amadey | f8d7b0335fd968d6dadd59a5a07dcccbd3cd4b3cb774125919f24c5ea9b16b2e

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	f8d7b0335fd968d6dadd59a5a07dcccbd3cd4b3cb774125919f24c5ea9b16b2e.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
6000	powershell.exe
6008	powershell.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	f8d7b0335fd968d6dadd59a5a07dcccbd3cd4b3cb774125919f24c5ea9b16b2e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	f8d7b0335fd968d6dadd59a5a07dcccbd3cd4b3cb774125919f24c5ea9b16b2e.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	NewLatest.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	f8d7b0335fd968d6dadd59a5a07dcccbd3cd4b3cb774125919f24c5ea9b16b2e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	axplong.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	deep.exe

Executes dropped EXE 19 IoCs

pid	Process
212	axplong.exe
4400	axplong.exe
2860	redline123123.exe
5020	judit.exe
3024	upd.exe
5008	deep.exe
2164	stub.exe
3380	gold.exe
4848	lummac2.exe
512	da_protected.exe
4684	svhoost.exe
3240	One.exe
2460	drivermanager.exe
2032	NewLatest.exe
3236	Hkbsse.exe
5228	monster.exe
5484	legs.exe
5572	stub.exe
5988	quickaccesspopup.exe

Identifies Wine through registry keys 2 TTPs 3 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Wine	f8d7b0335fd968d6dadd59a5a07dcccbd3cd4b3cb774125919f24c5ea9b16b2e.exe
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Wine	axplong.exe

Loads dropped DLL 55 IoCs

pid	Process
2164	stub.exe
2164	stub.exe
2164	stub.exe
2164	stub.exe
2164	stub.exe
2164	stub.exe
2164	stub.exe
2164	stub.exe
2164	stub.exe
2164	stub.exe
2164	stub.exe
2164	stub.exe
2164	stub.exe
2164	stub.exe
2164	stub.exe
2164	stub.exe
2164	stub.exe
2164	stub.exe
2164	stub.exe
2164	stub.exe
2164	stub.exe
2164	stub.exe
2164	stub.exe
2164	stub.exe
2164	stub.exe
2164	stub.exe
2164	stub.exe
2164	stub.exe
2164	stub.exe
2164	stub.exe
2164	stub.exe
2164	stub.exe
5572	stub.exe
5572	stub.exe
5572	stub.exe
5572	stub.exe
5572	stub.exe
5572	stub.exe
5572	stub.exe
5572	stub.exe
5572	stub.exe
5572	stub.exe
5572	stub.exe
5572	stub.exe
5572	stub.exe
5572	stub.exe
5572	stub.exe
5572	stub.exe
5572	stub.exe
5572	stub.exe
5572	stub.exe
5572	stub.exe
5572	stub.exe
5572	stub.exe
5572	stub.exe

Themida packer 5 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x00110000000232a7-222.dat	themida
behavioral1/memory/512-613-0x0000000000AF0000-0x0000000001448000-memory.dmp	themida
behavioral1/memory/512-614-0x0000000000AF0000-0x0000000001448000-memory.dmp	themida
behavioral1/files/0x0005000000016868-662.dat	themida
behavioral1/memory/512-713-0x0000000000AF0000-0x0000000001448000-memory.dmp	themida

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
4268	f8d7b0335fd968d6dadd59a5a07dcccbd3cd4b3cb774125919f24c5ea9b16b2e.exe
212	axplong.exe
4400	axplong.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3024 set thread context of 4828	3024	upd.exe	108
PID 3380 set thread context of 2504	3380	gold.exe	112
PID 2460 set thread context of 5168	2460	drivermanager.exe	131
PID 5484 set thread context of 5616	5484	legs.exe	135

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\axplong.job	f8d7b0335fd968d6dadd59a5a07dcccbd3cd4b3cb774125919f24c5ea9b16b2e.exe
File created	C:\Windows\Tasks\Hkbsse.job	NewLatest.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral1/files/0x00070000000232a9-165.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5996	5484	WerFault.exe	133
3544	512	WerFault.exe	116

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
4624	tasklist.exe
5176	tasklist.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	svhoost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	svhoost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
5656	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4268	f8d7b0335fd968d6dadd59a5a07dcccbd3cd4b3cb774125919f24c5ea9b16b2e.exe
4268	f8d7b0335fd968d6dadd59a5a07dcccbd3cd4b3cb774125919f24c5ea9b16b2e.exe
212	axplong.exe
212	axplong.exe
4400	axplong.exe
4400	axplong.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4040	WMIC.exe
Token: SeSecurityPrivilege	4040	WMIC.exe
Token: SeTakeOwnershipPrivilege	4040	WMIC.exe
Token: SeLoadDriverPrivilege	4040	WMIC.exe
Token: SeSystemProfilePrivilege	4040	WMIC.exe
Token: SeSystemtimePrivilege	4040	WMIC.exe
Token: SeProfSingleProcessPrivilege	4040	WMIC.exe
Token: SeIncBasePriorityPrivilege	4040	WMIC.exe
Token: SeCreatePagefilePrivilege	4040	WMIC.exe
Token: SeBackupPrivilege	4040	WMIC.exe
Token: SeRestorePrivilege	4040	WMIC.exe
Token: SeShutdownPrivilege	4040	WMIC.exe
Token: SeDebugPrivilege	4040	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4040	WMIC.exe
Token: SeRemoteShutdownPrivilege	4040	WMIC.exe
Token: SeUndockPrivilege	4040	WMIC.exe
Token: SeManageVolumePrivilege	4040	WMIC.exe
Token: 33	4040	WMIC.exe
Token: 34	4040	WMIC.exe
Token: 35	4040	WMIC.exe
Token: 36	4040	WMIC.exe
Token: SeDebugPrivilege	4624	tasklist.exe
Token: SeIncreaseQuotaPrivilege	4040	WMIC.exe
Token: SeSecurityPrivilege	4040	WMIC.exe
Token: SeTakeOwnershipPrivilege	4040	WMIC.exe
Token: SeLoadDriverPrivilege	4040	WMIC.exe
Token: SeSystemProfilePrivilege	4040	WMIC.exe
Token: SeSystemtimePrivilege	4040	WMIC.exe
Token: SeProfSingleProcessPrivilege	4040	WMIC.exe
Token: SeIncBasePriorityPrivilege	4040	WMIC.exe
Token: SeCreatePagefilePrivilege	4040	WMIC.exe
Token: SeBackupPrivilege	4040	WMIC.exe
Token: SeRestorePrivilege	4040	WMIC.exe
Token: SeShutdownPrivilege	4040	WMIC.exe
Token: SeDebugPrivilege	4040	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4040	WMIC.exe
Token: SeRemoteShutdownPrivilege	4040	WMIC.exe
Token: SeUndockPrivilege	4040	WMIC.exe
Token: SeManageVolumePrivilege	4040	WMIC.exe
Token: 33	4040	WMIC.exe
Token: 34	4040	WMIC.exe
Token: 35	4040	WMIC.exe
Token: 36	4040	WMIC.exe
Token: SeDebugPrivilege	3240	One.exe
Token: SeDebugPrivilege	2460	drivermanager.exe
Token: SeBackupPrivilege	3240	One.exe
Token: SeSecurityPrivilege	3240	One.exe
Token: SeSecurityPrivilege	3240	One.exe
Token: SeSecurityPrivilege	3240	One.exe
Token: SeSecurityPrivilege	3240	One.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4268	f8d7b0335fd968d6dadd59a5a07dcccbd3cd4b3cb774125919f24c5ea9b16b2e.exe
2032	NewLatest.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4268 wrote to memory of 212	4268	f8d7b0335fd968d6dadd59a5a07dcccbd3cd4b3cb774125919f24c5ea9b16b2e.exe	91
PID 4268 wrote to memory of 212	4268	f8d7b0335fd968d6dadd59a5a07dcccbd3cd4b3cb774125919f24c5ea9b16b2e.exe	91
PID 4268 wrote to memory of 212	4268	f8d7b0335fd968d6dadd59a5a07dcccbd3cd4b3cb774125919f24c5ea9b16b2e.exe	91
PID 212 wrote to memory of 2860	212	axplong.exe	102
PID 212 wrote to memory of 2860	212	axplong.exe	102
PID 212 wrote to memory of 2860	212	axplong.exe	102
PID 212 wrote to memory of 5020	212	axplong.exe	104
PID 212 wrote to memory of 5020	212	axplong.exe	104
PID 212 wrote to memory of 3024	212	axplong.exe	105
PID 212 wrote to memory of 3024	212	axplong.exe	105
PID 212 wrote to memory of 3024	212	axplong.exe	105
PID 3024 wrote to memory of 4356	3024	upd.exe	106
PID 3024 wrote to memory of 4356	3024	upd.exe	106
PID 3024 wrote to memory of 4356	3024	upd.exe	106
PID 3024 wrote to memory of 836	3024	upd.exe	107
PID 3024 wrote to memory of 836	3024	upd.exe	107
PID 3024 wrote to memory of 836	3024	upd.exe	107
PID 3024 wrote to memory of 4828	3024	upd.exe	108
PID 3024 wrote to memory of 4828	3024	upd.exe	108
PID 3024 wrote to memory of 4828	3024	upd.exe	108
PID 3024 wrote to memory of 4828	3024	upd.exe	108
PID 3024 wrote to memory of 4828	3024	upd.exe	108
PID 3024 wrote to memory of 4828	3024	upd.exe	108
PID 3024 wrote to memory of 4828	3024	upd.exe	108
PID 3024 wrote to memory of 4828	3024	upd.exe	108
PID 212 wrote to memory of 5008	212	axplong.exe	110
PID 212 wrote to memory of 5008	212	axplong.exe	110
PID 212 wrote to memory of 5008	212	axplong.exe	110
PID 5020 wrote to memory of 2164	5020	judit.exe	109
PID 5020 wrote to memory of 2164	5020	judit.exe	109
PID 212 wrote to memory of 3380	212	axplong.exe	111
PID 212 wrote to memory of 3380	212	axplong.exe	111
PID 212 wrote to memory of 3380	212	axplong.exe	111
PID 3380 wrote to memory of 2504	3380	gold.exe	112
PID 3380 wrote to memory of 2504	3380	gold.exe	112
PID 3380 wrote to memory of 2504	3380	gold.exe	112
PID 3380 wrote to memory of 2504	3380	gold.exe	112
PID 3380 wrote to memory of 2504	3380	gold.exe	112
PID 3380 wrote to memory of 2504	3380	gold.exe	112
PID 3380 wrote to memory of 2504	3380	gold.exe	112
PID 3380 wrote to memory of 2504	3380	gold.exe	112
PID 2164 wrote to memory of 228	2164	stub.exe	113
PID 2164 wrote to memory of 228	2164	stub.exe	113
PID 212 wrote to memory of 4848	212	axplong.exe	115
PID 212 wrote to memory of 4848	212	axplong.exe	115
PID 212 wrote to memory of 4848	212	axplong.exe	115
PID 5008 wrote to memory of 512	5008	deep.exe	116
PID 5008 wrote to memory of 512	5008	deep.exe	116
PID 5008 wrote to memory of 512	5008	deep.exe	116
PID 2164 wrote to memory of 2416	2164	stub.exe	118
PID 2164 wrote to memory of 2416	2164	stub.exe	118
PID 2164 wrote to memory of 3424	2164	stub.exe	119
PID 2164 wrote to memory of 3424	2164	stub.exe	119
PID 2416 wrote to memory of 4040	2416	cmd.exe	122
PID 2416 wrote to memory of 4040	2416	cmd.exe	122
PID 3424 wrote to memory of 4624	3424	cmd.exe	123
PID 3424 wrote to memory of 4624	3424	cmd.exe	123
PID 4828 wrote to memory of 4684	4828	RegAsm.exe	125
PID 4828 wrote to memory of 4684	4828	RegAsm.exe	125
PID 4828 wrote to memory of 4684	4828	RegAsm.exe	125
PID 4828 wrote to memory of 3240	4828	RegAsm.exe	124
PID 4828 wrote to memory of 3240	4828	RegAsm.exe	124
PID 212 wrote to memory of 2460	212	axplong.exe	127
PID 212 wrote to memory of 2460	212	axplong.exe	127

C:\Users\Admin\AppData\Local\Temp\f8d7b0335fd968d6dadd59a5a07dcccbd3cd4b3cb774125919f24c5ea9b16b2e.exe
"C:\Users\Admin\AppData\Local\Temp\f8d7b0335fd968d6dadd59a5a07dcccbd3cd4b3cb774125919f24c5ea9b16b2e.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
  "C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:212
- - C:\Users\Admin\AppData\Local\Temp\1000007001\redline123123.exe
    "C:\Users\Admin\AppData\Local\Temp\1000007001\redline123123.exe"
    3⤵
    - Executes dropped EXE
    PID:2860
- - C:\Users\Admin\AppData\Local\Temp\1000005001\judit.exe
    "C:\Users\Admin\AppData\Local\Temp\1000005001\judit.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5020
  - - C:\Users\Admin\AppData\Local\Temp\onefile_5020_133633584733213107\stub.exe
      "C:\Users\Admin\AppData\Local\Temp\1000005001\judit.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2164
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:228
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2416
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4040
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3424
      - C:\Windows\system32\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4624
- - C:\Users\Admin\AppData\Local\Temp\1000008001\upd.exe
    "C:\Users\Admin\AppData\Local\Temp\1000008001\upd.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3024
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:4356
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:836
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:4828
    - - C:\Users\Admin\AppData\Roaming\configurationValue\One.exe
        
        "C:\Users\Admin\AppData\Roaming\configurationValue\One.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3240
    - - C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe
        
        "C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe"
        5⤵
        Executes dropped EXE
        Modifies system certificate store
        
        PID:4684
- - C:\Users\Admin\AppData\Local\Temp\1000025001\deep.exe
    "C:\Users\Admin\AppData\Local\Temp\1000025001\deep.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5008
  - - C:\Users\Admin\AppData\Local\Temp\da_protected.exe
      "C:\Users\Admin\AppData\Local\Temp\da_protected.exe"
      4⤵
      Executes dropped EXE
      PID:512
    - - C:\Users\Admin\AppData\Local\Temp\advrir.exe
        
        "C:\Users\Admin\AppData\Local\Temp\advrir.exe"
        5⤵
        
        PID:5260
      - C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        setup.exe
        6⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\setup-ca14673535d20c5b\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup-ca14673535d20c5b\setup.exe"
        7⤵
        
        PID:4612
        
        C:\Windows\system32\winsvc.exe
        
        "C:\Windows\system32\winsvc.exe" "C:\Users\Admin\AppData\Local\Temp\setup-ca14673535d20c5b\setup.exe"
        8⤵
        
        PID:5264
    - - C:\Users\Admin\AppData\Local\Temp\aulokj.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aulokj.exe"
        5⤵
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\rad_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\rad_protected.exe"
        6⤵
        
        PID:2480
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 512 -s 2200
        5⤵
        Program crash
        
        PID:3544
- - C:\Users\Admin\AppData\Local\Temp\1000035001\gold.exe
    "C:\Users\Admin\AppData\Local\Temp\1000035001\gold.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3380
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:2504
- - C:\Users\Admin\AppData\Local\Temp\1000047001\lummac2.exe
    "C:\Users\Admin\AppData\Local\Temp\1000047001\lummac2.exe"
    3⤵
    - Executes dropped EXE
    PID:4848
- - C:\Users\Admin\AppData\Local\Temp\1000063001\drivermanager.exe
    "C:\Users\Admin\AppData\Local\Temp\1000063001\drivermanager.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    PID:2460
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:5168
- - C:\Users\Admin\AppData\Local\Temp\1000064001\NewLatest.exe
    "C:\Users\Admin\AppData\Local\Temp\1000064001\NewLatest.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of FindShellTrayWindow
    PID:2032
  - - C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
      "C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe"
      4⤵
      Executes dropped EXE
      PID:3236
    - - C:\Users\Admin\AppData\Local\Temp\1000005001\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000005001\setup.exe"
        5⤵
        
        PID:5144
      - C:\Users\Admin\AppData\Local\Temp\7zS2428.tmp\Install.exe
        
        .\Install.exe
        6⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\7zS2AB0.tmp\Install.exe
        
        .\Install.exe /YAadidcC "385119" /S
        7⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        8⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
        9⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        10⤵
        
        PID:5968
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        11⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
        9⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        10⤵
        
        PID:764
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        11⤵
        
        PID:5020
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
        9⤵
        
        PID:1928
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        10⤵
        
        PID:776
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        11⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
        9⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        10⤵
        
        PID:4172
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        11⤵
        
        PID:4656
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        9⤵
        
        PID:4592
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        10⤵
        
        PID:1444
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        11⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6008
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        12⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        8⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        9⤵
        
        PID:1492
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        10⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6000
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        11⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bRfJDuKmNsszhfPRJj" /SC once /ST 12:03:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS2AB0.tmp\Install.exe\" oU /QkFdidlD 385119 /S" /V1 /F
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5656
- - C:\Users\Admin\AppData\Local\Temp\1000070001\monster.exe
    "C:\Users\Admin\AppData\Local\Temp\1000070001\monster.exe"
    3⤵
    - Executes dropped EXE
    PID:5228
  - - C:\Users\Admin\AppData\Local\Temp\onefile_5228_133633584984462838\stub.exe
      "C:\Users\Admin\AppData\Local\Temp\1000070001\monster.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5572
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:6032
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        5⤵
        
        PID:3224
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        6⤵
        
        PID:220
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        5⤵
        
        PID:3632
      - C:\Windows\system32\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:5176
- - C:\Users\Admin\AppData\Local\Temp\1000075001\legs.exe
    "C:\Users\Admin\AppData\Local\Temp\1000075001\legs.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:5484
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:5616
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5484 -s 268
      4⤵
      Program crash
      PID:5996
- - C:\Users\Admin\AppData\Local\Temp\1000082001\quickaccesspopup.exe
    "C:\Users\Admin\AppData\Local\Temp\1000082001\quickaccesspopup.exe"
    3⤵
    - Executes dropped EXE
    PID:5988
  - - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
      C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
      4⤵
      PID:5244

C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3636 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
1⤵
PID:1372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5484 -ip 5484
1⤵
PID:5744

C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
1⤵
PID:2820

C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
1⤵
PID:3716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 512 -ip 512
1⤵
PID:4776

C:\Users\Admin\AppData\Local\Temp\7zS2AB0.tmp\Install.exe
C:\Users\Admin\AppData\Local\Temp\7zS2AB0.tmp\Install.exe oU /QkFdidlD 385119 /S
1⤵
PID:5884

C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
1⤵
PID:3572

C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
1⤵
PID:1556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

System Information Discovery

T1082

Virtualization/Sandbox Evasion