ee2f543ac0c6dfe4c050bc8c4c746ee2e249de699064a7079bf0f8bf209a6eda

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	RegAsm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	RuntimeBroker.exe

System Binary Proxy Execution: Regsvcs/Regasm 1 TTPs 2 IoCs

Abuse Regasm to proxy execution of malicious code.

defense_evasion

Regsvcs/Regasm

T1218.009

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\RegAsm.exe	downloader.exe
Key opened	\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\RegAsm.exe	cmd.exe

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	RegAsm.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	RegAsm.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.lnk	RegAsm.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.lnk	RegAsm.exe

Executes dropped EXE 64 IoCs

pid	Process
2208	main.exe
4648	RegAsm.exe
4656	main.exe
3540	main.exe
228	main.exe
4288	main.exe
3672	main.exe
1572	main.exe
4768	main.exe
228	main.exe
4384	main.exe
4548	main.exe
664	main.exe
4772	main.exe
596	main.exe
228	main.exe
1444	main.exe
1168	main.exe
3256	main.exe
4628	main.exe
4216	main.exe
2324	RuntimeBroker.exe
3760	main.exe
228	main.exe
4860	main.exe
1016	main.exe
3068	main.exe
2708	main.exe
3660	main.exe
456	main.exe
2088	main.exe
4720	main.exe
4536	main.exe
1508	main.exe
4764	main.exe
2376	main.exe
4032	main.exe
3056	main.exe
1048	main.exe
4408	main.exe
3336	main.exe
2952	main.exe
4288	main.exe
3156	main.exe
4488	main.exe
4140	main.exe
4072	main.exe
468	main.exe
3132	main.exe
1088	RuntimeBroker.exe
440	main.exe
2752	main.exe
3260	main.exe
2540	main.exe
3220	main.exe
4760	main.exe
4472	main.exe
384	main.exe
3508	main.exe
3764	main.exe
640	main.exe
2724	main.exe
1208	main.exe
1956	main.exe

Loads dropped DLL 64 IoCs

pid	Process
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4648	RegAsm.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
4656	main.exe
228	main.exe
228	main.exe
228	main.exe
228	main.exe
228	main.exe

Obfuscated with Agile.Net obfuscator 2 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral2/files/0x000700000002351b-79.dat	agile_net
behavioral2/memory/4648-127-0x0000000000E70000-0x000000000157A000-memory.dmp	agile_net

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Themida packer 4 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x0007000000023598-141.dat	themida
behavioral2/memory/4648-285-0x00007FF8F4560000-0x00007FF8F50E4000-memory.dmp	themida
behavioral2/memory/4648-162-0x00007FF8F4560000-0x00007FF8F50E4000-memory.dmp	themida
behavioral2/memory/4648-515-0x00007FF8F4560000-0x00007FF8F50E4000-memory.dmp	themida

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000700000002356a-122.dat	upx
behavioral2/memory/4656-126-0x00007FF8F7F90000-0x00007FF8F83F6000-memory.dmp	upx
behavioral2/files/0x0007000000023561-138.dat	upx
behavioral2/memory/4656-143-0x00007FF90EA40000-0x00007FF90EA4F000-memory.dmp	upx
behavioral2/memory/4656-142-0x00007FF90EA50000-0x00007FF90EA74000-memory.dmp	upx
behavioral2/files/0x000700000002354a-135.dat	upx
behavioral2/files/0x0007000000023568-148.dat	upx
behavioral2/files/0x000700000002356d-152.dat	upx
behavioral2/files/0x000700000002356b-161.dat	upx
behavioral2/memory/4656-170-0x00007FF90A760000-0x00007FF90A778000-memory.dmp	upx
behavioral2/files/0x0007000000023570-172.dat	upx
behavioral2/memory/4656-173-0x00007FF9097F0000-0x00007FF90981B000-memory.dmp	upx
behavioral2/files/0x000700000002354b-176.dat	upx
behavioral2/files/0x0007000000023567-180.dat	upx
behavioral2/files/0x0007000000023562-185.dat	upx
behavioral2/files/0x0007000000023560-188.dat	upx
behavioral2/memory/4656-192-0x00007FF8F43E0000-0x00007FF8F4498000-memory.dmp	upx
behavioral2/files/0x000700000002354c-196.dat	upx
behavioral2/files/0x000700000002356f-202.dat	upx
behavioral2/files/0x000700000002356e-206.dat	upx
behavioral2/files/0x0007000000023520-207.dat	upx
behavioral2/files/0x0007000000023552-204.dat	upx
behavioral2/files/0x000700000002355d-200.dat	upx
behavioral2/files/0x000700000002355c-198.dat	upx
behavioral2/memory/4656-238-0x00007FF8F3AE0000-0x00007FF8F3AF7000-memory.dmp	upx
behavioral2/memory/4656-252-0x00007FF8F3750000-0x00007FF8F39A2000-memory.dmp	upx
behavioral2/memory/4656-251-0x00007FF8F3A00000-0x00007FF8F3A29000-memory.dmp	upx
behavioral2/memory/4656-250-0x00007FF8F3A30000-0x00007FF8F3A4E000-memory.dmp	upx
behavioral2/memory/4656-249-0x00007FF8F3A50000-0x00007FF8F3A61000-memory.dmp	upx
behavioral2/memory/4656-248-0x00007FF8F3A70000-0x00007FF8F3ABD000-memory.dmp	upx
behavioral2/memory/4656-247-0x00007FF8F3AC0000-0x00007FF8F3AD9000-memory.dmp	upx
behavioral2/memory/4656-237-0x00007FF8F3B00000-0x00007FF8F3B22000-memory.dmp	upx
behavioral2/memory/4656-236-0x00007FF8F3B30000-0x00007FF8F3B44000-memory.dmp	upx
behavioral2/memory/4656-235-0x00007FF8F3B50000-0x00007FF8F3B60000-memory.dmp	upx
behavioral2/memory/4656-234-0x00007FF8F3B60000-0x00007FF8F3B74000-memory.dmp	upx
behavioral2/memory/4656-233-0x00007FF8F3B80000-0x00007FF8F3B8C000-memory.dmp	upx
behavioral2/memory/4656-232-0x00007FF8F3B90000-0x00007FF8F3BA2000-memory.dmp	upx
behavioral2/memory/4656-231-0x00007FF8F3BB0000-0x00007FF8F3BBD000-memory.dmp	upx
behavioral2/memory/4656-230-0x00007FF8F3BC0000-0x00007FF8F3BCC000-memory.dmp	upx
behavioral2/memory/4656-229-0x00007FF8F3E70000-0x00007FF8F3E7C000-memory.dmp	upx
behavioral2/memory/4656-228-0x00007FF8F3E80000-0x00007FF8F3E8B000-memory.dmp	upx
behavioral2/memory/4656-227-0x00007FF8F3E90000-0x00007FF8F3E9B000-memory.dmp	upx
behavioral2/memory/4656-226-0x00007FF8F3EA0000-0x00007FF8F3EAC000-memory.dmp	upx
behavioral2/memory/4656-225-0x00007FF8F3EB0000-0x00007FF8F3EBC000-memory.dmp	upx
behavioral2/memory/4656-224-0x00007FF8F3EC0000-0x00007FF8F3ECE000-memory.dmp	upx
behavioral2/memory/4656-223-0x00007FF8F3ED0000-0x00007FF8F3EDD000-memory.dmp	upx
behavioral2/memory/4656-222-0x00007FF8F3EE0000-0x00007FF8F3EEC000-memory.dmp	upx
behavioral2/memory/4656-221-0x00007FF8FB2D0000-0x00007FF8FB2DB000-memory.dmp	upx
behavioral2/memory/4656-220-0x00007FF900550000-0x00007FF90055C000-memory.dmp	upx
behavioral2/memory/4656-219-0x00007FF904820000-0x00007FF90482B000-memory.dmp	upx
behavioral2/memory/4656-218-0x00007FF905330000-0x00007FF90533C000-memory.dmp	upx
behavioral2/memory/4656-217-0x00007FF907430000-0x00007FF90743B000-memory.dmp	upx
behavioral2/memory/4656-216-0x00007FF909440000-0x00007FF90944B000-memory.dmp	upx
behavioral2/memory/4656-215-0x00007FF8F3BD0000-0x00007FF8F3D4A000-memory.dmp	upx
behavioral2/memory/4656-214-0x00007FF8F3EF0000-0x00007FF8F3F0F000-memory.dmp	upx
behavioral2/memory/4656-213-0x00007FF8F3F10000-0x00007FF8F4028000-memory.dmp	upx
behavioral2/memory/4656-212-0x00007FF8F4030000-0x00007FF8F4056000-memory.dmp	upx
behavioral2/memory/4656-211-0x00007FF909B30000-0x00007FF909B3B000-memory.dmp	upx
behavioral2/memory/4656-210-0x00007FF909670000-0x00007FF909685000-memory.dmp	upx
behavioral2/memory/4656-193-0x00007FF8F4060000-0x00007FF8F43D9000-memory.dmp	upx
behavioral2/memory/4656-191-0x00007FF904830000-0x00007FF90485E000-memory.dmp	upx
behavioral2/memory/4656-190-0x00007FF909690000-0x00007FF9096AC000-memory.dmp	upx
behavioral2/memory/4656-189-0x00007FF905340000-0x00007FF905383000-memory.dmp	upx
behavioral2/files/0x0007000000023553-183.dat	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "C:\\Users\\Public\\RuntimeBroker.exe"	RegAsm.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 33 IoCs

Web Service

T1102

flow	ioc
124	discord.com
20	discord.com
64	discord.com
100	discord.com
127	discord.com
145	discord.com
45	discord.com
83	discord.com
97	discord.com
109	discord.com
121	discord.com
36	discord.com
91	discord.com
67	discord.com
139	discord.com
25	discord.com
55	discord.com
136	discord.com
94	discord.com
118	discord.com
115	discord.com
142	discord.com
58	discord.com
79	discord.com
86	discord.com
130	discord.com
133	discord.com
70	discord.com
73	discord.com
61	discord.com
112	discord.com
21	discord.com
33	discord.com

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
4648	RegAsm.exe
2324	RuntimeBroker.exe
1088	RuntimeBroker.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x000600000001da3a-3.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2236	schtasks.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeDebugPrivilege	4656	main.exe
Token: SeDebugPrivilege	4648	RegAsm.exe
Token: SeDebugPrivilege	228	main.exe
Token: SeDebugPrivilege	2944	taskmgr.exe
Token: SeSystemProfilePrivilege	2944	taskmgr.exe
Token: SeCreateGlobalPrivilege	2944	taskmgr.exe
Token: SeDebugPrivilege	3672	main.exe
Token: SeDebugPrivilege	4768	main.exe
Token: SeDebugPrivilege	4384	main.exe
Token: SeDebugPrivilege	664	main.exe
Token: 33	2944	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2944	taskmgr.exe
Token: SeDebugPrivilege	596	main.exe
Token: SeDebugPrivilege	1444	main.exe
Token: SeDebugPrivilege	3256	main.exe
Token: SeDebugPrivilege	4216	main.exe
Token: SeDebugPrivilege	2324	RuntimeBroker.exe
Token: SeDebugPrivilege	228	main.exe
Token: SeDebugPrivilege	1016	main.exe
Token: SeDebugPrivilege	2708	main.exe
Token: SeDebugPrivilege	456	main.exe
Token: SeDebugPrivilege	4720	main.exe
Token: SeDebugPrivilege	1508	main.exe
Token: SeDebugPrivilege	2376	main.exe
Token: SeDebugPrivilege	3056	main.exe
Token: SeDebugPrivilege	4408	main.exe
Token: SeDebugPrivilege	2952	main.exe
Token: SeDebugPrivilege	3156	main.exe
Token: SeDebugPrivilege	4140	main.exe
Token: SeDebugPrivilege	468	main.exe
Token: SeDebugPrivilege	440	main.exe
Token: SeDebugPrivilege	1088	RuntimeBroker.exe
Token: SeDebugPrivilege	3260	main.exe
Token: SeDebugPrivilege	3220	main.exe
Token: SeDebugPrivilege	4472	main.exe
Token: SeDebugPrivilege	3508	main.exe
Token: SeDebugPrivilege	640	main.exe
Token: SeDebugPrivilege	1208	main.exe
Token: SeDebugPrivilege	3844	main.exe
Token: SeDebugPrivilege	4488	main.exe
Token: SeDebugPrivilege	1376	main.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe

Suspicious use of SendNotifyMessage 49 IoCs

pid	Process
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe
2944	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 4872	3628	downloader.exe	87
PID 3628 wrote to memory of 4872	3628	downloader.exe	87
PID 4872 wrote to memory of 2208	4872	cmd.exe	88
PID 4872 wrote to memory of 2208	4872	cmd.exe	88
PID 3628 wrote to memory of 3588	3628	downloader.exe	89
PID 3628 wrote to memory of 3588	3628	downloader.exe	89
PID 3588 wrote to memory of 4648	3588	cmd.exe	90
PID 3588 wrote to memory of 4648	3588	cmd.exe	90
PID 2208 wrote to memory of 4656	2208	main.exe	91
PID 2208 wrote to memory of 4656	2208	main.exe	91
PID 4656 wrote to memory of 3056	4656	main.exe	92
PID 4656 wrote to memory of 3056	4656	main.exe	92
PID 4648 wrote to memory of 2236	4648	RegAsm.exe	94
PID 4648 wrote to memory of 2236	4648	RegAsm.exe	94
PID 3628 wrote to memory of 3584	3628	downloader.exe	96
PID 3628 wrote to memory of 3584	3628	downloader.exe	96
PID 3584 wrote to memory of 3540	3584	cmd.exe	97
PID 3584 wrote to memory of 3540	3584	cmd.exe	97
PID 3540 wrote to memory of 228	3540	main.exe	98
PID 3540 wrote to memory of 228	3540	main.exe	98
PID 228 wrote to memory of 4616	228	main.exe	99
PID 228 wrote to memory of 4616	228	main.exe	99
PID 3628 wrote to memory of 816	3628	downloader.exe	103
PID 3628 wrote to memory of 816	3628	downloader.exe	103
PID 816 wrote to memory of 4288	816	cmd.exe	104
PID 816 wrote to memory of 4288	816	cmd.exe	104
PID 4288 wrote to memory of 3672	4288	main.exe	105
PID 4288 wrote to memory of 3672	4288	main.exe	105
PID 3672 wrote to memory of 2092	3672	main.exe	107
PID 3672 wrote to memory of 2092	3672	main.exe	107
PID 3628 wrote to memory of 1432	3628	downloader.exe	109
PID 3628 wrote to memory of 1432	3628	downloader.exe	109
PID 1432 wrote to memory of 1572	1432	cmd.exe	110
PID 1432 wrote to memory of 1572	1432	cmd.exe	110
PID 1572 wrote to memory of 4768	1572	main.exe	111
PID 1572 wrote to memory of 4768	1572	main.exe	111
PID 4768 wrote to memory of 3792	4768	main.exe	112
PID 4768 wrote to memory of 3792	4768	main.exe	112
PID 3628 wrote to memory of 4124	3628	downloader.exe	114
PID 3628 wrote to memory of 4124	3628	downloader.exe	114
PID 4124 wrote to memory of 228	4124	cmd.exe	115
PID 4124 wrote to memory of 228	4124	cmd.exe	115
PID 228 wrote to memory of 4384	228	main.exe	117
PID 228 wrote to memory of 4384	228	main.exe	117
PID 4384 wrote to memory of 2512	4384	main.exe	118
PID 4384 wrote to memory of 2512	4384	main.exe	118
PID 3628 wrote to memory of 3840	3628	downloader.exe	121
PID 3628 wrote to memory of 3840	3628	downloader.exe	121
PID 3840 wrote to memory of 4548	3840	cmd.exe	122
PID 3840 wrote to memory of 4548	3840	cmd.exe	122
PID 4548 wrote to memory of 664	4548	main.exe	123
PID 4548 wrote to memory of 664	4548	main.exe	123
PID 664 wrote to memory of 2312	664	main.exe	124
PID 664 wrote to memory of 2312	664	main.exe	124
PID 3628 wrote to memory of 4936	3628	downloader.exe	126
PID 3628 wrote to memory of 4936	3628	downloader.exe	126
PID 4936 wrote to memory of 4772	4936	cmd.exe	127
PID 4936 wrote to memory of 4772	4936	cmd.exe	127
PID 4772 wrote to memory of 596	4772	main.exe	128
PID 4772 wrote to memory of 596	4772	main.exe	128
PID 596 wrote to memory of 2464	596	main.exe	129
PID 596 wrote to memory of 2464	596	main.exe	129
PID 3628 wrote to memory of 4216	3628	downloader.exe	131
PID 3628 wrote to memory of 4216	3628	downloader.exe	131

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\downloader.exe
"C:\Users\Admin\AppData\Local\Temp\downloader.exe"
1⤵
- System Binary Proxy Execution: Regsvcs/Regasm
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\main.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Users\Admin\AppData\Local\Temp\main.exe
    "C:\Users\Admin\AppData\Local\Temp\main.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2208
  - - C:\Users\Admin\AppData\Local\Temp\main.exe
      "C:\Users\Admin\AppData\Local\Temp\main.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4656
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:3056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\RegAsm.exe""
  2⤵
  - System Binary Proxy Execution: Regsvcs/Regasm
  - Suspicious use of WriteProcessMemory
  PID:3588
- - C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
    "C:\Users\Admin\AppData\Local\Temp\RegAsm.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Checks computer location settings
    - Drops startup file
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4648
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "RuntimeBroker" /tr "C:\Users\Public\RuntimeBroker.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\main.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3584
- - C:\Users\Admin\AppData\Local\Temp\main.exe
    "C:\Users\Admin\AppData\Local\Temp\main.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3540
  - - C:\Users\Admin\AppData\Local\Temp\main.exe
      "C:\Users\Admin\AppData\Local\Temp\main.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:228
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:4616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\main.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:816
- - C:\Users\Admin\AppData\Local\Temp\main.exe
    "C:\Users\Admin\AppData\Local\Temp\main.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4288
  - - C:\Users\Admin\AppData\Local\Temp\main.exe
      "C:\Users\Admin\AppData\Local\Temp\main.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3672
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:2092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\main.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1432
- - C:\Users\Admin\AppData\Local\Temp\main.exe
    "C:\Users\Admin\AppData\Local\Temp\main.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1572
  - - C:\Users\Admin\AppData\Local\Temp\main.exe
      "C:\Users\Admin\AppData\Local\Temp\main.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4768
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:3792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\main.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4124
- - C:\Users\Admin\AppData\Local\Temp\main.exe
    "C:\Users\Admin\AppData\Local\Temp\main.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:228
  - - C:\Users\Admin\AppData\Local\Temp\main.exe
      "C:\Users\Admin\AppData\Local\Temp\main.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4384
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:2512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\main.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3840
- - C:\Users\Admin\AppData\Local\Temp\main.exe
    "C:\Users\Admin\AppData\Local\Temp\main.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4548
  - - C:\Users\Admin\AppData\Local\Temp\main.exe
      "C:\Users\Admin\AppData\Local\Temp\main.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:664
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:2312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\main.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4936
- - C:\Users\Admin\AppData\Local\Temp\main.exe
    "C:\Users\Admin\AppData\Local\Temp\main.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4772
  - - C:\Users\Admin\AppData\Local\Temp\main.exe
      "C:\Users\Admin\AppData\Local\Temp\main.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:596
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:2464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\main.exe""
  2⤵
  PID:4216
- - C:\Users\Admin\AppData\Local\Temp\main.exe
    "C:\Users\Admin\AppData\Local\Temp\main.exe"
    3⤵
    - Executes dropped EXE
    PID:228
  - - C:\Users\Admin\AppData\Local\Temp\main.exe
      "C:\Users\Admin\AppData\Local\Temp\main.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1444
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:1996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\main.exe""
  2⤵
  PID:2672
- - C:\Users\Admin\AppData\Local\Temp\main.exe
    "C:\Users\Admin\AppData\Local\Temp\main.exe"
    3⤵
    - Executes dropped EXE
    PID:1168
  - - C:\Users\Admin\AppData\Local\Temp\main.exe
      "C:\Users\Admin\AppData\Local\Temp\main.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3256
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:4912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\main.exe""
  2⤵
  PID:2736
- - C:\Users\Admin\AppData\Local\Temp\main.exe
    "C:\Users\Admin\AppData\Local\Temp\main.exe"
    3⤵
    - Executes dropped EXE
    PID:4628
  - - C:\Users\Admin\AppData\Local\Temp\main.exe
      "C:\Users\Admin\AppData\Local\Temp\main.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4216
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:3912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\main.exe""
  2⤵
  PID:4132
- - C:\Users\Admin\AppData\Local\Temp\main.exe
    "C:\Users\Admin\AppData\Local\Temp\main.exe"
    3⤵
    - Executes dropped EXE
    PID:3760
  - - C:\Users\Admin\AppData\Local\Temp\main.exe
      "C:\Users\Admin\AppData\Local\Temp\main.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:228
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:4776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\main.exe""
  2⤵
  PID:1972
- - C:\Users\Admin\AppData\Local\Temp\main.exe
    "C:\Users\Admin\AppData\Local\Temp\main.exe"
    3⤵
    - Executes dropped EXE
    PID:4860
  - - C:\Users\Admin\AppData\Local\Temp\main.exe
      "C:\Users\Admin\AppData\Local\Temp\main.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1016
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:3592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\main.exe""
  2⤵
  PID:2180
- - C:\Users\Admin\AppData\Local\Temp\main.exe
    "C:\Users\Admin\AppData\Local\Temp\main.exe"
    3⤵
    - Executes dropped EXE
    PID:3068
  - - C:\Users\Admin\AppData\Local\Temp\main.exe
      "C:\Users\Admin\AppData\Local\Temp\main.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2708
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:2908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\main.exe""
  2⤵
  PID:3196
- - C:\Users\Admin\AppData\Local\Temp\main.exe
    "C:\Users\Admin\AppData\Local\Temp\main.exe"
    3⤵
    - Executes dropped EXE
    PID:3660
  - - C:\Users\Admin\AppData\Local\Temp\main.exe
      "C:\Users\Admin\AppData\Local\Temp\main.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:456
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:1364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\main.exe""
  2⤵
  PID:2408
- - C:\Users\Admin\AppData\Local\Temp\main.exe
    "C:\Users\Admin\AppData\Local\Temp\main.exe"
    3⤵
    - Executes dropped EXE
    PID:2088
  - - C:\Users\Admin\AppData\Local\Temp\main.exe
      "C:\Users\Admin\AppData\Local\Temp\main.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4720
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:1564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\main.exe""
  2⤵
  PID:2376
- - C:\Users\Admin\AppData\Local\Temp\main.exe
    "C:\Users\Admin\AppData\Local\Temp\main.exe"
    3⤵
    - Executes dropped EXE
    PID:4536
  - - C:\Users\Admin\AppData\Local\Temp\main.exe
      "C:\Users\Admin\AppData\Local\Temp\main.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1508
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:3004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\main.exe""
  2⤵
  PID:4624
- - C:\Users\Admin\AppData\Local\Temp\main.exe
    "C:\Users\Admin\AppData\Local\Temp\main.exe"
    3⤵
    - Executes dropped EXE
    PID:4764
  - - C:\Users\Admin\AppData\Local\Temp\main.exe
      "C:\Users\Admin\AppData\Local\Temp\main.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2376
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:3012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\main.exe""
  2⤵
  PID:4760
- - C:\Users\Admin\AppData\Local\Temp\main.exe
    "C:\Users\Admin\AppData\Local\Temp\main.exe"
    3⤵
    - Executes dropped EXE
    PID:4032
  - - C:\Users\Admin\AppData\Local\Temp\main.exe
      "C:\Users\Admin\AppData\Local\Temp\main.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3056
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:2380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\main.exe""
  2⤵
  PID:3788
- - C:\Users\Admin\AppData\Local\Temp\main.exe
    "C:\Users\Admin\AppData\Local\Temp\main.exe"
    3⤵
    - Executes dropped EXE
    PID:1048
  - - C:\Users\Admin\AppData\Local\Temp\main.exe
      "C:\Users\Admin\AppData\Local\Temp\main.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4408
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:3716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\main.exe""
  2⤵
  PID:3560
- - C:\Users\Admin\AppData\Local\Temp\main.exe
    "C:\Users\Admin\AppData\Local\Temp\main.exe"
    3⤵
    - Executes dropped EXE
    PID:3336
  - - C:\Users\Admin\AppData\Local\Temp\main.exe
      "C:\Users\Admin\AppData\Local\Temp\main.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2952
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:2572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\main.exe""
  2⤵
  PID:4960
- - C:\Users\Admin\AppData\Local\Temp\main.exe
    "C:\Users\Admin\AppData\Local\Temp\main.exe"
    3⤵
    - Executes dropped EXE
    PID:4288
  - - C:\Users\Admin\AppData\Local\Temp\main.exe
      "C:\Users\Admin\AppData\Local\Temp\main.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3156
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:2612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\main.exe""
  2⤵
  PID:3844
- - C:\Users\Admin\AppData\Local\Temp\main.exe
    "C:\Users\Admin\AppData\Local\Temp\main.exe"
    3⤵
    - Executes dropped EXE
    PID:4488
  - - C:\Users\Admin\AppData\Local\Temp\main.exe
      "C:\Users\Admin\AppData\Local\Temp\main.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4140
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:4064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\main.exe""
  2⤵
  PID:3560
- - C:\Users\Admin\AppData\Local\Temp\main.exe
    "C:\Users\Admin\AppData\Local\Temp\main.exe"
    3⤵
    - Executes dropped EXE
    PID:4072
  - - C:\Users\Admin\AppData\Local\Temp\main.exe
      "C:\Users\Admin\AppData\Local\Temp\main.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:468
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:2104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\main.exe""
  2⤵
  PID:980
- - C:\Users\Admin\AppData\Local\Temp\main.exe
    "C:\Users\Admin\AppData\Local\Temp\main.exe"
    3⤵
    - Executes dropped EXE
    PID:3132
  - - C:\Users\Admin\AppData\Local\Temp\main.exe
      "C:\Users\Admin\AppData\Local\Temp\main.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:440
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:3568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\main.exe""
  2⤵
  PID:4296
- - C:\Users\Admin\AppData\Local\Temp\main.exe
    "C:\Users\Admin\AppData\Local\Temp\main.exe"
    3⤵
    - Executes dropped EXE
    PID:2752
  - - C:\Users\Admin\AppData\Local\Temp\main.exe
      "C:\Users\Admin\AppData\Local\Temp\main.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3260
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:4960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\main.exe""
  2⤵
  PID:4836
- - C:\Users\Admin\AppData\Local\Temp\main.exe
    "C:\Users\Admin\AppData\Local\Temp\main.exe"
    3⤵
    - Executes dropped EXE
    PID:2540
  - - C:\Users\Admin\AppData\Local\Temp\main.exe
      "C:\Users\Admin\AppData\Local\Temp\main.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3220
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:2212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\main.exe""
  2⤵
  PID:1416
- - C:\Users\Admin\AppData\Local\Temp\main.exe
    "C:\Users\Admin\AppData\Local\Temp\main.exe"
    3⤵
    - Executes dropped EXE
    PID:4760
  - - C:\Users\Admin\AppData\Local\Temp\main.exe
      "C:\Users\Admin\AppData\Local\Temp\main.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4472
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:4600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\main.exe""
  2⤵
  PID:4772
- - C:\Users\Admin\AppData\Local\Temp\main.exe
    "C:\Users\Admin\AppData\Local\Temp\main.exe"
    3⤵
    - Executes dropped EXE
    PID:384
  - - C:\Users\Admin\AppData\Local\Temp\main.exe
      "C:\Users\Admin\AppData\Local\Temp\main.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3508
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:3948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\main.exe""
  2⤵
  PID:3212
- - C:\Users\Admin\AppData\Local\Temp\main.exe
    "C:\Users\Admin\AppData\Local\Temp\main.exe"
    3⤵
    - Executes dropped EXE
    PID:3764
  - - C:\Users\Admin\AppData\Local\Temp\main.exe
      "C:\Users\Admin\AppData\Local\Temp\main.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:640
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:1668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\main.exe""
  2⤵
  PID:904
- - C:\Users\Admin\AppData\Local\Temp\main.exe
    "C:\Users\Admin\AppData\Local\Temp\main.exe"
    3⤵
    - Executes dropped EXE
    PID:2724
  - - C:\Users\Admin\AppData\Local\Temp\main.exe
      "C:\Users\Admin\AppData\Local\Temp\main.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1208
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:4776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\main.exe""
  2⤵
  PID:2948
- - C:\Users\Admin\AppData\Local\Temp\main.exe
    "C:\Users\Admin\AppData\Local\Temp\main.exe"
    3⤵
    - Executes dropped EXE
    PID:1956
  - - C:\Users\Admin\AppData\Local\Temp\main.exe
      "C:\Users\Admin\AppData\Local\Temp\main.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3844
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:2212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\main.exe""
  2⤵
  PID:2844
- - C:\Users\Admin\AppData\Local\Temp\main.exe
    "C:\Users\Admin\AppData\Local\Temp\main.exe"
    3⤵
    PID:4012
  - - C:\Users\Admin\AppData\Local\Temp\main.exe
      "C:\Users\Admin\AppData\Local\Temp\main.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4488
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:4428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\main.exe""
  2⤵
  PID:2316
- - C:\Users\Admin\AppData\Local\Temp\main.exe
    "C:\Users\Admin\AppData\Local\Temp\main.exe"
    3⤵
    PID:2208
  - - C:\Users\Admin\AppData\Local\Temp\main.exe
      "C:\Users\Admin\AppData\Local\Temp\main.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1376
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:2152

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2944

C:\Users\Public\RuntimeBroker.exe
C:\Users\Public\RuntimeBroker.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:2324

C:\Users\Public\RuntimeBroker.exe
C:\Users\Public\RuntimeBroker.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:1088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Regsvcs/Regasm

T1218.009

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery