShutdownPrivilege	3416
Token: SeCreatePagefilePrivilege	3416
Token: SeShutdownPrivilege	3416
Token: SeCreatePagefilePrivilege	3416
Token: SeShutdownPrivilege	3416
Token: SeCreatePagefilePrivilege	3416
Token: SeShutdownPrivilege	3416
Token: SeCreatePagefilePrivilege	3416
Token: SeShutdownPrivilege	3416
Token: SeCreatePagefilePrivilege	3416
Token: SeShutdownPrivilege	3416
Token: SeCreatePagefilePrivilege	3416
Token: SeShutdownPrivilege	3416
Token: SeCreatePagefilePrivilege	3416
Token: SeShutdownPrivilege	3416
Token: SeCreatePagefilePrivilege	3416
Token: SeShutdownPrivilege	3416
Token: SeCreatePagefilePrivilege	3416
Token: SeShutdownPrivilege	3416
Token: SeCreatePagefilePrivilege	3416
Token: SeShutdownPrivilege	3416
Token: SeCreatePagefilePrivilege	3416
Token: SeShutdownPrivilege	3416
Token: SeCreatePagefilePrivilege	3416
Token: SeShutdownPrivilege	3416
Token: SeCreatePagefilePrivilege	3416
Token: SeShutdownPrivilege	3416
Token: SeCreatePagefilePrivilege	3416
Token: SeShutdownPrivilege	3416
Token: SeCreatePagefilePrivilege	3416

Suspicious use of FindShellTrayWindow 7 IoCs

Processes:

u29k.1.exe

pid process

2360 u29k.1.exe
2360 u29k.1.exe
2360 u29k.1.exe
2360 u29k.1.exe
2360 u29k.1.exe
2360 u29k.1.exe
2360 u29k.1.exe
Suspicious use of SendNotifyMessage 7 IoCs

Processes:

u29k.1.exe

pid process

2360 u29k.1.exe
2360 u29k.1.exe
2360 u29k.1.exe
2360 u29k.1.exe
2360 u29k.1.exe
2360 u29k.1.exe
2360 u29k.1.exe

pid	process
2360	u29k.1.exe
2360	u29k.1.exe
2360	u29k.1.exe
2360	u29k.1.exe
2360	u29k.1.exe
2360	u29k.1.exe
2360	u29k.1.exe

pid	process
2360	u29k.1.exe
2360	u29k.1.exe
2360	u29k.1.exe
2360	u29k.1.exe
2360	u29k.1.exe
2360	u29k.1.exe
2360	u29k.1.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825.exeISetup8.execmd.exeu29k.0.execmd.exeAAKKECFBGI.execmd.exe6D7B.exeu29k.1.exe6D7B.exe6D7B.exe

description	pid	process	target process
PID 4828 wrote to memory of 3320	4828	43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825.exe	schtasks.exe
PID 4828 wrote to memory of 3320	4828	43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825.exe	schtasks.exe
PID 4828 wrote to memory of 3320	4828	43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825.exe	schtasks.exe
PID 4828 wrote to memory of 2936	4828	43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825.exe	ISetup8.exe
PID 4828 wrote to memory of 2936	4828	43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825.exe	ISetup8.exe
PID 4828 wrote to memory of 2936	4828	43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825.exe	ISetup8.exe
PID 2936 wrote to memory of 652	2936	ISetup8.exe	u29k.0.exe
PID 2936 wrote to memory of 652	2936	ISetup8.exe	u29k.0.exe
PID 2936 wrote to memory of 652	2936	ISetup8.exe	u29k.0.exe
PID 4828 wrote to memory of 304	4828	43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825.exe	toolspub1.exe
PID 4828 wrote to memory of 304	4828	43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825.exe	toolspub1.exe
PID 4828 wrote to memory of 304	4828	43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825.exe	toolspub1.exe
PID 2936 wrote to memory of 2360	2936	ISetup8.exe	u29k.1.exe
PID 2936 wrote to memory of 2360	2936	ISetup8.exe	u29k.1.exe
PID 2936 wrote to memory of 2360	2936	ISetup8.exe	u29k.1.exe
PID 3416 wrote to memory of 2388	3416		cmd.exe
PID 3416 wrote to memory of 2388	3416		cmd.exe
PID 2388 wrote to memory of 872	2388	cmd.exe	reg.exe
PID 2388 wrote to memory of 872	2388	cmd.exe	reg.exe
PID 652 wrote to memory of 3188	652	u29k.0.exe	cmd.exe
PID 652 wrote to memory of 3188	652	u29k.0.exe	cmd.exe
PID 652 wrote to memory of 3188	652	u29k.0.exe	cmd.exe
PID 3188 wrote to memory of 1328	3188	cmd.exe	AAKKECFBGI.exe
PID 3188 wrote to memory of 1328	3188	cmd.exe	AAKKECFBGI.exe
PID 3188 wrote to memory of 1328	3188	cmd.exe	AAKKECFBGI.exe
PID 1328 wrote to memory of 4960	1328	AAKKECFBGI.exe	cmd.exe
PID 1328 wrote to memory of 4960	1328	AAKKECFBGI.exe	cmd.exe
PID 1328 wrote to memory of 4960	1328	AAKKECFBGI.exe	cmd.exe
PID 4960 wrote to memory of 4000	4960	cmd.exe	PING.EXE
PID 4960 wrote to memory of 4000	4960	cmd.exe	PING.EXE
PID 4960 wrote to memory of 4000	4960	cmd.exe	PING.EXE
PID 3416 wrote to memory of 32	3416		6D7B.exe
PID 3416 wrote to memory of 32	3416		6D7B.exe
PID 3416 wrote to memory of 32	3416		6D7B.exe
PID 32 wrote to memory of 4148	32	6D7B.exe	6D7B.exe
PID 32 wrote to memory of 4148	32	6D7B.exe	6D7B.exe
PID 32 wrote to memory of 4148	32	6D7B.exe	6D7B.exe
PID 32 wrote to memory of 4148	32	6D7B.exe	6D7B.exe
PID 32 wrote to memory of 4148	32	6D7B.exe	6D7B.exe
PID 32 wrote to memory of 4148	32	6D7B.exe	6D7B.exe
PID 32 wrote to memory of 4148	32	6D7B.exe	6D7B.exe
PID 32 wrote to memory of 4148	32	6D7B.exe	6D7B.exe
PID 32 wrote to memory of 4148	32	6D7B.exe	6D7B.exe
PID 32 wrote to memory of 4148	32	6D7B.exe	6D7B.exe
PID 2360 wrote to memory of 4156	2360	u29k.1.exe	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
PID 2360 wrote to memory of 4156	2360	u29k.1.exe	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
PID 4148 wrote to memory of 4016	4148	6D7B.exe	icacls.exe
PID 4148 wrote to memory of 4016	4148	6D7B.exe	icacls.exe
PID 4148 wrote to memory of 4016	4148	6D7B.exe	icacls.exe
PID 4148 wrote to memory of 1656	4148	6D7B.exe	6D7B.exe
PID 4148 wrote to memory of 1656	4148	6D7B.exe	6D7B.exe
PID 4148 wrote to memory of 1656	4148	6D7B.exe	6D7B.exe
PID 1656 wrote to memory of 2284	1656	6D7B.exe	6D7B.exe
PID 1656 wrote to memory of 2284	1656	6D7B.exe	6D7B.exe
PID 1656 wrote to memory of 2284	1656	6D7B.exe	6D7B.exe
PID 1656 wrote to memory of 2284	1656	6D7B.exe	6D7B.exe
PID 1656 wrote to memory of 2284	1656	6D7B.exe	6D7B.exe
PID 1656 wrote to memory of 2284	1656	6D7B.exe	6D7B.exe
PID 1656 wrote to memory of 2284	1656	6D7B.exe	6D7B.exe
PID 1656 wrote to memory of 2284	1656	6D7B.exe	6D7B.exe
PID 1656 wrote to memory of 2284	1656	6D7B.exe	6D7B.exe
PID 1656 wrote to memory of 2284	1656	6D7B.exe	6D7B.exe
PID 3416 wrote to memory of 2776	3416		89BF.exe
PID 3416 wrote to memory of 2776	3416		89BF.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825.exe
"C:\Users\Admin\AppData\Local\Temp\43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN 43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825.exe /TR "C:\Users\Admin\AppData\Local\Temp\43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825.exe" /F
  2⤵
  - DcRat
  - Creates scheduled task(s)
  PID:3320
- C:\Users\Admin\AppData\Local\Temp\1000167001\ISetup8.exe
  "C:\Users\Admin\AppData\Local\Temp\1000167001\ISetup8.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2936
- - C:\Users\Admin\AppData\Local\Temp\u29k.0.exe
    "C:\Users\Admin\AppData\Local\Temp\u29k.0.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:652
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\AAKKECFBGI.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3188
    - - C:\Users\Admin\AppData\Local\Temp\AAKKECFBGI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AAKKECFBGI.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1328
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\AAKKECFBGI.exe
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4960
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 2.2.2.2 -n 1 -w 3000
        7⤵
        Runs ping.exe
        
        PID:4000
- - C:\Users\Admin\AppData\Local\Temp\u29k.1.exe
    "C:\Users\Admin\AppData\Local\Temp\u29k.1.exe"
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2360
  - - C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
      "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4156
- C:\Users\Admin\AppData\Local\Temp\1000168001\toolspub1.exe
  "C:\Users\Admin\AppData\Local\Temp\1000168001\toolspub1.exe"
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:304

C:\Users\Admin\AppData\Local\Temp\43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825.exe
C:\Users\Admin\AppData\Local\Temp\43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2972

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3709.bat" "
1⤵
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\system32\reg.exe
  reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
  2⤵
  PID:872

C:\Users\Admin\AppData\Local\Temp\6D7B.exe
C:\Users\Admin\AppData\Local\Temp\6D7B.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:32
- C:\Users\Admin\AppData\Local\Temp\6D7B.exe
  C:\Users\Admin\AppData\Local\Temp\6D7B.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4148
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\33c275af-1600-4572-a418-42685e86f684" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:4016
- - C:\Users\Admin\AppData\Local\Temp\6D7B.exe
    "C:\Users\Admin\AppData\Local\Temp\6D7B.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1656
  - - C:\Users\Admin\AppData\Local\Temp\6D7B.exe
      "C:\Users\Admin\AppData\Local\Temp\6D7B.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Executes dropped EXE
      PID:2284
    - - C:\Users\Admin\AppData\Local\09ea3bee-5c5e-44b3-8b00-47d1e20efb77\build2.exe
        
        "C:\Users\Admin\AppData\Local\09ea3bee-5c5e-44b3-8b00-47d1e20efb77\build2.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4840
      - C:\Users\Admin\AppData\Local\09ea3bee-5c5e-44b3-8b00-47d1e20efb77\build2.exe
        
        "C:\Users\Admin\AppData\Local\09ea3bee-5c5e-44b3-8b00-47d1e20efb77\build2.exe"
        6⤵
        Executes dropped EXE
        
        PID:4436
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 2128
        7⤵
        Program crash
        
        PID:3076
    - - C:\Users\Admin\AppData\Local\09ea3bee-5c5e-44b3-8b00-47d1e20efb77\build3.exe
        
        "C:\Users\Admin\AppData\Local\09ea3bee-5c5e-44b3-8b00-47d1e20efb77\build3.exe"
        5⤵
        Executes dropped EXE
        
        PID:1724
      - C:\Users\Admin\AppData\Local\09ea3bee-5c5e-44b3-8b00-47d1e20efb77\build3.exe
        
        "C:\Users\Admin\AppData\Local\09ea3bee-5c5e-44b3-8b00-47d1e20efb77\build3.exe"
        6⤵
        
        PID:3920
        
        C:\Windows\SysWOW64\schtasks.exe
        
        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
        7⤵
        DcRat
        Creates scheduled task(s)
        
        PID:352

C:\Users\Admin\AppData\Local\Temp\89BF.exe
C:\Users\Admin\AppData\Local\Temp\89BF.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2776
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3652
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1136
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1136 -s 1124
    3⤵
    - Program crash
    PID:2144
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1136 -s 1212
    3⤵
    - Program crash
    PID:1880

C:\Users\Admin\AppData\Local\Temp\43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825.exe
C:\Users\Admin\AppData\Local\Temp\43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3140

C:\Users\Admin\AppData\Local\Temp\7086.exe
C:\Users\Admin\AppData\Local\Temp\7086.exe
1⤵
- Executes dropped EXE
PID:3060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 1040
  2⤵
  - Program crash
  PID:4884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 1084
  2⤵
  - Program crash
  PID:5092

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7578.bat" "
1⤵
PID:3320
- C:\Windows\system32\reg.exe
  reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
  2⤵
  PID:3204

C:\Users\Admin\AppData\Local\Temp\8C8C.exe
C:\Users\Admin\AppData\Local\Temp\8C8C.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3704
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1592

C:\Users\Admin\AppData\Local\Temp\A082.exe
C:\Users\Admin\AppData\Local\Temp\A082.exe
1⤵
- Executes dropped EXE
PID:3452
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  PID:496
- C:\Users\Admin\AppData\Local\Temp\A082.exe
  "C:\Users\Admin\AppData\Local\Temp\A082.exe"
  2⤵
  PID:2532
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    PID:3208
- - C:\Windows\System32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    PID:1316
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:1504
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    PID:3088
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    PID:4956
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    PID:1504
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:1060
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      DcRat
      Creates scheduled task(s)
      PID:3844
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /tn ScheduledUpdate /f
      4⤵
      PID:164
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:3324
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:4132
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      PID:3456
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      DcRat
      Creates scheduled task(s)
      PID:2976
  - - C:\Windows\windefender.exe
      "C:\Windows\windefender.exe"
      4⤵
      PID:1932
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        5⤵
        
        PID:1604
      - C:\Windows\SysWOW64\sc.exe
        
        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        6⤵
        Launches sc.exe
        
        PID:4948

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1280

C:\Users\Admin\AppData\Local\Temp\43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825.exe
C:\Users\Admin\AppData\Local\Temp\43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825.exe
1⤵
PID:4512

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
PID:4640

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
PID:2328

C:\Users\Admin\AppData\Local\Temp\43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825.exe
C:\Users\Admin\AppData\Local\Temp\43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825.exe
1⤵
PID:4428

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
PID:3604

C:\Users\Admin\AppData\Local\Temp\43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825.exe
C:\Users\Admin\AppData\Local\Temp\43b6c8410a80960b00f3785b5123ab440862bdd4496594585c44f4b436ca7825.exe
1⤵
PID:2576

C:\Users\Admin\AppData\Roaming\cudfduf
C:\Users\Admin\AppData\Roaming\cudfduf
1⤵
PID:3088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Virtualization/Sandbox Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery

Virtualization/Sandbox Evasion