4e0ddcd303f27c01dcc8a35a9bd821c53fb7dcca474ac7f0c84d3c6451e9f778

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	x.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	x.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	x.exe

Executes dropped EXE 2 IoCs

pid	Process
500	x.exe
1344	CL_Debug_Log.txt

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Wine	x.exe

AutoIT Executable 4 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral18/memory/500-6-0x0000000000320000-0x0000000001546000-memory.dmp	autoit_exe
behavioral18/files/0x000700000001abf5-29.dat	autoit_exe
behavioral18/files/0x000800000001abf3-35.dat	autoit_exe
behavioral18/memory/500-38-0x0000000000320000-0x0000000001546000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
1044	schtasks.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
3916	timeout.exe
712	timeout.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	1344	CL_Debug_Log.txt
Token: 35	1344	CL_Debug_Log.txt
Token: SeSecurityPrivilege	1344	CL_Debug_Log.txt
Token: SeSecurityPrivilege	1344	CL_Debug_Log.txt

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
500	x.exe
500	x.exe
500	x.exe
500	x.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
500	x.exe
500	x.exe
500	x.exe
500	x.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 500	4184	wscript.exe	72
PID 4184 wrote to memory of 500	4184	wscript.exe	72
PID 4184 wrote to memory of 500	4184	wscript.exe	72
PID 500 wrote to memory of 1344	500	x.exe	73
PID 500 wrote to memory of 1344	500	x.exe	73
PID 500 wrote to memory of 1344	500	x.exe	73
PID 500 wrote to memory of 3580	500	x.exe	75
PID 500 wrote to memory of 3580	500	x.exe	75
PID 500 wrote to memory of 3580	500	x.exe	75
PID 3580 wrote to memory of 1044	3580	cmd.exe	77
PID 3580 wrote to memory of 1044	3580	cmd.exe	77
PID 3580 wrote to memory of 1044	3580	cmd.exe	77
PID 500 wrote to memory of 4632	500	x.exe	78
PID 500 wrote to memory of 4632	500	x.exe	78
PID 500 wrote to memory of 4632	500	x.exe	78
PID 4632 wrote to memory of 3916	4632	cmd.exe	80
PID 4632 wrote to memory of 3916	4632	cmd.exe	80
PID 4632 wrote to memory of 3916	4632	cmd.exe	80
PID 4632 wrote to memory of 712	4632	cmd.exe	81
PID 4632 wrote to memory of 712	4632	cmd.exe	81
PID 4632 wrote to memory of 712	4632	cmd.exe	81

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\MsMpEng.js
1⤵
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Users\Admin\AppData\Local\Temp\x.exe
  "C:\Users\Admin\AppData\Local\Temp\x.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:500
- - C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt
    C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt e -p"JDQJndnqwdnqw2139dn21n3b312idDQDB" "C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt" -o"C:\Users\Admin\AppData\Local\Temp\"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1344
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3580
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"
      4⤵
      Creates scheduled task(s)
      PID:1044
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c For /L %i In (0,0,0) Do (del "C:\Users\Admin\AppData\Local\Temp\x.exe"&&timeout /t 0&&if not exist "C:\Users\Admin\AppData\Local\Temp\x.exe" exit)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4632
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:3916
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

T1082

Virtualization/Sandbox Evasion