amadey | 46df76fcbd73ee551748a4b9a65b6957b6ca4c4a7863a4bb16d40ad5c119bf69

Virtualization/Sandbox Evasion

Processes:

46df76fcbd73ee551748a4b9a65b6957b6ca4c4a7863a4bb16d40ad5c119bf69.exeaxplons.exeaxplons.exeaxplons.exeaxplons.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	46df76fcbd73ee551748a4b9a65b6957b6ca4c4a7863a4bb16d40ad5c119bf69.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplons.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplons.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplons.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplons.exe

Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

46df76fcbd73ee551748a4b9a65b6957b6ca4c4a7863a4bb16d40ad5c119bf69.exeaxplons.exeaxplons.exeaxplons.exeaxplons.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	46df76fcbd73ee551748a4b9a65b6957b6ca4c4a7863a4bb16d40ad5c119bf69.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	46df76fcbd73ee551748a4b9a65b6957b6ca4c4a7863a4bb16d40ad5c119bf69.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplons.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

NewB.exe46df76fcbd73ee551748a4b9a65b6957b6ca4c4a7863a4bb16d40ad5c119bf69.exeaxplons.exeRegAsm.exeinstall.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	NewB.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	46df76fcbd73ee551748a4b9a65b6957b6ca4c4a7863a4bb16d40ad5c119bf69.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	axplons.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	install.exe

Executes dropped EXE 18 IoCs

Processes:

axplons.exealex.exetrf.exekeks.exegold.exeredline1.exeinstall.exeswizzhis.exelumma1.exe580551.exefile300un.exeNewB.exeaxplons.exeNewB.exeaxplons.exeNewB.exeaxplons.exeNewB.exe

pid	Process
4748	axplons.exe
4828	alex.exe
2164	trf.exe
4628	keks.exe
3240	gold.exe
640	redline1.exe
3600	install.exe
1584	swizzhis.exe
4460	lumma1.exe
1732	580551.exe
2428	file300un.exe
3512	NewB.exe
3736	axplons.exe
3264	NewB.exe
2064	axplons.exe
4464	NewB.exe
2316	axplons.exe
2728	NewB.exe

Identifies Wine through registry keys 2 TTPs 5 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

Processes:

46df76fcbd73ee551748a4b9a65b6957b6ca4c4a7863a4bb16d40ad5c119bf69.exeaxplons.exeaxplons.exeaxplons.exeaxplons.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Wine	46df76fcbd73ee551748a4b9a65b6957b6ca4c4a7863a4bb16d40ad5c119bf69.exe
Key opened	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Wine	axplons.exe
Key opened	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Wine	axplons.exe
Key opened	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Wine	axplons.exe
Key opened	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Wine	axplons.exe

Loads dropped DLL 3 IoCs

Processes:

580551.exeRegAsm.exe

pid	Process
1732	580551.exe
2440	RegAsm.exe
2440	RegAsm.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

46df76fcbd73ee551748a4b9a65b6957b6ca4c4a7863a4bb16d40ad5c119bf69.exeaxplons.exeaxplons.exeaxplons.exeaxplons.exe

pid	Process
1820	46df76fcbd73ee551748a4b9a65b6957b6ca4c4a7863a4bb16d40ad5c119bf69.exe
4748	axplons.exe
3736	axplons.exe
2064	axplons.exe
2316	axplons.exe

Suspicious use of SetThreadContext 5 IoCs

Processes:

alex.exegold.exeswizzhis.exelumma1.exefile300un.exe

description	pid	Process	procid_target
PID 4828 set thread context of 2928	4828	alex.exe	86
PID 3240 set thread context of 1792	3240	gold.exe	96
PID 1584 set thread context of 2440	1584	swizzhis.exe	109
PID 4460 set thread context of 4124	4460	lumma1.exe	120
PID 2428 set thread context of 1656	2428	file300un.exe	134

Drops file in Windows directory 1 IoCs

Processes:

46df76fcbd73ee551748a4b9a65b6957b6ca4c4a7863a4bb16d40ad5c119bf69.exe

description	ioc	Process
File created	C:\Windows\Tasks\axplons.job	46df76fcbd73ee551748a4b9a65b6957b6ca4c4a7863a4bb16d40ad5c119bf69.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exe

pid	Process
4124	sc.exe
4992	sc.exe
4696	sc.exe
468	sc.exe
676	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	Process	procid_target
3712	4828	WerFault.exe	85
3876	1656	WerFault.exe	134

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

RegAsm.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

Processes:

schtasks.exe

pid	Process
1380	schtasks.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

keks.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	keks.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	keks.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

Processes:

46df76fcbd73ee551748a4b9a65b6957b6ca4c4a7863a4bb16d40ad5c119bf69.exeaxplons.exetrf.exeRegAsm.exeredline1.exekeks.exeaxplons.exeaxplons.exeaxplons.exe

pid	Process
1820	46df76fcbd73ee551748a4b9a65b6957b6ca4c4a7863a4bb16d40ad5c119bf69.exe
1820	46df76fcbd73ee551748a4b9a65b6957b6ca4c4a7863a4bb16d40ad5c119bf69.exe
4748	axplons.exe
4748	axplons.exe
2164	trf.exe
2440	RegAsm.exe
2440	RegAsm.exe
640	redline1.exe
4628	keks.exe
640	redline1.exe
640	redline1.exe
4628	keks.exe
4628	keks.exe
640	redline1.exe
640	redline1.exe
4628	keks.exe
4628	keks.exe
2440	RegAsm.exe
2440	RegAsm.exe
3736	axplons.exe
3736	axplons.exe
2064	axplons.exe
2064	axplons.exe
2316	axplons.exe
2316	axplons.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

trf.exeredline1.exekeks.exeRegAsm.exe

description	pid	Process
Token: SeDebugPrivilege	2164	trf.exe
Token: SeBackupPrivilege	2164	trf.exe
Token: SeSecurityPrivilege	2164	trf.exe
Token: SeSecurityPrivilege	2164	trf.exe
Token: SeSecurityPrivilege	2164	trf.exe
Token: SeSecurityPrivilege	2164	trf.exe
Token: SeDebugPrivilege	640	redline1.exe
Token: SeDebugPrivilege	4628	keks.exe
Token: SeDebugPrivilege	2928	RegAsm.exe

Suspicious use of UnmapMainImage 1 IoCs

Processes:

msbuild.exe

pid	Process
1656	msbuild.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

46df76fcbd73ee551748a4b9a65b6957b6ca4c4a7863a4bb16d40ad5c119bf69.exeaxplons.exealex.exeRegAsm.exegold.execmd.exeswizzhis.exe

description	pid	Process	procid_target
PID 1820 wrote to memory of 4748	1820	46df76fcbd73ee551748a4b9a65b6957b6ca4c4a7863a4bb16d40ad5c119bf69.exe	84
PID 1820 wrote to memory of 4748	1820	46df76fcbd73ee551748a4b9a65b6957b6ca4c4a7863a4bb16d40ad5c119bf69.exe	84
PID 1820 wrote to memory of 4748	1820	46df76fcbd73ee551748a4b9a65b6957b6ca4c4a7863a4bb16d40ad5c119bf69.exe	84
PID 4748 wrote to memory of 4828	4748	axplons.exe	85
PID 4748 wrote to memory of 4828	4748	axplons.exe	85
PID 4748 wrote to memory of 4828	4748	axplons.exe	85
PID 4828 wrote to memory of 2928	4828	alex.exe	86
PID 4828 wrote to memory of 2928	4828	alex.exe	86
PID 4828 wrote to memory of 2928	4828	alex.exe	86
PID 4828 wrote to memory of 2928	4828	alex.exe	86
PID 4828 wrote to memory of 2928	4828	alex.exe	86
PID 4828 wrote to memory of 2928	4828	alex.exe	86
PID 4828 wrote to memory of 2928	4828	alex.exe	86
PID 4828 wrote to memory of 2928	4828	alex.exe	86
PID 2928 wrote to memory of 2164	2928	RegAsm.exe	90
PID 2928 wrote to memory of 2164	2928	RegAsm.exe	90
PID 2928 wrote to memory of 4628	2928	RegAsm.exe	91
PID 2928 wrote to memory of 4628	2928	RegAsm.exe	91
PID 2928 wrote to memory of 4628	2928	RegAsm.exe	91
PID 4748 wrote to memory of 3240	4748	axplons.exe	93
PID 4748 wrote to memory of 3240	4748	axplons.exe	93
PID 4748 wrote to memory of 3240	4748	axplons.exe	93
PID 3240 wrote to memory of 3688	3240	gold.exe	95
PID 3240 wrote to memory of 3688	3240	gold.exe	95
PID 3240 wrote to memory of 3688	3240	gold.exe	95
PID 3240 wrote to memory of 1792	3240	gold.exe	96
PID 3240 wrote to memory of 1792	3240	gold.exe	96
PID 3240 wrote to memory of 1792	3240	gold.exe	96
PID 3240 wrote to memory of 1792	3240	gold.exe	96
PID 3240 wrote to memory of 1792	3240	gold.exe	96
PID 3240 wrote to memory of 1792	3240	gold.exe	96
PID 3240 wrote to memory of 1792	3240	gold.exe	96
PID 3240 wrote to memory of 1792	3240	gold.exe	96
PID 3240 wrote to memory of 1792	3240	gold.exe	96
PID 4748 wrote to memory of 640	4748	axplons.exe	98
PID 4748 wrote to memory of 640	4748	axplons.exe	98
PID 4748 wrote to memory of 640	4748	axplons.exe	98
PID 4748 wrote to memory of 3600	4748	axplons.exe	99
PID 4748 wrote to memory of 3600	4748	axplons.exe	99
PID 4748 wrote to memory of 3600	4748	axplons.exe	99
PID 2988 wrote to memory of 4124	2988	cmd.exe	120
PID 2988 wrote to memory of 4124	2988	cmd.exe	120
PID 2988 wrote to memory of 4124	2988	cmd.exe	120
PID 2988 wrote to memory of 664	2988	cmd.exe	104
PID 2988 wrote to memory of 664	2988	cmd.exe	104
PID 2988 wrote to memory of 664	2988	cmd.exe	104
PID 2988 wrote to memory of 4992	2988	cmd.exe	105
PID 2988 wrote to memory of 4992	2988	cmd.exe	105
PID 2988 wrote to memory of 4992	2988	cmd.exe	105
PID 2988 wrote to memory of 3704	2988	cmd.exe	106
PID 2988 wrote to memory of 3704	2988	cmd.exe	106
PID 2988 wrote to memory of 3704	2988	cmd.exe	106
PID 4748 wrote to memory of 1584	4748	axplons.exe	107
PID 4748 wrote to memory of 1584	4748	axplons.exe	107
PID 4748 wrote to memory of 1584	4748	axplons.exe	107
PID 1584 wrote to memory of 2440	1584	swizzhis.exe	109
PID 1584 wrote to memory of 2440	1584	swizzhis.exe	109
PID 1584 wrote to memory of 2440	1584	swizzhis.exe	109
PID 1584 wrote to memory of 2440	1584	swizzhis.exe	109
PID 1584 wrote to memory of 2440	1584	swizzhis.exe	109
PID 1584 wrote to memory of 2440	1584	swizzhis.exe	109
PID 1584 wrote to memory of 2440	1584	swizzhis.exe	109
PID 1584 wrote to memory of 2440	1584	swizzhis.exe	109
PID 1584 wrote to memory of 2440	1584	swizzhis.exe	109

C:\Users\Admin\AppData\Local\Temp\46df76fcbd73ee551748a4b9a65b6957b6ca4c4a7863a4bb16d40ad5c119bf69.exe
"C:\Users\Admin\AppData\Local\Temp\46df76fcbd73ee551748a4b9a65b6957b6ca4c4a7863a4bb16d40ad5c119bf69.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
  "C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe
    "C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4828
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      Checks computer location settings
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2928
    - - C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe
        
        "C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2164
    - - C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe
        
        "C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"
        5⤵
        Executes dropped EXE
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4628
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
        5⤵
        
        PID:1412
      - C:\Windows\SysWOW64\choice.exe
        
        choice /C Y /N /D Y /T 3
        6⤵
        
        PID:1144
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 332
      4⤵
      Program crash
      PID:3712
- - C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe
    "C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3240
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:3688
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:1792
- - C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe
    "C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:640
- - C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe
    "C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:3600
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installg.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2988
    - - C:\Windows\SysWOW64\sc.exe
        
        Sc stop GameServerClient
        5⤵
        Launches sc.exe
        
        PID:4124
    - - C:\Program Files (x86)\GameSyncLink\GameService.exe
        
        GameService remove GameServerClient confirm
        5⤵
        
        PID:664
    - - C:\Windows\SysWOW64\sc.exe
        
        Sc delete GameSyncLink
        5⤵
        Launches sc.exe
        
        PID:4992
    - - C:\Program Files (x86)\GameSyncLink\GameService.exe
        
        GameService remove GameSyncLink confirm
        5⤵
        
        PID:3704
    - - C:\Program Files (x86)\GameSyncLink\GameService.exe
        
        GameService install GameSyncLink "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"
        5⤵
        
        PID:4572
    - - C:\Program Files (x86)\GameSyncLink\GameService.exe
        
        GameService start GameSyncLink
        5⤵
        
        PID:1472
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installc.bat" "
      4⤵
      PID:620
    - - C:\Windows\SysWOW64\sc.exe
        
        Sc stop GameServerClientC
        5⤵
        Launches sc.exe
        
        PID:4696
    - - C:\Program Files (x86)\GameSyncLink\GameService.exe
        
        GameService remove GameServerClientC confirm
        5⤵
        
        PID:3624
    - - C:\Windows\SysWOW64\sc.exe
        
        Sc delete PiercingNetLink
        5⤵
        Launches sc.exe
        
        PID:468
    - - C:\Program Files (x86)\GameSyncLink\GameService.exe
        
        GameService remove PiercingNetLink confirm
        5⤵
        
        PID:2916
    - - C:\Program Files (x86)\GameSyncLink\GameService.exe
        
        GameService install PiercingNetLink "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"
        5⤵
        
        PID:4000
    - - C:\Program Files (x86)\GameSyncLink\GameService.exe
        
        GameService start PiercingNetLink
        5⤵
        
        PID:2064
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installm.bat" "
      4⤵
      PID:3516
    - - C:\Windows\SysWOW64\sc.exe
        
        Sc delete GameSyncLinks
        5⤵
        Launches sc.exe
        
        PID:676
    - - C:\Program Files (x86)\GameSyncLink\GameService.exe
        
        GameService remove GameSyncLinks confirm
        5⤵
        
        PID:804
    - - C:\Program Files (x86)\GameSyncLink\GameService.exe
        
        GameService install GameSyncLinks "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"
        5⤵
        
        PID:4780
    - - C:\Program Files (x86)\GameSyncLink\GameService.exe
        
        GameService start GameSyncLinks
        5⤵
        
        PID:4836
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
      4⤵
      PID:956
- - C:\Users\Admin\AppData\Local\Temp\1000007001\swizzhis.exe
    "C:\Users\Admin\AppData\Local\Temp\1000007001\swizzhis.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1584
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      Loads dropped DLL
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      PID:2440
- - C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe
    "C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:4460
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:3672
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:4124
- - C:\Users\Admin\AppData\Local\Temp\1000013001\file300un.exe
    "C:\Users\Admin\AppData\Local\Temp\1000013001\file300un.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:2428
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
      4⤵
      Suspicious use of UnmapMainImage
      PID:1656
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 20
        5⤵
        Program crash
        
        PID:3876
- - C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
    "C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:3512
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:1380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4828 -ip 4828
1⤵
PID:468

C:\Program Files (x86)\GameSyncLink\GameService.exe
"C:\Program Files (x86)\GameSyncLink\GameService.exe"
1⤵
PID:4624
- C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe
  "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"
  2⤵
  PID:1628
- - C:\Windows\Temp\580551.exe
    "C:\Windows\Temp\580551.exe" --list-devices
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1732

C:\Program Files (x86)\GameSyncLink\GameService.exe
"C:\Program Files (x86)\GameSyncLink\GameService.exe"
1⤵
PID:3196
- C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe
  "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"
  2⤵
  PID:1244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1656 -ip 1656
1⤵
PID:2352

C:\Program Files (x86)\GameSyncLink\GameService.exe
"C:\Program Files (x86)\GameSyncLink\GameService.exe"
1⤵
PID:372
- C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe
  "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"
  2⤵
  PID:3880

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3736

C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
1⤵
- Executes dropped EXE
PID:3264

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2064

C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
1⤵
- Executes dropped EXE
PID:4464

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2316

C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
1⤵
- Executes dropped EXE
PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion