4e0ddcd303f27c01dcc8a35a9bd821c53fb7dcca474ac7f0c84d3c6451e9f778

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	x.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	x.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	x.exe

Executes dropped EXE 12 IoCs

pid	Process
1008	x.exe
2728	CL_Debug_Log.txt
320	Helper.exe
2584	Helper.exe
2624	Helper.exe
2796	Helper.exe
2024	Helper.exe
1560	tor.exe
2512	Helper.exe
2520	Helper.exe
2556	Helper.exe
2792	Helper.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Wine	x.exe

Loads dropped DLL 12 IoCs

pid	Process
1008	x.exe
1596	taskeng.exe
1596	taskeng.exe
2872	Process not Found
2624	Helper.exe
2624	Helper.exe
1560	tor.exe
1560	tor.exe
1560	tor.exe
1560	tor.exe
1560	tor.exe
1560	tor.exe

AutoIT Executable 4 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral17/memory/1008-7-0x0000000000F40000-0x0000000002166000-memory.dmp	autoit_exe
behavioral17/files/0x00050000000194b9-31.dat	autoit_exe
behavioral17/files/0x0006000000019477-37.dat	autoit_exe
behavioral17/memory/1008-40-0x0000000000F40000-0x0000000002166000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2624 set thread context of 2024	2624	Helper.exe	52

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
1720	schtasks.exe

Delays execution with timeout.exe 9 IoCs

evasion

pid	Process
2208	timeout.exe
2884	timeout.exe
2896	timeout.exe
2220	timeout.exe
2376	timeout.exe
1896	timeout.exe
1952	timeout.exe
2920	timeout.exe
3068	timeout.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
2624	Helper.exe
2624	Helper.exe
2624	Helper.exe
2624	Helper.exe
2624	Helper.exe
2624	Helper.exe
2624	Helper.exe
2624	Helper.exe
2624	Helper.exe
2624	Helper.exe
2624	Helper.exe
2624	Helper.exe
2624	Helper.exe
2624	Helper.exe
2624	Helper.exe
2624	Helper.exe
2624	Helper.exe
2624	Helper.exe
2624	Helper.exe
2624	Helper.exe
2624	Helper.exe
2624	Helper.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeRestorePrivilege	2728	CL_Debug_Log.txt
Token: 35	2728	CL_Debug_Log.txt
Token: SeSecurityPrivilege	2728	CL_Debug_Log.txt
Token: SeSecurityPrivilege	2728	CL_Debug_Log.txt
Token: SeRestorePrivilege	2024	Helper.exe
Token: 35	2024	Helper.exe
Token: SeSecurityPrivilege	2024	Helper.exe
Token: SeSecurityPrivilege	2024	Helper.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
1008	x.exe
1008	x.exe
1008	x.exe
2584	Helper.exe
2584	Helper.exe
2584	Helper.exe
320	Helper.exe
320	Helper.exe
320	Helper.exe
2624	Helper.exe
2624	Helper.exe
2624	Helper.exe
2796	Helper.exe
2796	Helper.exe
2796	Helper.exe
2520	Helper.exe
2520	Helper.exe
2520	Helper.exe
2512	Helper.exe
2512	Helper.exe
2512	Helper.exe
2556	Helper.exe
2556	Helper.exe
2556	Helper.exe
2792	Helper.exe
2792	Helper.exe
2792	Helper.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
1008	x.exe
1008	x.exe
1008	x.exe
2584	Helper.exe
2584	Helper.exe
2584	Helper.exe
320	Helper.exe
320	Helper.exe
320	Helper.exe
2624	Helper.exe
2624	Helper.exe
2624	Helper.exe
2796	Helper.exe
2796	Helper.exe
2796	Helper.exe
2520	Helper.exe
2520	Helper.exe
2520	Helper.exe
2512	Helper.exe
2512	Helper.exe
2512	Helper.exe
2556	Helper.exe
2556	Helper.exe
2556	Helper.exe
2792	Helper.exe
2792	Helper.exe
2792	Helper.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 1008	1376	wscript.exe	28
PID 1376 wrote to memory of 1008	1376	wscript.exe	28
PID 1376 wrote to memory of 1008	1376	wscript.exe	28
PID 1376 wrote to memory of 1008	1376	wscript.exe	28
PID 1008 wrote to memory of 2728	1008	x.exe	29
PID 1008 wrote to memory of 2728	1008	x.exe	29
PID 1008 wrote to memory of 2728	1008	x.exe	29
PID 1008 wrote to memory of 2728	1008	x.exe	29
PID 1008 wrote to memory of 1652	1008	x.exe	31
PID 1008 wrote to memory of 1652	1008	x.exe	31
PID 1008 wrote to memory of 1652	1008	x.exe	31
PID 1008 wrote to memory of 1652	1008	x.exe	31
PID 1652 wrote to memory of 1720	1652	cmd.exe	33
PID 1652 wrote to memory of 1720	1652	cmd.exe	33
PID 1652 wrote to memory of 1720	1652	cmd.exe	33
PID 1652 wrote to memory of 1720	1652	cmd.exe	33
PID 1008 wrote to memory of 2448	1008	x.exe	34
PID 1008 wrote to memory of 2448	1008	x.exe	34
PID 1008 wrote to memory of 2448	1008	x.exe	34
PID 1008 wrote to memory of 2448	1008	x.exe	34
PID 2448 wrote to memory of 2884	2448	cmd.exe	36
PID 2448 wrote to memory of 2884	2448	cmd.exe	36
PID 2448 wrote to memory of 2884	2448	cmd.exe	36
PID 2448 wrote to memory of 2884	2448	cmd.exe	36
PID 2448 wrote to memory of 2920	2448	cmd.exe	37
PID 2448 wrote to memory of 2920	2448	cmd.exe	37
PID 2448 wrote to memory of 2920	2448	cmd.exe	37
PID 2448 wrote to memory of 2920	2448	cmd.exe	37
PID 2448 wrote to memory of 3068	2448	cmd.exe	38
PID 2448 wrote to memory of 3068	2448	cmd.exe	38
PID 2448 wrote to memory of 3068	2448	cmd.exe	38
PID 2448 wrote to memory of 3068	2448	cmd.exe	38
PID 2448 wrote to memory of 2896	2448	cmd.exe	39
PID 2448 wrote to memory of 2896	2448	cmd.exe	39
PID 2448 wrote to memory of 2896	2448	cmd.exe	39
PID 2448 wrote to memory of 2896	2448	cmd.exe	39
PID 2448 wrote to memory of 2220	2448	cmd.exe	40
PID 2448 wrote to memory of 2220	2448	cmd.exe	40
PID 2448 wrote to memory of 2220	2448	cmd.exe	40
PID 2448 wrote to memory of 2220	2448	cmd.exe	40
PID 2448 wrote to memory of 2376	2448	cmd.exe	41
PID 2448 wrote to memory of 2376	2448	cmd.exe	41
PID 2448 wrote to memory of 2376	2448	cmd.exe	41
PID 2448 wrote to memory of 2376	2448	cmd.exe	41
PID 2448 wrote to memory of 1896	2448	cmd.exe	42
PID 2448 wrote to memory of 1896	2448	cmd.exe	42
PID 2448 wrote to memory of 1896	2448	cmd.exe	42
PID 2448 wrote to memory of 1896	2448	cmd.exe	42
PID 2448 wrote to memory of 1952	2448	cmd.exe	43
PID 2448 wrote to memory of 1952	2448	cmd.exe	43
PID 2448 wrote to memory of 1952	2448	cmd.exe	43
PID 2448 wrote to memory of 1952	2448	cmd.exe	43
PID 2448 wrote to memory of 2208	2448	cmd.exe	44
PID 2448 wrote to memory of 2208	2448	cmd.exe	44
PID 2448 wrote to memory of 2208	2448	cmd.exe	44
PID 2448 wrote to memory of 2208	2448	cmd.exe	44
PID 1596 wrote to memory of 2584	1596	taskeng.exe	49
PID 1596 wrote to memory of 2584	1596	taskeng.exe	49
PID 1596 wrote to memory of 2584	1596	taskeng.exe	49
PID 1596 wrote to memory of 320	1596	taskeng.exe	48
PID 1596 wrote to memory of 320	1596	taskeng.exe	48
PID 1596 wrote to memory of 320	1596	taskeng.exe	48
PID 2584 wrote to memory of 2624	2584	Helper.exe	50
PID 2584 wrote to memory of 2624	2584	Helper.exe	50

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\MsMpEng.js
1⤵
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Users\Admin\AppData\Local\Temp\x.exe
  "C:\Users\Admin\AppData\Local\Temp\x.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1008
- - C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt
    C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt e -p"JDQJndnqwdnqw2139dn21n3b312idDQDB" "C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt" -o"C:\Users\Admin\AppData\Local\Temp\"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2728
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1652
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"
      4⤵
      Creates scheduled task(s)
      PID:1720
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c For /L %i In (0,0,0) Do (del "C:\Users\Admin\AppData\Local\Temp\x.exe"&&timeout /t 0&&if not exist "C:\Users\Admin\AppData\Local\Temp\x.exe" exit)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2448
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:2884
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:2920
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:3068
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:2896
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:2220
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:2376
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:1896
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:1952
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:2208

C:\Windows\system32\taskeng.exe
taskeng.exe {8E21F99C-4C7B-4436-AE95-CC1BADF4F53B} S-1-5-21-2610426812-2871295383-373749122-1000:UEITMFAB\Admin:Interactive:[1]
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:320
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2796
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2624
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
      7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2024
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\tor.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\tor.exe" -f TorConfig
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1560
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2512
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2792
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2520
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

T1082

Virtualization/Sandbox Evasion