amadey | 3f057d41729ede50420ed52323bf31988be3d8621186c9f3aa769addb2f89fdd

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	3f057d41729ede50420ed52323bf31988be3d8621186c9f3aa769addb2f89fdd_NeikiAnalytics.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	da_protected.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	da_protected.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	da_protected.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3f057d41729ede50420ed52323bf31988be3d8621186c9f3aa769addb2f89fdd_NeikiAnalytics.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3f057d41729ede50420ed52323bf31988be3d8621186c9f3aa769addb2f89fdd_NeikiAnalytics.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe

Executes dropped EXE 14 IoCs

pid	Process
2532	axplong.exe
2308	ama.exe
2336	deep.exe
776	da_protected.exe
1448	gold.exe
1048	lummac2.exe
488	NewLatest.exe
412	Hkbsse.exe
2652	1.exe
2376	legs.exe
2636	taskweaker.exe
2620	judit.exe
1552	stub.exe
1880	googleads.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Wine	3f057d41729ede50420ed52323bf31988be3d8621186c9f3aa769addb2f89fdd_NeikiAnalytics.exe
Key opened	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Wine	axplong.exe

Loads dropped DLL 27 IoCs

pid	Process
2084	3f057d41729ede50420ed52323bf31988be3d8621186c9f3aa769addb2f89fdd_NeikiAnalytics.exe
2532	axplong.exe
2532	axplong.exe
2336	deep.exe
2336	deep.exe
2336	deep.exe
2336	deep.exe
2532	axplong.exe
3004	WerFault.exe
3004	WerFault.exe
3004	WerFault.exe
2532	axplong.exe
2532	axplong.exe
2532	axplong.exe
488	NewLatest.exe
412	Hkbsse.exe
412	Hkbsse.exe
2532	axplong.exe
1432	WerFault.exe
1432	WerFault.exe
1432	WerFault.exe
2532	axplong.exe
2532	axplong.exe
2532	axplong.exe
2620	judit.exe
1552	stub.exe
2532	axplong.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x0007000000016575-54.dat	themida
behavioral1/memory/776-265-0x0000000000920000-0x0000000001278000-memory.dmp	themida
behavioral1/memory/776-266-0x0000000000920000-0x0000000001278000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	da_protected.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
2084	3f057d41729ede50420ed52323bf31988be3d8621186c9f3aa769addb2f89fdd_NeikiAnalytics.exe
2532	axplong.exe
776	da_protected.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\axplong.job	3f057d41729ede50420ed52323bf31988be3d8621186c9f3aa769addb2f89fdd_NeikiAnalytics.exe
File created	C:\Windows\Tasks\Hkbsse.job	NewLatest.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3004	1448	WerFault.exe	33
1432	2376	WerFault.exe	41

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	axplong.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	axplong.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	axplong.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2084	3f057d41729ede50420ed52323bf31988be3d8621186c9f3aa769addb2f89fdd_NeikiAnalytics.exe
2532	axplong.exe
2308	ama.exe
2652	1.exe
2652	1.exe
2308	ama.exe
2308	ama.exe
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2652	1.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	2308	ama.exe
Token: SeDebugPrivilege	776	da_protected.exe
Token: SeShutdownPrivilege	1120	Process not Found
Token: SeShutdownPrivilege	1120	Process not Found
Token: SeDebugPrivilege	1880	googleads.exe
Token: SeShutdownPrivilege	1120	Process not Found
Token: SeShutdownPrivilege	1120	Process not Found
Token: SeBackupPrivilege	1880	googleads.exe
Token: SeSecurityPrivilege	1880	googleads.exe
Token: SeSecurityPrivilege	1880	googleads.exe
Token: SeSecurityPrivilege	1880	googleads.exe
Token: SeSecurityPrivilege	1880	googleads.exe
Token: SeShutdownPrivilege	1120	Process not Found

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2084	3f057d41729ede50420ed52323bf31988be3d8621186c9f3aa769addb2f89fdd_NeikiAnalytics.exe
488	NewLatest.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2532	2084	3f057d41729ede50420ed52323bf31988be3d8621186c9f3aa769addb2f89fdd_NeikiAnalytics.exe	28
PID 2084 wrote to memory of 2532	2084	3f057d41729ede50420ed52323bf31988be3d8621186c9f3aa769addb2f89fdd_NeikiAnalytics.exe	28
PID 2084 wrote to memory of 2532	2084	3f057d41729ede50420ed52323bf31988be3d8621186c9f3aa769addb2f89fdd_NeikiAnalytics.exe	28
PID 2084 wrote to memory of 2532	2084	3f057d41729ede50420ed52323bf31988be3d8621186c9f3aa769addb2f89fdd_NeikiAnalytics.exe	28
PID 2532 wrote to memory of 2308	2532	axplong.exe	29
PID 2532 wrote to memory of 2308	2532	axplong.exe	29
PID 2532 wrote to memory of 2308	2532	axplong.exe	29
PID 2532 wrote to memory of 2308	2532	axplong.exe	29
PID 2532 wrote to memory of 2336	2532	axplong.exe	31
PID 2532 wrote to memory of 2336	2532	axplong.exe	31
PID 2532 wrote to memory of 2336	2532	axplong.exe	31
PID 2532 wrote to memory of 2336	2532	axplong.exe	31
PID 2336 wrote to memory of 776	2336	deep.exe	32
PID 2336 wrote to memory of 776	2336	deep.exe	32
PID 2336 wrote to memory of 776	2336	deep.exe	32
PID 2336 wrote to memory of 776	2336	deep.exe	32
PID 2532 wrote to memory of 1448	2532	axplong.exe	33
PID 2532 wrote to memory of 1448	2532	axplong.exe	33
PID 2532 wrote to memory of 1448	2532	axplong.exe	33
PID 2532 wrote to memory of 1448	2532	axplong.exe	33
PID 1448 wrote to memory of 3004	1448	gold.exe	34
PID 1448 wrote to memory of 3004	1448	gold.exe	34
PID 1448 wrote to memory of 3004	1448	gold.exe	34
PID 1448 wrote to memory of 3004	1448	gold.exe	34
PID 2532 wrote to memory of 1048	2532	axplong.exe	35
PID 2532 wrote to memory of 1048	2532	axplong.exe	35
PID 2532 wrote to memory of 1048	2532	axplong.exe	35
PID 2532 wrote to memory of 1048	2532	axplong.exe	35
PID 2532 wrote to memory of 488	2532	axplong.exe	36
PID 2532 wrote to memory of 488	2532	axplong.exe	36
PID 2532 wrote to memory of 488	2532	axplong.exe	36
PID 2532 wrote to memory of 488	2532	axplong.exe	36
PID 488 wrote to memory of 412	488	NewLatest.exe	38
PID 488 wrote to memory of 412	488	NewLatest.exe	38
PID 488 wrote to memory of 412	488	NewLatest.exe	38
PID 488 wrote to memory of 412	488	NewLatest.exe	38
PID 412 wrote to memory of 2652	412	Hkbsse.exe	39
PID 412 wrote to memory of 2652	412	Hkbsse.exe	39
PID 412 wrote to memory of 2652	412	Hkbsse.exe	39
PID 412 wrote to memory of 2652	412	Hkbsse.exe	39
PID 2532 wrote to memory of 2376	2532	axplong.exe	41
PID 2532 wrote to memory of 2376	2532	axplong.exe	41
PID 2532 wrote to memory of 2376	2532	axplong.exe	41
PID 2532 wrote to memory of 2376	2532	axplong.exe	41
PID 2376 wrote to memory of 1432	2376	legs.exe	42
PID 2376 wrote to memory of 1432	2376	legs.exe	42
PID 2376 wrote to memory of 1432	2376	legs.exe	42
PID 2376 wrote to memory of 1432	2376	legs.exe	42
PID 2532 wrote to memory of 2636	2532	axplong.exe	43
PID 2532 wrote to memory of 2636	2532	axplong.exe	43
PID 2532 wrote to memory of 2636	2532	axplong.exe	43
PID 2532 wrote to memory of 2636	2532	axplong.exe	43
PID 2532 wrote to memory of 2620	2532	axplong.exe	44
PID 2532 wrote to memory of 2620	2532	axplong.exe	44
PID 2532 wrote to memory of 2620	2532	axplong.exe	44
PID 2532 wrote to memory of 2620	2532	axplong.exe	44
PID 2620 wrote to memory of 1552	2620	judit.exe	45
PID 2620 wrote to memory of 1552	2620	judit.exe	45
PID 2620 wrote to memory of 1552	2620	judit.exe	45
PID 2532 wrote to memory of 1880	2532	axplong.exe	46
PID 2532 wrote to memory of 1880	2532	axplong.exe	46
PID 2532 wrote to memory of 1880	2532	axplong.exe	46
PID 2532 wrote to memory of 1880	2532	axplong.exe	46

C:\Users\Admin\AppData\Local\Temp\3f057d41729ede50420ed52323bf31988be3d8621186c9f3aa769addb2f89fdd_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3f057d41729ede50420ed52323bf31988be3d8621186c9f3aa769addb2f89fdd_NeikiAnalytics.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
  "C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Users\Admin\AppData\Local\Temp\1000007001\ama.exe
    "C:\Users\Admin\AppData\Local\Temp\1000007001\ama.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2308
- - C:\Users\Admin\AppData\Local\Temp\1000025001\deep.exe
    "C:\Users\Admin\AppData\Local\Temp\1000025001\deep.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2336
  - - C:\Users\Admin\AppData\Local\Temp\da_protected.exe
      "C:\Users\Admin\AppData\Local\Temp\da_protected.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of AdjustPrivilegeToken
      PID:776
- - C:\Users\Admin\AppData\Local\Temp\1000035001\gold.exe
    "C:\Users\Admin\AppData\Local\Temp\1000035001\gold.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1448
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 84
      4⤵
      Loads dropped DLL
      Program crash
      PID:3004
- - C:\Users\Admin\AppData\Local\Temp\1000047001\lummac2.exe
    "C:\Users\Admin\AppData\Local\Temp\1000047001\lummac2.exe"
    3⤵
    - Executes dropped EXE
    PID:1048
- - C:\Users\Admin\AppData\Local\Temp\1000064001\NewLatest.exe
    "C:\Users\Admin\AppData\Local\Temp\1000064001\NewLatest.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:488
  - - C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
      "C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:412
    - - C:\Users\Admin\AppData\Local\Temp\1000013001\1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000013001\1.exe"
        5⤵
        Executes dropped EXE
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:2652
- - C:\Users\Admin\AppData\Local\Temp\1000092001\legs.exe
    "C:\Users\Admin\AppData\Local\Temp\1000092001\legs.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2376
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 64
      4⤵
      Loads dropped DLL
      Program crash
      PID:1432
- - C:\Users\Admin\AppData\Local\Temp\1000094001\taskweaker.exe
    "C:\Users\Admin\AppData\Local\Temp\1000094001\taskweaker.exe"
    3⤵
    - Executes dropped EXE
    PID:2636
- - C:\Users\Admin\AppData\Local\Temp\1000095001\judit.exe
    "C:\Users\Admin\AppData\Local\Temp\1000095001\judit.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2620
  - - C:\Users\Admin\AppData\Local\Temp\onefile_2620_133635933566470000\stub.exe
      "C:\Users\Admin\AppData\Local\Temp\1000095001\judit.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1552
- - C:\Users\Admin\AppData\Local\Temp\1000096001\googleads.exe
    "C:\Users\Admin\AppData\Local\Temp\1000096001\googleads.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion