4e0ddcd303f27c01dcc8a35a9bd821c53fb7dcca474ac7f0c84d3c6451e9f778

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	x.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	x.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	x.exe

Executes dropped EXE 2 IoCs

pid	Process
4648	x.exe
3796	CL_Debug_Log.txt

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000\Software\Wine	x.exe

AutoIT Executable 4 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral18/memory/4648-6-0x0000000000B00000-0x0000000001D26000-memory.dmp	autoit_exe
behavioral18/files/0x000700000001abfd-29.dat	autoit_exe
behavioral18/files/0x000800000001abfb-35.dat	autoit_exe
behavioral18/memory/4648-38-0x0000000000B00000-0x0000000001D26000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
5008	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
528	timeout.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	3796	CL_Debug_Log.txt
Token: 35	3796	CL_Debug_Log.txt
Token: SeSecurityPrivilege	3796	CL_Debug_Log.txt
Token: SeSecurityPrivilege	3796	CL_Debug_Log.txt

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4648	x.exe
4648	x.exe
4648	x.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4648	x.exe
4648	x.exe
4648	x.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 4648	4060	wscript.exe	72
PID 4060 wrote to memory of 4648	4060	wscript.exe	72
PID 4060 wrote to memory of 4648	4060	wscript.exe	72
PID 4648 wrote to memory of 3796	4648	x.exe	73
PID 4648 wrote to memory of 3796	4648	x.exe	73
PID 4648 wrote to memory of 3796	4648	x.exe	73
PID 4648 wrote to memory of 4308	4648	x.exe	75
PID 4648 wrote to memory of 4308	4648	x.exe	75
PID 4648 wrote to memory of 4308	4648	x.exe	75
PID 4308 wrote to memory of 5008	4308	cmd.exe	77
PID 4308 wrote to memory of 5008	4308	cmd.exe	77
PID 4308 wrote to memory of 5008	4308	cmd.exe	77
PID 4648 wrote to memory of 3252	4648	x.exe	78
PID 4648 wrote to memory of 3252	4648	x.exe	78
PID 4648 wrote to memory of 3252	4648	x.exe	78
PID 3252 wrote to memory of 528	3252	cmd.exe	80
PID 3252 wrote to memory of 528	3252	cmd.exe	80
PID 3252 wrote to memory of 528	3252	cmd.exe	80

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\MsMpEng.js
1⤵
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Users\Admin\AppData\Local\Temp\x.exe
  "C:\Users\Admin\AppData\Local\Temp\x.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4648
- - C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt
    C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt e -p"JDQJndnqwdnqw2139dn21n3b312idDQDB" "C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt" -o"C:\Users\Admin\AppData\Local\Temp\"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3796
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4308
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"
      4⤵
      Creates scheduled task(s)
      PID:5008
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c For /L %i In (0,0,0) Do (del "C:\Users\Admin\AppData\Local\Temp\x.exe"&&timeout /t 0&&if not exist "C:\Users\Admin\AppData\Local\Temp\x.exe" exit)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3252
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

T1082

Virtualization/Sandbox Evasion