4e0ddcd303f27c01dcc8a35a9bd821c53fb7dcca474ac7f0c84d3c6451e9f778

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	x.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	x.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	x.exe

Executes dropped EXE 2 IoCs

pid	Process
4672	x.exe
4364	CL_Debug_Log.txt

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Wine	x.exe

AutoIT Executable 4 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral18/memory/4672-6-0x0000000001380000-0x00000000025A6000-memory.dmp	autoit_exe
behavioral18/files/0x000700000001ac2d-29.dat	autoit_exe
behavioral18/files/0x000800000001ac2b-35.dat	autoit_exe
behavioral18/memory/4672-38-0x0000000001380000-0x00000000025A6000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
1532	schtasks.exe

Delays execution with timeout.exe 64 IoCs

evasion

pid	Process
648	timeout.exe
212	timeout.exe
1184	timeout.exe
5024	timeout.exe
3280	timeout.exe
2808	timeout.exe
504	timeout.exe
1792	timeout.exe
3364	timeout.exe
4228	timeout.exe
520	timeout.exe
1816	timeout.exe
4796	timeout.exe
788	timeout.exe
4564	timeout.exe
844	timeout.exe
796	timeout.exe
3568	timeout.exe
5116	timeout.exe
2232	timeout.exe
4796	timeout.exe
4492	timeout.exe
3884	timeout.exe
4636	timeout.exe
2416	timeout.exe
4396	timeout.exe
1172	timeout.exe
2040	timeout.exe
2632	timeout.exe
2140	timeout.exe
3652	timeout.exe
656	timeout.exe
2180	timeout.exe
4304	timeout.exe
3380	timeout.exe
1008	timeout.exe
488	timeout.exe
2628	timeout.exe
2512	timeout.exe
1568	timeout.exe
1312	timeout.exe
4724	timeout.exe
1352	timeout.exe
1360	timeout.exe
1712	timeout.exe
3684	timeout.exe
5076	timeout.exe
3284	timeout.exe
4932	timeout.exe
792	timeout.exe
3752	timeout.exe
3964	timeout.exe
3672	timeout.exe
4352	timeout.exe
2268	timeout.exe
5080	timeout.exe
68	timeout.exe
1676	timeout.exe
4200	timeout.exe
3936	timeout.exe
4748	timeout.exe
3748	timeout.exe
3116	timeout.exe
3252	timeout.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	4364	CL_Debug_Log.txt
Token: 35	4364	CL_Debug_Log.txt
Token: SeSecurityPrivilege	4364	CL_Debug_Log.txt
Token: SeSecurityPrivilege	4364	CL_Debug_Log.txt

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4672	x.exe
4672	x.exe
4672	x.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4672	x.exe
4672	x.exe
4672	x.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3772 wrote to memory of 4672	3772	wscript.exe	75
PID 3772 wrote to memory of 4672	3772	wscript.exe	75
PID 3772 wrote to memory of 4672	3772	wscript.exe	75
PID 4672 wrote to memory of 4364	4672	x.exe	76
PID 4672 wrote to memory of 4364	4672	x.exe	76
PID 4672 wrote to memory of 4364	4672	x.exe	76
PID 4672 wrote to memory of 4396	4672	x.exe	78
PID 4672 wrote to memory of 4396	4672	x.exe	78
PID 4672 wrote to memory of 4396	4672	x.exe	78
PID 4396 wrote to memory of 1532	4396	cmd.exe	80
PID 4396 wrote to memory of 1532	4396	cmd.exe	80
PID 4396 wrote to memory of 1532	4396	cmd.exe	80
PID 4672 wrote to memory of 3940	4672	x.exe	81
PID 4672 wrote to memory of 3940	4672	x.exe	81
PID 4672 wrote to memory of 3940	4672	x.exe	81
PID 3940 wrote to memory of 1712	3940	cmd.exe	83
PID 3940 wrote to memory of 1712	3940	cmd.exe	83
PID 3940 wrote to memory of 1712	3940	cmd.exe	83
PID 3940 wrote to memory of 4196	3940	cmd.exe	84
PID 3940 wrote to memory of 4196	3940	cmd.exe	84
PID 3940 wrote to memory of 4196	3940	cmd.exe	84
PID 3940 wrote to memory of 3588	3940	cmd.exe	85
PID 3940 wrote to memory of 3588	3940	cmd.exe	85
PID 3940 wrote to memory of 3588	3940	cmd.exe	85
PID 3940 wrote to memory of 4792	3940	cmd.exe	86
PID 3940 wrote to memory of 4792	3940	cmd.exe	86
PID 3940 wrote to memory of 4792	3940	cmd.exe	86
PID 3940 wrote to memory of 3444	3940	cmd.exe	87
PID 3940 wrote to memory of 3444	3940	cmd.exe	87
PID 3940 wrote to memory of 3444	3940	cmd.exe	87
PID 3940 wrote to memory of 1608	3940	cmd.exe	88
PID 3940 wrote to memory of 1608	3940	cmd.exe	88
PID 3940 wrote to memory of 1608	3940	cmd.exe	88
PID 3940 wrote to memory of 4932	3940	cmd.exe	89
PID 3940 wrote to memory of 4932	3940	cmd.exe	89
PID 3940 wrote to memory of 4932	3940	cmd.exe	89
PID 3940 wrote to memory of 4228	3940	cmd.exe	90
PID 3940 wrote to memory of 4228	3940	cmd.exe	90
PID 3940 wrote to memory of 4228	3940	cmd.exe	90
PID 3940 wrote to memory of 4240	3940	cmd.exe	91
PID 3940 wrote to memory of 4240	3940	cmd.exe	91
PID 3940 wrote to memory of 4240	3940	cmd.exe	91
PID 3940 wrote to memory of 844	3940	cmd.exe	92
PID 3940 wrote to memory of 844	3940	cmd.exe	92
PID 3940 wrote to memory of 844	3940	cmd.exe	92
PID 3940 wrote to memory of 2044	3940	cmd.exe	93
PID 3940 wrote to memory of 2044	3940	cmd.exe	93
PID 3940 wrote to memory of 2044	3940	cmd.exe	93
PID 3940 wrote to memory of 1072	3940	cmd.exe	94
PID 3940 wrote to memory of 1072	3940	cmd.exe	94
PID 3940 wrote to memory of 1072	3940	cmd.exe	94
PID 3940 wrote to memory of 2092	3940	cmd.exe	95
PID 3940 wrote to memory of 2092	3940	cmd.exe	95
PID 3940 wrote to memory of 2092	3940	cmd.exe	95
PID 3940 wrote to memory of 364	3940	cmd.exe	96
PID 3940 wrote to memory of 364	3940	cmd.exe	96
PID 3940 wrote to memory of 364	3940	cmd.exe	96
PID 3940 wrote to memory of 348	3940	cmd.exe	97
PID 3940 wrote to memory of 348	3940	cmd.exe	97
PID 3940 wrote to memory of 348	3940	cmd.exe	97
PID 3940 wrote to memory of 2024	3940	cmd.exe	183
PID 3940 wrote to memory of 2024	3940	cmd.exe	183
PID 3940 wrote to memory of 2024	3940	cmd.exe	183
PID 3940 wrote to memory of 2628	3940	cmd.exe	184

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\MsMpEng.js
1⤵
- Suspicious use of WriteProcessMemory
PID:3772
- C:\Users\Admin\AppData\Local\Temp\x.exe
  "C:\Users\Admin\AppData\Local\Temp\x.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4672
- - C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt
    C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt e -p"JDQJndnqwdnqw2139dn21n3b312idDQDB" "C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt" -o"C:\Users\Admin\AppData\Local\Temp\"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4364
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4396
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"
      4⤵
      Creates scheduled task(s)
      PID:1532
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c For /L %i In (0,0,0) Do (del "C:\Users\Admin\AppData\Local\Temp\x.exe"&&timeout /t 0&&if not exist "C:\Users\Admin\AppData\Local\Temp\x.exe" exit)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3940
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:1712
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:4196
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:3588
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:4792
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:3444
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:1608
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:4932
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:4228
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:4240
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:844
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:2044
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:1072
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:2092
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:364
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:348
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:2024
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:2628
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:3724
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:1452
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:2492
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:2512
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:4200
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:4560
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:4492
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:2284
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:4796
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:3884
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:5080
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:812
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:68
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:504
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:2308
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:3580
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:912
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:1568
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:8
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:3748
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:1676
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:1792
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:2416
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:4288
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:1400
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:816
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:1324
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:3364
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:3388
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:4392
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:4636
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:3280
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:3936
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:4864
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:4304
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:3116
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:2956
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:3652
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:4600
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:3568
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:1844
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:520
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:792
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:3752
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:3964
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:212
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:1816
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:2808
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:488
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:788
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:1864
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:3672
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:4724
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:2040
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:4364
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:3684
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:4368
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:1804
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:4352
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:4396
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:2468
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:1352
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:1184
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:4696
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:656
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:4280
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:1360
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:4804
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:64
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:2632
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:2760
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:5076
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:1656
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:5024
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:3284
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:592
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:4268
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:796
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:5116
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:3252
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:916
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:2140
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:4748
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:2024
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:2628
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:2180
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:3380
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:1172
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:1492
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:4564
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:2268
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:2232
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:1312
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:4796
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:3884
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:1008
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:648
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:4644
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:4292
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:1564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

T1082

Virtualization/Sandbox Evasion