amadey | e512cba6514d8c13545316502f389184662a94efa06d19b7cf723b61f8d7f53f

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

Processes:

file300un.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	file300un.exe

Windows security bypass 2 TTPs 2 IoCs

Disable or Modify Tools

Modify Registry

Processes:

file300un.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	file300un.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe = "0"	file300un.exe

Xehook stealer
Xehook is an infostealer written in C#.
stealer xehook
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 11 IoCs

Query Registry

Virtualization/Sandbox Evasion

Processes:

axplont.exeaxplont.exeexplortu.exee512cba6514d8c13545316502f389184662a94efa06d19b7cf723b61f8d7f53f.exef91b495c86.exeaxplont.exeexplortu.exeexplortu.exed8ffd65e79.exeaxplont.exeexplortu.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplont.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplont.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	e512cba6514d8c13545316502f389184662a94efa06d19b7cf723b61f8d7f53f.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	f91b495c86.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplont.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	d8ffd65e79.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplont.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exe

pid	Process
916	powershell.exe

Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 2 IoCs

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

netsh.exenetsh.exe

pid	Process
5784	netsh.exe
5728	netsh.exe

Checks BIOS information in registry 2 TTPs 22 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

e512cba6514d8c13545316502f389184662a94efa06d19b7cf723b61f8d7f53f.exeexplortu.exed8ffd65e79.exeaxplont.exef91b495c86.exeexplortu.exeaxplont.exeexplortu.exeexplortu.exeaxplont.exeaxplont.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	e512cba6514d8c13545316502f389184662a94efa06d19b7cf723b61f8d7f53f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	d8ffd65e79.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplont.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	f91b495c86.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplont.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	e512cba6514d8c13545316502f389184662a94efa06d19b7cf723b61f8d7f53f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplont.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	f91b495c86.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplont.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	d8ffd65e79.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplont.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplont.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplont.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplont.exe

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

RegAsm.exeNewoff.exeRegAsm.exefile300un.exee512cba6514d8c13545316502f389184662a94efa06d19b7cf723b61f8d7f53f.exeexplortu.exed8ffd65e79.exeaxplont.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	Newoff.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	file300un.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	e512cba6514d8c13545316502f389184662a94efa06d19b7cf723b61f8d7f53f.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	explortu.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	d8ffd65e79.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	axplont.exe

Executes dropped EXE 26 IoCs

Processes:

explortu.exed8ffd65e79.exeaxplont.exef91b495c86.exebuildjudit.exestub.exe33333.exefileosn.exeOne.exesvhoost.exelumma1234.exeNewoff.exegold.exeswizzzz.exeaxplont.exeexplortu.exeNewoff.exeexplortu.exeaxplont.exeNewoff.exefile300un.exe4.exevictor.exeexplortu.exeaxplont.exeNewoff.exe

pid	Process
1512	explortu.exe
2892	d8ffd65e79.exe
4888	axplont.exe
3192	f91b495c86.exe
916	buildjudit.exe
4540	stub.exe
2564	33333.exe
3400	fileosn.exe
696	One.exe
3660	svhoost.exe
2044	lumma1234.exe
5176	Newoff.exe
5464	gold.exe
5624	swizzzz.exe
5796	axplont.exe
5804	explortu.exe
6136	Newoff.exe
5616	explortu.exe
5608	axplont.exe
5868	Newoff.exe
4292	file300un.exe
5996	4.exe
2488	victor.exe
2652	explortu.exe
1844	axplont.exe
5888	Newoff.exe

Identifies Wine through registry keys 2 TTPs 11 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Query Registry

Virtualization/Sandbox Evasion

Processes:

d8ffd65e79.exef91b495c86.exeaxplont.exeexplortu.exeexplortu.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exeaxplont.exee512cba6514d8c13545316502f389184662a94efa06d19b7cf723b61f8d7f53f.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Wine	d8ffd65e79.exe
Key opened	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Wine	f91b495c86.exe
Key opened	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Wine	axplont.exe
Key opened	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Wine	axplont.exe
Key opened	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Wine	axplont.exe
Key opened	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Wine	axplont.exe
Key opened	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Wine	e512cba6514d8c13545316502f389184662a94efa06d19b7cf723b61f8d7f53f.exe

Loads dropped DLL 33 IoCs

Processes:

stub.exe

pid	Process
4540	stub.exe
4540	stub.exe
4540	stub.exe
4540	stub.exe
4540	stub.exe
4540	stub.exe
4540	stub.exe
4540	stub.exe
4540	stub.exe
4540	stub.exe
4540	stub.exe
4540	stub.exe
4540	stub.exe
4540	stub.exe
4540	stub.exe
4540	stub.exe
4540	stub.exe
4540	stub.exe
4540	stub.exe
4540	stub.exe
4540	stub.exe
4540	stub.exe
4540	stub.exe
4540	stub.exe
4540	stub.exe
4540	stub.exe
4540	stub.exe
4540	stub.exe
4540	stub.exe
4540	stub.exe
4540	stub.exe
4540	stub.exe
4540	stub.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Windows security modification 2 TTPs 3 IoCs

Disable or Modify Tools

Modify Registry

Processes:

file300un.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions	file300un.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe = "0"	file300un.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	file300un.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Processes:

explortu.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f91b495c86.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000005001\\f91b495c86.exe"	explortu.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

System Information Discovery

Processes:

file300un.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	file300un.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	file300un.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

Processes:

flow	ioc
26	raw.githubusercontent.com
27	raw.githubusercontent.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
24	ip-api.com
124	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs

Processes:

e512cba6514d8c13545316502f389184662a94efa06d19b7cf723b61f8d7f53f.exeexplortu.exed8ffd65e79.exeaxplont.exef91b495c86.exeexplortu.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exeaxplont.exe

pid	Process
2260	e512cba6514d8c13545316502f389184662a94efa06d19b7cf723b61f8d7f53f.exe
1512	explortu.exe
2892	d8ffd65e79.exe
4888	axplont.exe
3192	f91b495c86.exe
5804	explortu.exe
5796	axplont.exe
5616	explortu.exe
5608	axplont.exe
2652	explortu.exe
1844	axplont.exe

Suspicious use of SetThreadContext 6 IoCs

Processes:

33333.exelumma1234.exegold.exeswizzzz.exevictor.exefile300un.exe

description	pid	Process	procid_target
PID 2564 set thread context of 468	2564	33333.exe	115
PID 2044 set thread context of 2728	2044	lumma1234.exe	144
PID 5464 set thread context of 5516	5464	gold.exe	151
PID 5624 set thread context of 5656	5624	swizzzz.exe	153
PID 2488 set thread context of 4704	2488	victor.exe	204
PID 4292 set thread context of 6112	4292	file300un.exe	206

Drops file in Windows directory 2 IoCs

Processes:

e512cba6514d8c13545316502f389184662a94efa06d19b7cf723b61f8d7f53f.exed8ffd65e79.exe

description	ioc	Process
File created	C:\Windows\Tasks\explortu.job	e512cba6514d8c13545316502f389184662a94efa06d19b7cf723b61f8d7f53f.exe
File created	C:\Windows\Tasks\axplont.job	d8ffd65e79.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid	Process
5980	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	Process	procid_target
1788	2564	WerFault.exe	113
5152	5464	WerFault.exe	150
6032	5996	WerFault.exe	200
4492	6112	WerFault.exe	206
4648	2488	WerFault.exe	203

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

4.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	4.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	4.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	4.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

RegAsm.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe

Collects information from the system 1 TTPs 1 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

Processes:

WMIC.exe

pid	Process
3600	WMIC.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

Processes:

schtasks.exe

pid	Process
5228	schtasks.exe

Delays execution with timeout.exe 1 IoCs

Processes:

timeout.exe

pid	Process
5172	timeout.exe

Enumerates processes with tasklist 1 TTPs 3 IoCs

Process Discovery

T1057

Processes:

tasklist.exetasklist.exetasklist.exe

pid	Process
2284	tasklist.exe
4592	tasklist.exe
2044	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

T1059

Processes:

ipconfig.exeNETSTAT.EXE

pid	Process
2284	ipconfig.exe
3056	NETSTAT.EXE

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

Processes:

systeminfo.exe

pid	Process
4044	systeminfo.exe

Kills process with taskkill 1 IoCs

Processes:

taskkill.exe

pid	Process
2432	taskkill.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

Processes:

svhoost.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	svhoost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	svhoost.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

Processes:

e512cba6514d8c13545316502f389184662a94efa06d19b7cf723b61f8d7f53f.exeexplortu.exed8ffd65e79.exeaxplont.exef91b495c86.exepowershell.exeRegAsm.exeexplortu.exeaxplont.exesvhoost.exeOne.exefileosn.exeexplortu.exeaxplont.exepowershell.exeexplortu.exeaxplont.exe

pid	Process
2260	e512cba6514d8c13545316502f389184662a94efa06d19b7cf723b61f8d7f53f.exe
2260	e512cba6514d8c13545316502f389184662a94efa06d19b7cf723b61f8d7f53f.exe
1512	explortu.exe
1512	explortu.exe
2892	d8ffd65e79.exe
2892	d8ffd65e79.exe
4888	axplont.exe
4888	axplont.exe
3192	f91b495c86.exe
3192	f91b495c86.exe
3616	powershell.exe
3616	powershell.exe
3616	powershell.exe
5656	RegAsm.exe
5656	RegAsm.exe
5804	explortu.exe
5804	explortu.exe
5796	axplont.exe
5796	axplont.exe
3660	svhoost.exe
3660	svhoost.exe
696	One.exe
696	One.exe
3660	svhoost.exe
3660	svhoost.exe
3660	svhoost.exe
3660	svhoost.exe
3400	fileosn.exe
3400	fileosn.exe
3400	fileosn.exe
3400	fileosn.exe
3400	fileosn.exe
3400	fileosn.exe
5616	explortu.exe
5616	explortu.exe
5608	axplont.exe
5608	axplont.exe
916	powershell.exe
916	powershell.exe
916	powershell.exe
2652	explortu.exe
2652	explortu.exe
1844	axplont.exe
1844	axplont.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

WMIC.exetasklist.exetaskkill.exetasklist.exepowershell.exeOne.exesvhoost.exeWMIC.exe

description	pid	Process
Token: SeIncreaseQuotaPrivilege	868	WMIC.exe
Token: SeSecurityPrivilege	868	WMIC.exe
Token: SeTakeOwnershipPrivilege	868	WMIC.exe
Token: SeLoadDriverPrivilege	868	WMIC.exe
Token: SeSystemProfilePrivilege	868	WMIC.exe
Token: SeSystemtimePrivilege	868	WMIC.exe
Token: SeProfSingleProcessPrivilege	868	WMIC.exe
Token: SeIncBasePriorityPrivilege	868	WMIC.exe
Token: SeCreatePagefilePrivilege	868	WMIC.exe
Token: SeBackupPrivilege	868	WMIC.exe
Token: SeRestorePrivilege	868	WMIC.exe
Token: SeShutdownPrivilege	868	WMIC.exe
Token: SeDebugPrivilege	868	WMIC.exe
Token: SeSystemEnvironmentPrivilege	868	WMIC.exe
Token: SeRemoteShutdownPrivilege	868	WMIC.exe
Token: SeUndockPrivilege	868	WMIC.exe
Token: SeManageVolumePrivilege	868	WMIC.exe
Token: 33	868	WMIC.exe
Token: 34	868	WMIC.exe
Token: 35	868	WMIC.exe
Token: 36	868	WMIC.exe
Token: SeIncreaseQuotaPrivilege	868	WMIC.exe
Token: SeSecurityPrivilege	868	WMIC.exe
Token: SeTakeOwnershipPrivilege	868	WMIC.exe
Token: SeLoadDriverPrivilege	868	WMIC.exe
Token: SeSystemProfilePrivilege	868	WMIC.exe
Token: SeSystemtimePrivilege	868	WMIC.exe
Token: SeProfSingleProcessPrivilege	868	WMIC.exe
Token: SeIncBasePriorityPrivilege	868	WMIC.exe
Token: SeCreatePagefilePrivilege	868	WMIC.exe
Token: SeBackupPrivilege	868	WMIC.exe
Token: SeRestorePrivilege	868	WMIC.exe
Token: SeShutdownPrivilege	868	WMIC.exe
Token: SeDebugPrivilege	868	WMIC.exe
Token: SeSystemEnvironmentPrivilege	868	WMIC.exe
Token: SeRemoteShutdownPrivilege	868	WMIC.exe
Token: SeUndockPrivilege	868	WMIC.exe
Token: SeManageVolumePrivilege	868	WMIC.exe
Token: 33	868	WMIC.exe
Token: 34	868	WMIC.exe
Token: 35	868	WMIC.exe
Token: 36	868	WMIC.exe
Token: SeDebugPrivilege	2284	tasklist.exe
Token: SeDebugPrivilege	2432	taskkill.exe
Token: SeDebugPrivilege	4592	tasklist.exe
Token: SeDebugPrivilege	3616	powershell.exe
Token: SeDebugPrivilege	696	One.exe
Token: SeBackupPrivilege	696	One.exe
Token: SeSecurityPrivilege	696	One.exe
Token: SeSecurityPrivilege	696	One.exe
Token: SeSecurityPrivilege	696	One.exe
Token: SeSecurityPrivilege	696	One.exe
Token: SeDebugPrivilege	3660	svhoost.exe
Token: SeIncreaseQuotaPrivilege	3600	WMIC.exe
Token: SeSecurityPrivilege	3600	WMIC.exe
Token: SeTakeOwnershipPrivilege	3600	WMIC.exe
Token: SeLoadDriverPrivilege	3600	WMIC.exe
Token: SeSystemProfilePrivilege	3600	WMIC.exe
Token: SeSystemtimePrivilege	3600	WMIC.exe
Token: SeProfSingleProcessPrivilege	3600	WMIC.exe
Token: SeIncBasePriorityPrivilege	3600	WMIC.exe
Token: SeCreatePagefilePrivilege	3600	WMIC.exe
Token: SeBackupPrivilege	3600	WMIC.exe
Token: SeRestorePrivilege	3600	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

e512cba6514d8c13545316502f389184662a94efa06d19b7cf723b61f8d7f53f.exeexplortu.exed8ffd65e79.exeaxplont.exebuildjudit.exestub.execmd.execmd.execmd.execmd.exe33333.execmd.execmd.exe

description	pid	Process	procid_target
PID 2260 wrote to memory of 1512	2260	e512cba6514d8c13545316502f389184662a94efa06d19b7cf723b61f8d7f53f.exe	84
PID 2260 wrote to memory of 1512	2260	e512cba6514d8c13545316502f389184662a94efa06d19b7cf723b61f8d7f53f.exe	84
PID 2260 wrote to memory of 1512	2260	e512cba6514d8c13545316502f389184662a94efa06d19b7cf723b61f8d7f53f.exe	84
PID 1512 wrote to memory of 1660	1512	explortu.exe	89
PID 1512 wrote to memory of 1660	1512	explortu.exe	89
PID 1512 wrote to memory of 1660	1512	explortu.exe	89
PID 1512 wrote to memory of 2892	1512	explortu.exe	90
PID 1512 wrote to memory of 2892	1512	explortu.exe	90
PID 1512 wrote to memory of 2892	1512	explortu.exe	90
PID 2892 wrote to memory of 4888	2892	d8ffd65e79.exe	92
PID 2892 wrote to memory of 4888	2892	d8ffd65e79.exe	92
PID 2892 wrote to memory of 4888	2892	d8ffd65e79.exe	92
PID 1512 wrote to memory of 3192	1512	explortu.exe	93
PID 1512 wrote to memory of 3192	1512	explortu.exe	93
PID 1512 wrote to memory of 3192	1512	explortu.exe	93
PID 4888 wrote to memory of 916	4888	axplont.exe	96
PID 4888 wrote to memory of 916	4888	axplont.exe	96
PID 916 wrote to memory of 4540	916	buildjudit.exe	97
PID 916 wrote to memory of 4540	916	buildjudit.exe	97
PID 4540 wrote to memory of 1684	4540	stub.exe	137
PID 4540 wrote to memory of 1684	4540	stub.exe	137
PID 4540 wrote to memory of 3616	4540	stub.exe	124
PID 4540 wrote to memory of 3616	4540	stub.exe	124
PID 4540 wrote to memory of 4560	4540	stub.exe	101
PID 4540 wrote to memory of 4560	4540	stub.exe	101
PID 3616 wrote to memory of 868	3616	cmd.exe	104
PID 3616 wrote to memory of 868	3616	cmd.exe	104
PID 4560 wrote to memory of 2284	4560	cmd.exe	105
PID 4560 wrote to memory of 2284	4560	cmd.exe	105
PID 4540 wrote to memory of 4180	4540	stub.exe	106
PID 4540 wrote to memory of 4180	4540	stub.exe	106
PID 4180 wrote to memory of 4568	4180	cmd.exe	108
PID 4180 wrote to memory of 4568	4180	cmd.exe	108
PID 4540 wrote to memory of 4640	4540	stub.exe	109
PID 4540 wrote to memory of 4640	4540	stub.exe	109
PID 4540 wrote to memory of 2204	4540	stub.exe	110
PID 4540 wrote to memory of 2204	4540	stub.exe	110
PID 2204 wrote to memory of 2432	2204	cmd.exe	112
PID 2204 wrote to memory of 2432	2204	cmd.exe	112
PID 4888 wrote to memory of 2564	4888	axplont.exe	113
PID 4888 wrote to memory of 2564	4888	axplont.exe	113
PID 4888 wrote to memory of 2564	4888	axplont.exe	113
PID 2564 wrote to memory of 3580	2564	33333.exe	114
PID 2564 wrote to memory of 3580	2564	33333.exe	114
PID 2564 wrote to memory of 3580	2564	33333.exe	114
PID 2564 wrote to memory of 468	2564	33333.exe	115
PID 2564 wrote to memory of 468	2564	33333.exe	115
PID 2564 wrote to memory of 468	2564	33333.exe	115
PID 4540 wrote to memory of 212	4540	stub.exe	116
PID 4540 wrote to memory of 212	4540	stub.exe	116
PID 4540 wrote to memory of 4176	4540	stub.exe	117
PID 4540 wrote to memory of 4176	4540	stub.exe	117
PID 4540 wrote to memory of 2984	4540	stub.exe	118
PID 4540 wrote to memory of 2984	4540	stub.exe	118
PID 4540 wrote to memory of 4660	4540	stub.exe	119
PID 4540 wrote to memory of 4660	4540	stub.exe	119
PID 2564 wrote to memory of 468	2564	33333.exe	115
PID 2564 wrote to memory of 468	2564	33333.exe	115
PID 2564 wrote to memory of 468	2564	33333.exe	115
PID 2564 wrote to memory of 468	2564	33333.exe	115
PID 2564 wrote to memory of 468	2564	33333.exe	115
PID 4176 wrote to memory of 3616	4176	cmd.exe	124
PID 4176 wrote to memory of 3616	4176	cmd.exe	124
PID 4660 wrote to memory of 2484	4660	cmd.exe	125

System policy modification 1 TTPs 1 IoCs

Modify Registry

Processes:

file300un.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	file300un.exe

Views/modifies file attributes 1 TTPs 1 IoCs

Hidden Files and Directories

T1564.001

Processes:

attrib.exe

pid	Process
4568	attrib.exe

C:\Users\Admin\AppData\Local\Temp\e512cba6514d8c13545316502f389184662a94efa06d19b7cf723b61f8d7f53f.exe
"C:\Users\Admin\AppData\Local\Temp\e512cba6514d8c13545316502f389184662a94efa06d19b7cf723b61f8d7f53f.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
  "C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1512
- - C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
    "C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
    3⤵
    PID:1660
- - C:\Users\Admin\1000004002\d8ffd65e79.exe
    "C:\Users\Admin\1000004002\d8ffd65e79.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2892
  - - C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
      "C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Checks computer location settings
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4888
    - - C:\Users\Admin\AppData\Local\Temp\1000002001\buildjudit.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000002001\buildjudit.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:916
      - C:\Users\Admin\AppData\Local\Temp\onefile_916_133612973888968950\stub.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000002001\buildjudit.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:4540
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        7⤵
        
        PID:1684
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3616
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:868
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4560
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2284
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\MonsterUpdateService\Monster.exe""
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4180
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Local\MonsterUpdateService\Monster.exe"
        8⤵
        Views/modifies file attributes
        
        PID:4568
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('%error_message%', 0, 'System Error', 0+16);close()""
        7⤵
        
        PID:4640
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2204
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM chrome.exe
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2432
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        7⤵
        
        PID:212
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        8⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4592
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4176
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Get-Clipboard
        8⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3616
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "chcp"
        7⤵
        
        PID:2984
        
        C:\Windows\system32\chcp.com
        
        chcp
        8⤵
        
        PID:1404
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "chcp"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4660
        
        C:\Windows\system32\chcp.com
        
        chcp
        8⤵
        
        PID:2484
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
        7⤵
        
        PID:3824
        
        C:\Windows\system32\systeminfo.exe
        
        systeminfo
        8⤵
        Gathers system information
        
        PID:4044
        
        C:\Windows\system32\HOSTNAME.EXE
        
        hostname
        8⤵
        
        PID:1312
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic logicaldisk get caption,description,providername
        8⤵
        Collects information from the system
        Suspicious use of AdjustPrivilegeToken
        
        PID:3600
        
        C:\Windows\system32\net.exe
        
        net user
        8⤵
        
        PID:212
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        9⤵
        
        PID:2260
        
        C:\Windows\system32\query.exe
        
        query user
        8⤵
        
        PID:5356
        
        C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        9⤵
        
        PID:5460
        
        C:\Windows\system32\net.exe
        
        net localgroup
        8⤵
        
        PID:5512
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        9⤵
        
        PID:5528
        
        C:\Windows\system32\net.exe
        
        net localgroup administrators
        8⤵
        
        PID:5560
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        9⤵
        
        PID:5576
        
        C:\Windows\system32\net.exe
        
        net user guest
        8⤵
        
        PID:5416
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        9⤵
        
        PID:5612
        
        C:\Windows\system32\net.exe
        
        net user administrator
        8⤵
        
        PID:3348
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        9⤵
        
        PID:5640
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic startup get caption,command
        8⤵
        
        PID:5624
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /svc
        8⤵
        Enumerates processes with tasklist
        
        PID:2044
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /all
        8⤵
        Gathers network information
        
        PID:2284
        
        C:\Windows\system32\ROUTE.EXE
        
        route print
        8⤵
        
        PID:5100
        
        C:\Windows\system32\ARP.EXE
        
        arp -a
        8⤵
        
        PID:5760
        
        C:\Windows\system32\NETSTAT.EXE
        
        netstat -ano
        8⤵
        Gathers network information
        
        PID:3056
        
        C:\Windows\system32\sc.exe
        
        sc query type= service state= all
        8⤵
        Launches sc.exe
        
        PID:5980
        
        C:\Windows\system32\netsh.exe
        
        netsh firewall show state
        8⤵
        Modifies Windows Firewall
        
        PID:5784
        
        C:\Windows\system32\netsh.exe
        
        netsh firewall show config
        8⤵
        Modifies Windows Firewall
        
        PID:5728
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
        7⤵
        
        PID:856
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        8⤵
        
        PID:3256
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        7⤵
        
        PID:5900
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        8⤵
        
        PID:5944
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        7⤵
        
        PID:5132
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        8⤵
        
        PID:6016
    - - C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2564
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:3580
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        Checks computer location settings
        
        PID:468
        
        C:\Users\Admin\AppData\Roaming\configurationValue\One.exe
        
        "C:\Users\Admin\AppData\Roaming\configurationValue\One.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:696
        
        C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe
        
        "C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe"
        7⤵
        Executes dropped EXE
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3660
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
        7⤵
        
        PID:3836
        
        C:\Windows\SysWOW64\choice.exe
        
        choice /C Y /N /D Y /T 3
        8⤵
        
        PID:2380
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 272
        6⤵
        Program crash
        
        PID:1788
    - - C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:3400
    - - C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2044
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:2728
    - - C:\Users\Admin\AppData\Local\Temp\1000007001\Newoff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000007001\Newoff.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:5176
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Newoff.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000007001\Newoff.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:5228
    - - C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5464
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:5516
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5464 -s 244
        6⤵
        Program crash
        
        PID:5152
    - - C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5624
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        Checks computer location settings
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:5656
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" & del "C:\ProgramData\*.dll"" & exit
        7⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 5
        8⤵
        Delays execution with timeout.exe
        
        PID:5172
    - - C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe"
        5⤵
        UAC bypass
        Windows security bypass
        Checks computer location settings
        Executes dropped EXE
        Windows security modification
        Checks whether UAC is enabled
        Suspicious use of SetThreadContext
        System policy modification
        
        PID:4292
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe" -Force
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:916
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
        6⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6112 -s 152
        7⤵
        Program crash
        
        PID:4492
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
        6⤵
        
        PID:4300
    - - C:\Users\Admin\AppData\Local\Temp\1000022001\4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000022001\4.exe"
        5⤵
        Executes dropped EXE
        Checks SCSI registry key(s)
        
        PID:5996
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5996 -s 352
        6⤵
        Program crash
        
        PID:6032
    - - C:\Users\Admin\AppData\Local\Temp\1000025001\victor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000025001\victor.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2488
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:4704
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 284
        6⤵
        Program crash
        
        PID:4648
- - C:\Users\Admin\AppData\Local\Temp\1000005001\f91b495c86.exe
    "C:\Users\Admin\AppData\Local\Temp\1000005001\f91b495c86.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:3192

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:1684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2564 -ip 2564
  2⤵
  PID:3228
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5464 -ip 5464
  2⤵
  PID:1988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 5996 -ip 5996
  2⤵
  PID:6056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6112 -ip 6112
  2⤵
  PID:3120
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2488 -ip 2488
  2⤵
  PID:5244

C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5796

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5804

C:\Users\Admin\AppData\Local\Temp\1000007001\Newoff.exe
C:\Users\Admin\AppData\Local\Temp\1000007001\Newoff.exe
1⤵
- Executes dropped EXE
PID:6136

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5616

C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5608

C:\Users\Admin\AppData\Local\Temp\1000007001\Newoff.exe
C:\Users\Admin\AppData\Local\Temp\1000007001\Newoff.exe
1⤵
- Executes dropped EXE
PID:5868

C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1844

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2652

C:\Users\Admin\AppData\Local\Temp\1000007001\Newoff.exe
C:\Users\Admin\AppData\Local\Temp\1000007001\Newoff.exe
1⤵
- Executes dropped EXE
PID:5888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

Modify Registry

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion