glupteba | adffd52446d0d94c4f726205482a0c062248d6eb35948df937336957cf747db8

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	faeea4484adbb16f4f37872b15d9972a.exe

Windows security bypass 2 TTPs 2 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	faeea4484adbb16f4f37872b15d9972a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\faeea4484adbb16f4f37872b15d9972a.exe = "0"	faeea4484adbb16f4f37872b15d9972a.exe

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	VVnpnaKHnw4FNndvOADi1Q3Q.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 3 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	VVnpnaKHnw4FNndvOADi1Q3Q.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	VVnpnaKHnw4FNndvOADi1Q3Q.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	faeea4484adbb16f4f37872b15d9972a.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	u0dZr9H33Ec0S1zlNEJINfeT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	Install.exe

Drops startup file 10 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ISbUOKykomUcGLZw1H5WAIl8.bat	installutil.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ko1P7c0o8lWEcRWRqVOVtz8I.bat	installutil.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GYiyPPP4hSxFfPagw69M3Pjs.bat	installutil.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\59vrWDlHBExkokRKd950F5Yw.bat	installutil.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fJlE104FbWg1LuWoS3dORcVS.bat	installutil.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2c2b2SMBUTymea20hR98SfDA.bat	installutil.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l8XRhyoxdzcvmdD3jqT2KCD4.bat	installutil.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1spG34qOVJhhyaCqu35zUHQ8.bat	installutil.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\N5DCvEQYAJHdIKXyGGq1Fbft.bat	installutil.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\S9tCFTHDLBwt67UDMwvJIDtC.bat	installutil.exe

Executes dropped EXE 16 IoCs

pid	Process
5060	u0dZr9H33Ec0S1zlNEJINfeT.exe
3280	r6TzlUqnDR3VrU7XauMV5HRr.exe
4872	8h2brbadBcW5yGgQfuKJHTiQ.exe
3612	177Q24bkpNib2gDOmrtpAyv5.exe
4796	6pfOZhMjuxLQ29qWlUydxCHM.exe
2208	qJnkD9aWJx0uqNAAbL2fGiIj.exe
1476	VVnpnaKHnw4FNndvOADi1Q3Q.exe
856	fdoKSCk7yZ3lXZJvEQjDZmYI.exe
1052	u3wk.0.exe
1892	fdoKSCk7yZ3lXZJvEQjDZmYI.exe
2468	Install.exe
4300	fdoKSCk7yZ3lXZJvEQjDZmYI.exe
2428	u3wk.1.exe
5036	fdoKSCk7yZ3lXZJvEQjDZmYI.exe
4292	Install.exe
4428	fdoKSCk7yZ3lXZJvEQjDZmYI.exe

Loads dropped DLL 7 IoCs

pid	Process
856	fdoKSCk7yZ3lXZJvEQjDZmYI.exe
1892	fdoKSCk7yZ3lXZJvEQjDZmYI.exe
4300	fdoKSCk7yZ3lXZJvEQjDZmYI.exe
5036	fdoKSCk7yZ3lXZJvEQjDZmYI.exe
4428	fdoKSCk7yZ3lXZJvEQjDZmYI.exe
1052	u3wk.0.exe
1052	u3wk.0.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Themida packer 11 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x000700000002324f-494.dat	themida
behavioral2/files/0x000700000002324f-508.dat	themida
behavioral2/memory/1476-536-0x00007FF759200000-0x00007FF759B48000-memory.dmp	themida
behavioral2/memory/1476-547-0x00007FF759200000-0x00007FF759B48000-memory.dmp	themida
behavioral2/memory/1476-578-0x00007FF759200000-0x00007FF759B48000-memory.dmp	themida
behavioral2/memory/1476-585-0x00007FF759200000-0x00007FF759B48000-memory.dmp	themida
behavioral2/memory/1476-594-0x00007FF759200000-0x00007FF759B48000-memory.dmp	themida
behavioral2/memory/1476-586-0x00007FF759200000-0x00007FF759B48000-memory.dmp	themida
behavioral2/memory/1476-565-0x00007FF759200000-0x00007FF759B48000-memory.dmp	themida
behavioral2/memory/1476-554-0x00007FF759200000-0x00007FF759B48000-memory.dmp	themida
behavioral2/memory/1476-660-0x00007FF759200000-0x00007FF759B48000-memory.dmp	themida

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023252-516.dat	upx
behavioral2/files/0x0007000000023252-541.dat	upx
behavioral2/files/0x0007000000023252-502.dat	upx
behavioral2/memory/4300-584-0x0000000000520000-0x0000000000A58000-memory.dmp	upx
behavioral2/files/0x0007000000023252-592.dat	upx
behavioral2/files/0x0007000000023266-581.dat	upx
behavioral2/files/0x0007000000023266-580.dat	upx
behavioral2/files/0x0007000000023266-571.dat	upx
behavioral2/files/0x0007000000023265-566.dat	upx
behavioral2/files/0x0007000000023252-612.dat	upx

Windows security modification 2 TTPs 3 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	faeea4484adbb16f4f37872b15d9972a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions	faeea4484adbb16f4f37872b15d9972a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\faeea4484adbb16f4f37872b15d9972a.exe = "0"	faeea4484adbb16f4f37872b15d9972a.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	faeea4484adbb16f4f37872b15d9972a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	faeea4484adbb16f4f37872b15d9972a.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	VVnpnaKHnw4FNndvOADi1Q3Q.exe

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\F:	fdoKSCk7yZ3lXZJvEQjDZmYI.exe
File opened (read-only)	\??\D:	fdoKSCk7yZ3lXZJvEQjDZmYI.exe
File opened (read-only)	\??\F:	fdoKSCk7yZ3lXZJvEQjDZmYI.exe
File opened (read-only)	\??\D:	fdoKSCk7yZ3lXZJvEQjDZmYI.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
28	pastebin.com
30	pastebin.com

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
93	api.myip.com
94	api.myip.com
96	ipinfo.io
97	ipinfo.io

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	VVnpnaKHnw4FNndvOADi1Q3Q.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	VVnpnaKHnw4FNndvOADi1Q3Q.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	VVnpnaKHnw4FNndvOADi1Q3Q.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	VVnpnaKHnw4FNndvOADi1Q3Q.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1476	VVnpnaKHnw4FNndvOADi1Q3Q.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4572 set thread context of 3008	4572	faeea4484adbb16f4f37872b15d9972a.exe	96
PID 4796 set thread context of 1116	4796	6pfOZhMjuxLQ29qWlUydxCHM.exe	109

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 9 IoCs

pid	pid_target	Process	procid_target
692	5060	WerFault.exe	102
3808	1116	WerFault.exe	109
5152	1116	WerFault.exe	109
5700	3612	WerFault.exe	105
800	3280	WerFault.exe	103
5756	4872	WerFault.exe	104
5824	3612	WerFault.exe	105
6084	4872	WerFault.exe	104
6120	3280	WerFault.exe	103

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	u3wk.0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	u3wk.0.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
5288	schtasks.exe
5492	schtasks.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
3040	powershell.exe
3040	powershell.exe
3040	powershell.exe
1052	u3wk.0.exe
1052	u3wk.0.exe
1116	RegAsm.exe
1116	RegAsm.exe
892	dialer.exe
892	dialer.exe
892	dialer.exe
892	dialer.exe
5840	powershell.EXE
5840	powershell.EXE
5960	powershell.exe
5960	powershell.exe
5888	powershell.exe
5888	powershell.exe
5896	powershell.exe
5896	powershell.exe
5888	powershell.exe
5960	powershell.exe
5896	powershell.exe
5840	powershell.EXE

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3040	powershell.exe
Token: SeDebugPrivilege	3008	installutil.exe
Token: SeDebugPrivilege	5840	powershell.EXE
Token: SeDebugPrivilege	5888	powershell.exe
Token: SeDebugPrivilege	5896	powershell.exe
Token: SeDebugPrivilege	5960	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2428	u3wk.1.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 3040	4572	faeea4484adbb16f4f37872b15d9972a.exe	95
PID 4572 wrote to memory of 3040	4572	faeea4484adbb16f4f37872b15d9972a.exe	95
PID 4572 wrote to memory of 3008	4572	faeea4484adbb16f4f37872b15d9972a.exe	96
PID 4572 wrote to memory of 3008	4572	faeea4484adbb16f4f37872b15d9972a.exe	96
PID 4572 wrote to memory of 3008	4572	faeea4484adbb16f4f37872b15d9972a.exe	96
PID 4572 wrote to memory of 3008	4572	faeea4484adbb16f4f37872b15d9972a.exe	96
PID 4572 wrote to memory of 3008	4572	faeea4484adbb16f4f37872b15d9972a.exe	96
PID 4572 wrote to memory of 3008	4572	faeea4484adbb16f4f37872b15d9972a.exe	96
PID 4572 wrote to memory of 3008	4572	faeea4484adbb16f4f37872b15d9972a.exe	96
PID 4572 wrote to memory of 3008	4572	faeea4484adbb16f4f37872b15d9972a.exe	96
PID 4572 wrote to memory of 4488	4572	faeea4484adbb16f4f37872b15d9972a.exe	98
PID 4572 wrote to memory of 4488	4572	faeea4484adbb16f4f37872b15d9972a.exe	98
PID 4572 wrote to memory of 4488	4572	faeea4484adbb16f4f37872b15d9972a.exe	98
PID 3008 wrote to memory of 5060	3008	installutil.exe	102
PID 3008 wrote to memory of 5060	3008	installutil.exe	102
PID 3008 wrote to memory of 5060	3008	installutil.exe	102
PID 3008 wrote to memory of 3280	3008	installutil.exe	103
PID 3008 wrote to memory of 3280	3008	installutil.exe	103
PID 3008 wrote to memory of 3280	3008	installutil.exe	103
PID 3008 wrote to memory of 4872	3008	installutil.exe	104
PID 3008 wrote to memory of 4872	3008	installutil.exe	104
PID 3008 wrote to memory of 4872	3008	installutil.exe	104
PID 3008 wrote to memory of 3612	3008	installutil.exe	105
PID 3008 wrote to memory of 3612	3008	installutil.exe	105
PID 3008 wrote to memory of 3612	3008	installutil.exe	105
PID 3008 wrote to memory of 4796	3008	installutil.exe	106
PID 3008 wrote to memory of 4796	3008	installutil.exe	106
PID 3008 wrote to memory of 4796	3008	installutil.exe	106
PID 3008 wrote to memory of 2208	3008	installutil.exe	108
PID 3008 wrote to memory of 2208	3008	installutil.exe	108
PID 3008 wrote to memory of 2208	3008	installutil.exe	108
PID 4796 wrote to memory of 1116	4796	6pfOZhMjuxLQ29qWlUydxCHM.exe	109
PID 4796 wrote to memory of 1116	4796	6pfOZhMjuxLQ29qWlUydxCHM.exe	109
PID 4796 wrote to memory of 1116	4796	6pfOZhMjuxLQ29qWlUydxCHM.exe	109
PID 5060 wrote to memory of 1052	5060	u0dZr9H33Ec0S1zlNEJINfeT.exe	110
PID 5060 wrote to memory of 1052	5060	u0dZr9H33Ec0S1zlNEJINfeT.exe	110
PID 5060 wrote to memory of 1052	5060	u0dZr9H33Ec0S1zlNEJINfeT.exe	110
PID 4796 wrote to memory of 1116	4796	6pfOZhMjuxLQ29qWlUydxCHM.exe	109
PID 4796 wrote to memory of 1116	4796	6pfOZhMjuxLQ29qWlUydxCHM.exe	109
PID 4796 wrote to memory of 1116	4796	6pfOZhMjuxLQ29qWlUydxCHM.exe	109
PID 4796 wrote to memory of 1116	4796	6pfOZhMjuxLQ29qWlUydxCHM.exe	109
PID 4796 wrote to memory of 1116	4796	6pfOZhMjuxLQ29qWlUydxCHM.exe	109
PID 4796 wrote to memory of 1116	4796	6pfOZhMjuxLQ29qWlUydxCHM.exe	109
PID 4796 wrote to memory of 1116	4796	6pfOZhMjuxLQ29qWlUydxCHM.exe	109
PID 4796 wrote to memory of 1116	4796	6pfOZhMjuxLQ29qWlUydxCHM.exe	109
PID 3008 wrote to memory of 1476	3008	installutil.exe	111
PID 3008 wrote to memory of 1476	3008	installutil.exe	111
PID 3008 wrote to memory of 856	3008	installutil.exe	113
PID 3008 wrote to memory of 856	3008	installutil.exe	113
PID 3008 wrote to memory of 856	3008	installutil.exe	113
PID 2208 wrote to memory of 2468	2208	qJnkD9aWJx0uqNAAbL2fGiIj.exe	114
PID 2208 wrote to memory of 2468	2208	qJnkD9aWJx0uqNAAbL2fGiIj.exe	114
PID 2208 wrote to memory of 2468	2208	qJnkD9aWJx0uqNAAbL2fGiIj.exe	114
PID 856 wrote to memory of 1892	856	fdoKSCk7yZ3lXZJvEQjDZmYI.exe	115
PID 856 wrote to memory of 1892	856	fdoKSCk7yZ3lXZJvEQjDZmYI.exe	115
PID 856 wrote to memory of 1892	856	fdoKSCk7yZ3lXZJvEQjDZmYI.exe	115
PID 856 wrote to memory of 4300	856	fdoKSCk7yZ3lXZJvEQjDZmYI.exe	116
PID 856 wrote to memory of 4300	856	fdoKSCk7yZ3lXZJvEQjDZmYI.exe	116
PID 856 wrote to memory of 4300	856	fdoKSCk7yZ3lXZJvEQjDZmYI.exe	116
PID 5060 wrote to memory of 2428	5060	u0dZr9H33Ec0S1zlNEJINfeT.exe	117
PID 5060 wrote to memory of 2428	5060	u0dZr9H33Ec0S1zlNEJINfeT.exe	117
PID 5060 wrote to memory of 2428	5060	u0dZr9H33Ec0S1zlNEJINfeT.exe	117
PID 856 wrote to memory of 5036	856	fdoKSCk7yZ3lXZJvEQjDZmYI.exe	119
PID 856 wrote to memory of 5036	856	fdoKSCk7yZ3lXZJvEQjDZmYI.exe	119

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	faeea4484adbb16f4f37872b15d9972a.exe

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2644
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:892

C:\Users\Admin\AppData\Local\Temp\faeea4484adbb16f4f37872b15d9972a.exe
"C:\Users\Admin\AppData\Local\Temp\faeea4484adbb16f4f37872b15d9972a.exe"
1⤵
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\faeea4484adbb16f4f37872b15d9972a.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3040
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  - Drops startup file
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3008
- - C:\Users\Admin\Pictures\u0dZr9H33Ec0S1zlNEJINfeT.exe
    "C:\Users\Admin\Pictures\u0dZr9H33Ec0S1zlNEJINfeT.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5060
  - - C:\Users\Admin\AppData\Local\Temp\u3wk.0.exe
      "C:\Users\Admin\AppData\Local\Temp\u3wk.0.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      PID:1052
  - - C:\Users\Admin\AppData\Local\Temp\u3wk.1.exe
      "C:\Users\Admin\AppData\Local\Temp\u3wk.1.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2428
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
        5⤵
        
        PID:2952
      - C:\Windows\SysWOW64\chcp.com
        
        chcp 1251
        6⤵
        
        PID:5140
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
        6⤵
        Creates scheduled task(s)
        
        PID:5288
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 1188
      4⤵
      Program crash
      PID:692
- - C:\Users\Admin\Pictures\r6TzlUqnDR3VrU7XauMV5HRr.exe
    "C:\Users\Admin\Pictures\r6TzlUqnDR3VrU7XauMV5HRr.exe"
    3⤵
    - Executes dropped EXE
    PID:3280
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5896
  - - C:\Users\Admin\Pictures\r6TzlUqnDR3VrU7XauMV5HRr.exe
      "C:\Users\Admin\Pictures\r6TzlUqnDR3VrU7XauMV5HRr.exe"
      4⤵
      PID:4280
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3280 -s 880
      4⤵
      Program crash
      PID:800
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3280 -s 744
      4⤵
      Program crash
      PID:6120
- - C:\Users\Admin\Pictures\8h2brbadBcW5yGgQfuKJHTiQ.exe
    "C:\Users\Admin\Pictures\8h2brbadBcW5yGgQfuKJHTiQ.exe"
    3⤵
    - Executes dropped EXE
    PID:4872
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5960
  - - C:\Users\Admin\Pictures\8h2brbadBcW5yGgQfuKJHTiQ.exe
      "C:\Users\Admin\Pictures\8h2brbadBcW5yGgQfuKJHTiQ.exe"
      4⤵
      PID:5352
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 928
      4⤵
      Program crash
      PID:5756
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 876
      4⤵
      Program crash
      PID:6084
- - C:\Users\Admin\Pictures\177Q24bkpNib2gDOmrtpAyv5.exe
    "C:\Users\Admin\Pictures\177Q24bkpNib2gDOmrtpAyv5.exe"
    3⤵
    - Executes dropped EXE
    PID:3612
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5888
  - - C:\Users\Admin\Pictures\177Q24bkpNib2gDOmrtpAyv5.exe
      "C:\Users\Admin\Pictures\177Q24bkpNib2gDOmrtpAyv5.exe"
      4⤵
      PID:5476
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3612 -s 744
      4⤵
      Program crash
      PID:5700
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3612 -s 472
      4⤵
      Program crash
      PID:5824
- - C:\Users\Admin\Pictures\6pfOZhMjuxLQ29qWlUydxCHM.exe
    "C:\Users\Admin\Pictures\6pfOZhMjuxLQ29qWlUydxCHM.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4796
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Suspicious behavior: EnumeratesProcesses
      PID:1116
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1116 -s 624
        5⤵
        Program crash
        
        PID:3808
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1116 -s 620
        5⤵
        Program crash
        
        PID:5152
- - C:\Users\Admin\Pictures\qJnkD9aWJx0uqNAAbL2fGiIj.exe
    "C:\Users\Admin\Pictures\qJnkD9aWJx0uqNAAbL2fGiIj.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2208
  - - C:\Users\Admin\AppData\Local\Temp\7zSAA2A.tmp\Install.exe
      .\Install.exe
      4⤵
      Executes dropped EXE
      PID:2468
    - - C:\Users\Admin\AppData\Local\Temp\7zSB47B.tmp\Install.exe
        
        .\Install.exe /BwdidwWF "385118" /S
        5⤵
        Checks BIOS information in registry
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Enumerates system info in registry
        
        PID:4292
      - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
        6⤵
        
        PID:1140
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        7⤵
        
        PID:2424
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        8⤵
        
        PID:5192
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        8⤵
        
        PID:5220
      - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
        6⤵
        
        PID:2004
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        7⤵
        
        PID:5128
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        8⤵
        
        PID:5200
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        8⤵
        
        PID:5248
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "gpuKHOQYb" /SC once /ST 02:33:21 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
        6⤵
        Creates scheduled task(s)
        
        PID:5492
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn "gpuKHOQYb"
        6⤵
        
        PID:5720
- - C:\Users\Admin\Pictures\VVnpnaKHnw4FNndvOADi1Q3Q.exe
    "C:\Users\Admin\Pictures\VVnpnaKHnw4FNndvOADi1Q3Q.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:1476
- - C:\Users\Admin\Pictures\fdoKSCk7yZ3lXZJvEQjDZmYI.exe
    "C:\Users\Admin\Pictures\fdoKSCk7yZ3lXZJvEQjDZmYI.exe" --silent --allusers=0
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Enumerates connected drives
    - Suspicious use of WriteProcessMemory
    PID:856
  - - C:\Users\Admin\Pictures\fdoKSCk7yZ3lXZJvEQjDZmYI.exe
      C:\Users\Admin\Pictures\fdoKSCk7yZ3lXZJvEQjDZmYI.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.40 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2c0,0x2ec,0x6f6e21f8,0x6f6e2204,0x6f6e2210
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1892
  - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\fdoKSCk7yZ3lXZJvEQjDZmYI.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\fdoKSCk7yZ3lXZJvEQjDZmYI.exe" --version
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4300
  - - C:\Users\Admin\Pictures\fdoKSCk7yZ3lXZJvEQjDZmYI.exe
      "C:\Users\Admin\Pictures\fdoKSCk7yZ3lXZJvEQjDZmYI.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=856 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240324090635" --session-guid=72a7a3e2-5d8d-4483-8402-482ac00e4641 --server-tracking-blob=NjdmOWYyZmQwNTQ3ZTRiM2EyNGUzNjllZTkzYzAzMTBhM2I4YWQ2MzFmYTMzOTdjMjQ2ODE0MTgwMWY5MTAyNjp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2NyIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTcxMTI3MTE4Ny4zOTE3IiwidXRtIjp7ImNhbXBhaWduIjoiNzY3IiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoibWt0In0sInV1aWQiOiIyZjk3NWQwMC00ZWE5LTQ0MTItOGI0OC1lZmRkZDJhZTRlNjYifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=0C05000000000000
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Enumerates connected drives
      PID:5036
    - - C:\Users\Admin\Pictures\fdoKSCk7yZ3lXZJvEQjDZmYI.exe
        
        C:\Users\Admin\Pictures\fdoKSCk7yZ3lXZJvEQjDZmYI.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.40 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2bc,0x2f8,0x6e4021f8,0x6e402204,0x6e402210
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4428
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  PID:4488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5060 -ip 5060
1⤵
PID:3432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:1796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:2128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1116 -ip 1116
1⤵
PID:1472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1116 -ip 1116
1⤵
PID:1292

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3612 -ip 3612
1⤵
PID:5340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4872 -ip 4872
1⤵
PID:3880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3280 -ip 3280
1⤵
PID:5496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3612 -ip 3612
1⤵
PID:5084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3280 -ip 3280
1⤵
PID:5864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4872 -ip 4872
1⤵
PID:5872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery