amadey | dd461bb3be347878aa6e33f3e8252d3f81f3f93f56a856b61ae7a2c97bf97710

Virtualization/Sandbox Evasion

Processes:

9b471ab368.exeexplorha.exechrosha.exeexplorha.exedd461bb3be347878aa6e33f3e8252d3f81f3f93f56a856b61ae7a2c97bf97710.exeexplorha.exeamert.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	9b471ab368.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	chrosha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	dd461bb3be347878aa6e33f3e8252d3f81f3f93f56a856b61ae7a2c97bf97710.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	amert.exe

Blocklisted process makes network request 4 IoCs

Processes:

rundll32.exerundll32.exerundll32.exerundll32.exe

flow pid process

67 3916 rundll32.exe
68 3468 rundll32.exe
97 1452 rundll32.exe
104 1152 rundll32.exe
Downloads MZ/PE file

flow	pid	process
67	3916	rundll32.exe
68	3468	rundll32.exe
97	1452	rundll32.exe
104	1152	rundll32.exe

Checks BIOS information in registry 2 TTPs 14 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

chrosha.exeexplorha.exe9b471ab368.exedd461bb3be347878aa6e33f3e8252d3f81f3f93f56a856b61ae7a2c97bf97710.exeexplorha.exeamert.exeexplorha.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	chrosha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	9b471ab368.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	dd461bb3be347878aa6e33f3e8252d3f81f3f93f56a856b61ae7a2c97bf97710.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	amert.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	chrosha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	dd461bb3be347878aa6e33f3e8252d3f81f3f93f56a856b61ae7a2c97bf97710.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	amert.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	9b471ab368.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

explorha.exef2eea9f574.exechrosha.exedd461bb3be347878aa6e33f3e8252d3f81f3f93f56a856b61ae7a2c97bf97710.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\Control Panel\International\Geo\Nation	explorha.exe
Key value queried	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\Control Panel\International\Geo\Nation	f2eea9f574.exe
Key value queried	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\Control Panel\International\Geo\Nation	chrosha.exe
Key value queried	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\Control Panel\International\Geo\Nation	dd461bb3be347878aa6e33f3e8252d3f81f3f93f56a856b61ae7a2c97bf97710.exe

Executes dropped EXE 8 IoCs

Processes:

explorha.exeamert.exef2eea9f574.exe9b471ab368.exeexplorha.exechrosha.exebuild12.exeexplorha.exe

pid process

1580 explorha.exe
3916 amert.exe
5064 f2eea9f574.exe
2860 9b471ab368.exe
3484 explorha.exe
1892 chrosha.exe
3084 build12.exe
692 explorha.exe

pid	process
1580	explorha.exe
3916	amert.exe
5064	f2eea9f574.exe
2860	9b471ab368.exe
3484	explorha.exe
1892	chrosha.exe
3084	build12.exe
692	explorha.exe

Identifies Wine through registry keys 2 TTPs 7 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

Processes:

explorha.exeamert.exe9b471ab368.exeexplorha.exechrosha.exeexplorha.exedd461bb3be347878aa6e33f3e8252d3f81f3f93f56a856b61ae7a2c97bf97710.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\Software\Wine	explorha.exe
Key opened	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\Software\Wine	amert.exe
Key opened	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\Software\Wine	9b471ab368.exe
Key opened	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\Software\Wine	explorha.exe
Key opened	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\Software\Wine	chrosha.exe
Key opened	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\Software\Wine	explorha.exe
Key opened	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\Software\Wine	dd461bb3be347878aa6e33f3e8252d3f81f3f93f56a856b61ae7a2c97bf97710.exe

Loads dropped DLL 6 IoCs

Processes:

rundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exe

pid process

3216 rundll32.exe
3916 rundll32.exe
3468 rundll32.exe
1800 rundll32.exe
1452 rundll32.exe
1152 rundll32.exe
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
3216	rundll32.exe
3916	rundll32.exe
3468	rundll32.exe
1800	rundll32.exe
1452	rundll32.exe
1152	rundll32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorha.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f2eea9f574.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000055001\\f2eea9f574.exe"	explorha.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9b471ab368.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000056001\\9b471ab368.exe"	explorha.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\1000055001\f2eea9f574.exe	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

Processes:

dd461bb3be347878aa6e33f3e8252d3f81f3f93f56a856b61ae7a2c97bf97710.exeexplorha.exeamert.exe9b471ab368.exechrosha.exeexplorha.exeexplorha.exe

pid	process
3976	dd461bb3be347878aa6e33f3e8252d3f81f3f93f56a856b61ae7a2c97bf97710.exe
1580	explorha.exe
3916	amert.exe
2860	9b471ab368.exe
1892	chrosha.exe
3484	explorha.exe
692	explorha.exe

Drops file in Windows directory 2 IoCs

Processes:

dd461bb3be347878aa6e33f3e8252d3f81f3f93f56a856b61ae7a2c97bf97710.exeamert.exe

description	ioc	process
File created	C:\Windows\Tasks\explorha.job	dd461bb3be347878aa6e33f3e8252d3f81f3f93f56a856b61ae7a2c97bf97710.exe
File created	C:\Windows\Tasks\chrosha.job	amert.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133579728185676123"	chrome.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

Processes:

dd461bb3be347878aa6e33f3e8252d3f81f3f93f56a856b61ae7a2c97bf97710.exeexplorha.exeamert.exe9b471ab368.exechrome.exerundll32.exepowershell.exechrosha.exeexplorha.exerundll32.exepowershell.exebuild12.exeexplorha.exechrome.exe

pid	process
3976	dd461bb3be347878aa6e33f3e8252d3f81f3f93f56a856b61ae7a2c97bf97710.exe
3976	dd461bb3be347878aa6e33f3e8252d3f81f3f93f56a856b61ae7a2c97bf97710.exe
1580	explorha.exe
1580	explorha.exe
3916	amert.exe
3916	amert.exe
2860	9b471ab368.exe
2860	9b471ab368.exe
3924	chrome.exe
3924	chrome.exe
3916	rundll32.exe
3916	rundll32.exe
3916	rundll32.exe
3916	rundll32.exe
3916	rundll32.exe
3916	rundll32.exe
3916	rundll32.exe
3916	rundll32.exe
3916	rundll32.exe
3916	rundll32.exe
1140	powershell.exe
1140	powershell.exe
1140	powershell.exe
1892	chrosha.exe
1892	chrosha.exe
3484	explorha.exe
3484	explorha.exe
1452	rundll32.exe
1452	rundll32.exe
1452	rundll32.exe
1452	rundll32.exe
1452	rundll32.exe
1452	rundll32.exe
1452	rundll32.exe
1452	rundll32.exe
1452	rundll32.exe
1452	rundll32.exe
3484	powershell.exe
3484	powershell.exe
3484	powershell.exe
3084	build12.exe
3084	build12.exe
3084	build12.exe
692	explorha.exe
692	explorha.exe
2088	chrome.exe
2088	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

chrome.exe

pid process

3924 chrome.exe
3924 chrome.exe
3924 chrome.exe

pid	process
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exepowershell.exe

description	pid	process
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeDebugPrivilege	1140	powershell.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe

Suspicious use of FindShellTrayWindow 33 IoCs

Processes:

dd461bb3be347878aa6e33f3e8252d3f81f3f93f56a856b61ae7a2c97bf97710.exef2eea9f574.exechrome.exe

pid	process
3976	dd461bb3be347878aa6e33f3e8252d3f81f3f93f56a856b61ae7a2c97bf97710.exe
5064	f2eea9f574.exe
5064	f2eea9f574.exe
5064	f2eea9f574.exe
5064	f2eea9f574.exe
5064	f2eea9f574.exe
5064	f2eea9f574.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe

Suspicious use of SendNotifyMessage 30 IoCs

Processes:

f2eea9f574.exechrome.exe

pid	process
5064	f2eea9f574.exe
5064	f2eea9f574.exe
5064	f2eea9f574.exe
5064	f2eea9f574.exe
5064	f2eea9f574.exe
5064	f2eea9f574.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

dd461bb3be347878aa6e33f3e8252d3f81f3f93f56a856b61ae7a2c97bf97710.exeexplorha.exef2eea9f574.exechrome.exe

description	pid	process	target process
PID 3976 wrote to memory of 1580	3976	dd461bb3be347878aa6e33f3e8252d3f81f3f93f56a856b61ae7a2c97bf97710.exe	explorha.exe
PID 3976 wrote to memory of 1580	3976	dd461bb3be347878aa6e33f3e8252d3f81f3f93f56a856b61ae7a2c97bf97710.exe	explorha.exe
PID 3976 wrote to memory of 1580	3976	dd461bb3be347878aa6e33f3e8252d3f81f3f93f56a856b61ae7a2c97bf97710.exe	explorha.exe
PID 1580 wrote to memory of 3916	1580	explorha.exe	amert.exe
PID 1580 wrote to memory of 3916	1580	explorha.exe	amert.exe
PID 1580 wrote to memory of 3916	1580	explorha.exe	amert.exe
PID 1580 wrote to memory of 5064	1580	explorha.exe	f2eea9f574.exe
PID 1580 wrote to memory of 5064	1580	explorha.exe	f2eea9f574.exe
PID 1580 wrote to memory of 5064	1580	explorha.exe	f2eea9f574.exe
PID 5064 wrote to memory of 3924	5064	f2eea9f574.exe	chrome.exe
PID 5064 wrote to memory of 3924	5064	f2eea9f574.exe	chrome.exe
PID 3924 wrote to memory of 3328	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 3328	3924	chrome.exe	chrome.exe
PID 1580 wrote to memory of 2860	1580	explorha.exe	9b471ab368.exe
PID 1580 wrote to memory of 2860	1580	explorha.exe	9b471ab368.exe
PID 1580 wrote to memory of 2860	1580	explorha.exe	9b471ab368.exe
PID 3924 wrote to memory of 3404	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 3404	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 3404	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 3404	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 3404	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 3404	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 3404	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 3404	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 3404	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 3404	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 3404	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 3404	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 3404	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 3404	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 3404	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 3404	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 3404	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 3404	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 3404	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 3404	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 3404	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 3404	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 3404	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 3404	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 3404	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 3404	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 3404	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 3404	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 3404	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 3404	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 3404	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 4948	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 4948	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 2944	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 2944	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 2944	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 2944	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 2944	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 2944	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 2944	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 2944	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 2944	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 2944	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 2944	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 2944	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 2944	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 2944	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 2944	3924	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\dd461bb3be347878aa6e33f3e8252d3f81f3f93f56a856b61ae7a2c97bf97710.exe
"C:\Users\Admin\AppData\Local\Temp\dd461bb3be347878aa6e33f3e8252d3f81f3f93f56a856b61ae7a2c97bf97710.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3976

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
"C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1580

C:\Users\Admin\AppData\Local\Temp\1000054001\amert.exe
"C:\Users\Admin\AppData\Local\Temp\1000054001\amert.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:3916

C:\Users\Admin\AppData\Local\Temp\1000055001\f2eea9f574.exe
"C:\Users\Admin\AppData\Local\Temp\1000055001\f2eea9f574.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5064

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
4⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3924

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa0642ab58,0x7ffa0642ab68,0x7ffa0642ab78
5⤵
PID:3328

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 --field-trial-handle=1872,i,9699866023586332525,16817878950075566587,131072 /prefetch:2
5⤵
PID:3404

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 --field-trial-handle=1872,i,9699866023586332525,16817878950075566587,131072 /prefetch:8
5⤵
PID:4948

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2072 --field-trial-handle=1872,i,9699866023586332525,16817878950075566587,131072 /prefetch:8
5⤵
PID:2944

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3052 --field-trial-handle=1872,i,9699866023586332525,16817878950075566587,131072 /prefetch:1
5⤵
PID:4660

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3188 --field-trial-handle=1872,i,9699866023586332525,16817878950075566587,131072 /prefetch:1
5⤵
PID:3796

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4252 --field-trial-handle=1872,i,9699866023586332525,16817878950075566587,131072 /prefetch:1
5⤵
PID:3208

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3920 --field-trial-handle=1872,i,9699866023586332525,16817878950075566587,131072 /prefetch:8
5⤵
PID:4516

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4656 --field-trial-handle=1872,i,9699866023586332525,16817878950075566587,131072 /prefetch:8
5⤵
PID:1892

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4696 --field-trial-handle=1872,i,9699866023586332525,16817878950075566587,131072 /prefetch:8
5⤵
PID:1908

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1536 --field-trial-handle=1872,i,9699866023586332525,16817878950075566587,131072 /prefetch:2
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:2088

C:\Users\Admin\AppData\Local\Temp\1000056001\9b471ab368.exe
"C:\Users\Admin\AppData\Local\Temp\1000056001\9b471ab368.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2860

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
"C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
3⤵
PID:3196

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
3⤵
- Loads dropped DLL
PID:3216

C:\Windows\system32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3916

C:\Windows\system32\netsh.exe
netsh wlan show profiles
5⤵
PID:3576

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\768540242263_Desktop.zip' -CompressionLevel Optimal
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1140

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:3468

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:3568

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3484

C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1892

C:\Users\Admin\AppData\Local\Temp\1000188001\build12.exe
"C:\Users\Admin\AppData\Local\Temp\1000188001\build12.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3084

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
2⤵
- Loads dropped DLL
PID:1800

C:\Windows\system32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1452

C:\Windows\system32\netsh.exe
netsh wlan show profiles
4⤵
PID:408

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\768540242263_Desktop.zip' -CompressionLevel Optimal
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:3484

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:1152

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:692

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Virtualization/Sandbox Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

Virtualization/Sandbox Evasion

System Information Discovery