4e0ddcd303f27c01dcc8a35a9bd821c53fb7dcca474ac7f0c84d3c6451e9f778

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	x.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	x.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	x.exe

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	Helper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	Helper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	Helper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	Helper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	Helper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	Helper.exe

Executes dropped EXE 14 IoCs

pid	Process
4656	x.exe
2148	CL_Debug_Log.txt
4472	Helper.exe
3572	Helper.exe
4944	Helper.exe
3952	tor.exe
4532	Helper.exe
3948	Helper.exe
1444	Helper.exe
3896	Helper.exe
748	Helper.exe
3064	Helper.exe
8	Helper.exe
4956	Helper.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Software\Wine	x.exe

Loads dropped DLL 8 IoCs

pid	Process
3952	tor.exe
3952	tor.exe
3952	tor.exe
3952	tor.exe
3952	tor.exe
3952	tor.exe
3952	tor.exe
3952	tor.exe

AutoIT Executable 4 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral19/memory/4656-12-0x00000000006E0000-0x0000000001906000-memory.dmp	autoit_exe
behavioral19/files/0x0007000000023226-36.dat	autoit_exe
behavioral19/files/0x000b0000000231bf-41.dat	autoit_exe
behavioral19/memory/4656-44-0x00000000006E0000-0x0000000001906000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3572 set thread context of 4944	3572	Helper.exe	207

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
4780	schtasks.exe

Delays execution with timeout.exe 64 IoCs

evasion

pid	Process
2596	timeout.exe
3652	timeout.exe
1716	timeout.exe
3572	timeout.exe
2196	timeout.exe
1852	timeout.exe
568	timeout.exe
4924	timeout.exe
4388	timeout.exe
4112	timeout.exe
1336	timeout.exe
4172	timeout.exe
4828	timeout.exe
2028	timeout.exe
3164	timeout.exe
4396	timeout.exe
4192	timeout.exe
704	timeout.exe
5100	timeout.exe
3612	timeout.exe
1980	timeout.exe
2096	timeout.exe
4388	timeout.exe
4532	timeout.exe
5044	timeout.exe
3540	timeout.exe
5104	timeout.exe
3540	timeout.exe
2816	timeout.exe
1716	timeout.exe
1104	timeout.exe
3048	timeout.exe
4464	timeout.exe
1768	timeout.exe
3944	timeout.exe
1852	timeout.exe
2040	timeout.exe
2032	timeout.exe
4860	timeout.exe
3936	timeout.exe
536	timeout.exe
4372	timeout.exe
4660	timeout.exe
4012	timeout.exe
1484	timeout.exe
3036	timeout.exe
3332	timeout.exe
3228	timeout.exe
1232	timeout.exe
2120	timeout.exe
1980	timeout.exe
1892	timeout.exe
4472	timeout.exe
5116	timeout.exe
3984	timeout.exe
536	timeout.exe
8	timeout.exe
4424	timeout.exe
1468	timeout.exe
4944	timeout.exe
4364	timeout.exe
4904	timeout.exe
4836	timeout.exe
2100	timeout.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
3572	Helper.exe
3572	Helper.exe
3572	Helper.exe
3572	Helper.exe
3572	Helper.exe
3572	Helper.exe
3572	Helper.exe
3572	Helper.exe
3572	Helper.exe
3572	Helper.exe
3572	Helper.exe
3572	Helper.exe
3572	Helper.exe
3572	Helper.exe
3572	Helper.exe
3572	Helper.exe
3572	Helper.exe
3572	Helper.exe
3572	Helper.exe
3572	Helper.exe
3572	Helper.exe
3572	Helper.exe
3572	Helper.exe
3572	Helper.exe
3572	Helper.exe
3572	Helper.exe
3572	Helper.exe
3572	Helper.exe
3572	Helper.exe
3572	Helper.exe
3572	Helper.exe
3572	Helper.exe
3572	Helper.exe
3572	Helper.exe
3572	Helper.exe
3572	Helper.exe
3572	Helper.exe
3572	Helper.exe
3572	Helper.exe
3572	Helper.exe
3572	Helper.exe
3572	Helper.exe
3572	Helper.exe
3572	Helper.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeRestorePrivilege	2148	CL_Debug_Log.txt
Token: 35	2148	CL_Debug_Log.txt
Token: SeSecurityPrivilege	2148	CL_Debug_Log.txt
Token: SeSecurityPrivilege	2148	CL_Debug_Log.txt
Token: SeRestorePrivilege	4944	Helper.exe
Token: 35	4944	Helper.exe
Token: SeSecurityPrivilege	4944	Helper.exe
Token: SeSecurityPrivilege	4944	Helper.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4656	x.exe
4656	x.exe
4656	x.exe
4472	Helper.exe
4472	Helper.exe
4472	Helper.exe
3572	Helper.exe
3572	Helper.exe
3572	Helper.exe
4532	Helper.exe
4532	Helper.exe
4532	Helper.exe
3948	Helper.exe
3948	Helper.exe
3948	Helper.exe
1444	Helper.exe
1444	Helper.exe
1444	Helper.exe
3896	Helper.exe
3896	Helper.exe
3896	Helper.exe
748	Helper.exe
748	Helper.exe
748	Helper.exe
3064	Helper.exe
3064	Helper.exe
3064	Helper.exe
8	Helper.exe
8	Helper.exe
8	Helper.exe
4956	Helper.exe
4956	Helper.exe
4956	Helper.exe

Suspicious use of SendNotifyMessage 33 IoCs

pid	Process
4656	x.exe
4656	x.exe
4656	x.exe
4472	Helper.exe
4472	Helper.exe
4472	Helper.exe
3572	Helper.exe
3572	Helper.exe
3572	Helper.exe
4532	Helper.exe
4532	Helper.exe
4532	Helper.exe
3948	Helper.exe
3948	Helper.exe
3948	Helper.exe
1444	Helper.exe
1444	Helper.exe
1444	Helper.exe
3896	Helper.exe
3896	Helper.exe
3896	Helper.exe
748	Helper.exe
748	Helper.exe
748	Helper.exe
3064	Helper.exe
3064	Helper.exe
3064	Helper.exe
8	Helper.exe
8	Helper.exe
8	Helper.exe
4956	Helper.exe
4956	Helper.exe
4956	Helper.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 4656	1692	wscript.exe	88
PID 1692 wrote to memory of 4656	1692	wscript.exe	88
PID 1692 wrote to memory of 4656	1692	wscript.exe	88
PID 4656 wrote to memory of 2148	4656	x.exe	89
PID 4656 wrote to memory of 2148	4656	x.exe	89
PID 4656 wrote to memory of 2148	4656	x.exe	89
PID 4656 wrote to memory of 5032	4656	x.exe	164
PID 4656 wrote to memory of 5032	4656	x.exe	164
PID 4656 wrote to memory of 5032	4656	x.exe	164
PID 5032 wrote to memory of 4780	5032	cmd.exe	95
PID 5032 wrote to memory of 4780	5032	cmd.exe	95
PID 5032 wrote to memory of 4780	5032	cmd.exe	95
PID 4656 wrote to memory of 844	4656	x.exe	96
PID 4656 wrote to memory of 844	4656	x.exe	96
PID 4656 wrote to memory of 844	4656	x.exe	96
PID 844 wrote to memory of 628	844	cmd.exe	98
PID 844 wrote to memory of 628	844	cmd.exe	98
PID 844 wrote to memory of 628	844	cmd.exe	98
PID 844 wrote to memory of 4928	844	cmd.exe	99
PID 844 wrote to memory of 4928	844	cmd.exe	99
PID 844 wrote to memory of 4928	844	cmd.exe	99
PID 844 wrote to memory of 3944	844	cmd.exe	100
PID 844 wrote to memory of 3944	844	cmd.exe	100
PID 844 wrote to memory of 3944	844	cmd.exe	100
PID 844 wrote to memory of 3652	844	cmd.exe	175
PID 844 wrote to memory of 3652	844	cmd.exe	175
PID 844 wrote to memory of 3652	844	cmd.exe	175
PID 844 wrote to memory of 3036	844	cmd.exe	102
PID 844 wrote to memory of 3036	844	cmd.exe	102
PID 844 wrote to memory of 3036	844	cmd.exe	102
PID 844 wrote to memory of 1892	844	cmd.exe	103
PID 844 wrote to memory of 1892	844	cmd.exe	103
PID 844 wrote to memory of 1892	844	cmd.exe	103
PID 844 wrote to memory of 3984	844	cmd.exe	177
PID 844 wrote to memory of 3984	844	cmd.exe	177
PID 844 wrote to memory of 3984	844	cmd.exe	177
PID 844 wrote to memory of 1852	844	cmd.exe	178
PID 844 wrote to memory of 1852	844	cmd.exe	178
PID 844 wrote to memory of 1852	844	cmd.exe	178
PID 844 wrote to memory of 4504	844	cmd.exe	108
PID 844 wrote to memory of 4504	844	cmd.exe	108
PID 844 wrote to memory of 4504	844	cmd.exe	108
PID 844 wrote to memory of 2580	844	cmd.exe	109
PID 844 wrote to memory of 2580	844	cmd.exe	109
PID 844 wrote to memory of 2580	844	cmd.exe	109
PID 844 wrote to memory of 3048	844	cmd.exe	110
PID 844 wrote to memory of 3048	844	cmd.exe	110
PID 844 wrote to memory of 3048	844	cmd.exe	110
PID 844 wrote to memory of 5108	844	cmd.exe	111
PID 844 wrote to memory of 5108	844	cmd.exe	111
PID 844 wrote to memory of 5108	844	cmd.exe	111
PID 844 wrote to memory of 2936	844	cmd.exe	112
PID 844 wrote to memory of 2936	844	cmd.exe	112
PID 844 wrote to memory of 2936	844	cmd.exe	112
PID 844 wrote to memory of 4760	844	cmd.exe	113
PID 844 wrote to memory of 4760	844	cmd.exe	113
PID 844 wrote to memory of 4760	844	cmd.exe	113
PID 844 wrote to memory of 3664	844	cmd.exe	114
PID 844 wrote to memory of 3664	844	cmd.exe	114
PID 844 wrote to memory of 3664	844	cmd.exe	114
PID 844 wrote to memory of 1716	844	cmd.exe	185
PID 844 wrote to memory of 1716	844	cmd.exe	185
PID 844 wrote to memory of 1716	844	cmd.exe	185
PID 844 wrote to memory of 4112	844	cmd.exe	186

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\MsMpEng.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Users\Admin\AppData\Local\Temp\x.exe
  "C:\Users\Admin\AppData\Local\Temp\x.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt
    C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt e -p"JDQJndnqwdnqw2139dn21n3b312idDQDB" "C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt" -o"C:\Users\Admin\AppData\Local\Temp\"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2148
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5032
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"
      4⤵
      Creates scheduled task(s)
      PID:4780
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c For /L %i In (0,0,0) Do (del "C:\Users\Admin\AppData\Local\Temp\x.exe"&&timeout /t 0&&if not exist "C:\Users\Admin\AppData\Local\Temp\x.exe" exit)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:844
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:628
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:4928
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:3944
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:3652
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:3036
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:1892
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:3984
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:1852
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:4504
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:2580
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:3048
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:5108
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:2936
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:4760
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:3664
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:1716
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:4112
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:3228
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:536
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:4904
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:1100
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:2164
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:5104
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:4464
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:4216
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:1980
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:3540
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:1548
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:4388
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:4532
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:880
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:4880
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:4924
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:2096
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:4828
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:4860
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:1104
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:1768
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:4372
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:4660
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:4300
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:4472
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:4424
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:4012
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:3572
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:1484
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:2920
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:4592
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:1972
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:4944
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:2816
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:2040
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:704
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:1444
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:1912
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:1836
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:1408
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:5116
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:3164
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:5076
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:2596
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:5032
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:4836
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:2028
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:1232
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:5044
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:2812
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:4396
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:2084
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:2196
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:528
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:1336
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:3652
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:5100
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:3984
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:1852
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:4364
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:2860
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:3924
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:1468
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:3332
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:568
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:1716
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:4112
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:3228
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:536
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:3612
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:2032
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:2100
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:2120
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:8
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:3936
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:1980
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:3540
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:1548
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:4388
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:4172
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:2492
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:4192
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      PID:3948

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4472
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3572
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4944
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\tor.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\tor.exe" -f TorConfig
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3952

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4532
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3948

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1444
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3896

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:748
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3064

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:8
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

T1082

Virtualization/Sandbox Evasion