amadey | 9b3d425b8de19aa8d89f3f92dc0462463d35e248eb6a97736731484135f0afb9

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	9b3d425b8de19aa8d89f3f92dc0462463d35e248eb6a97736731484135f0afb9.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	9b3d425b8de19aa8d89f3f92dc0462463d35e248eb6a97736731484135f0afb9.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	9b3d425b8de19aa8d89f3f92dc0462463d35e248eb6a97736731484135f0afb9.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	9b3d425b8de19aa8d89f3f92dc0462463d35e248eb6a97736731484135f0afb9.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	9b3d425b8de19aa8d89f3f92dc0462463d35e248eb6a97736731484135f0afb9.exe

Checks BIOS information in registry 2 TTPs 24 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	9b3d425b8de19aa8d89f3f92dc0462463d35e248eb6a97736731484135f0afb9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	9b3d425b8de19aa8d89f3f92dc0462463d35e248eb6a97736731484135f0afb9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	9b3d425b8de19aa8d89f3f92dc0462463d35e248eb6a97736731484135f0afb9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	9b3d425b8de19aa8d89f3f92dc0462463d35e248eb6a97736731484135f0afb9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	9b3d425b8de19aa8d89f3f92dc0462463d35e248eb6a97736731484135f0afb9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	9b3d425b8de19aa8d89f3f92dc0462463d35e248eb6a97736731484135f0afb9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	9b3d425b8de19aa8d89f3f92dc0462463d35e248eb6a97736731484135f0afb9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	9b3d425b8de19aa8d89f3f92dc0462463d35e248eb6a97736731484135f0afb9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	9b3d425b8de19aa8d89f3f92dc0462463d35e248eb6a97736731484135f0afb9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	9b3d425b8de19aa8d89f3f92dc0462463d35e248eb6a97736731484135f0afb9.exe

Executes dropped EXE 11 IoCs

pid	Process
3428	axplong.exe
2436	axplong.exe
3828	axplong.exe
1876	axplong.exe
1924	axplong.exe
424	axplong.exe
2856	9b3d425b8de19aa8d89f3f92dc0462463d35e248eb6a97736731484135f0afb9.exe
4448	9b3d425b8de19aa8d89f3f92dc0462463d35e248eb6a97736731484135f0afb9.exe
2844	axplong.exe
5176	9b3d425b8de19aa8d89f3f92dc0462463d35e248eb6a97736731484135f0afb9.exe
5504	9b3d425b8de19aa8d89f3f92dc0462463d35e248eb6a97736731484135f0afb9.exe

Identifies Wine through registry keys 2 TTPs 12 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Wine	9b3d425b8de19aa8d89f3f92dc0462463d35e248eb6a97736731484135f0afb9.exe
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Wine	9b3d425b8de19aa8d89f3f92dc0462463d35e248eb6a97736731484135f0afb9.exe
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Wine	9b3d425b8de19aa8d89f3f92dc0462463d35e248eb6a97736731484135f0afb9.exe
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Wine	9b3d425b8de19aa8d89f3f92dc0462463d35e248eb6a97736731484135f0afb9.exe
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Wine	9b3d425b8de19aa8d89f3f92dc0462463d35e248eb6a97736731484135f0afb9.exe
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Wine	axplong.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs

pid	Process
2076	9b3d425b8de19aa8d89f3f92dc0462463d35e248eb6a97736731484135f0afb9.exe
3428	axplong.exe
2436	axplong.exe
3828	axplong.exe
1876	axplong.exe
1924	axplong.exe
424	axplong.exe
2856	9b3d425b8de19aa8d89f3f92dc0462463d35e248eb6a97736731484135f0afb9.exe
4448	9b3d425b8de19aa8d89f3f92dc0462463d35e248eb6a97736731484135f0afb9.exe
2844	axplong.exe
5176	9b3d425b8de19aa8d89f3f92dc0462463d35e248eb6a97736731484135f0afb9.exe
5504	9b3d425b8de19aa8d89f3f92dc0462463d35e248eb6a97736731484135f0afb9.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\axplong.job	9b3d425b8de19aa8d89f3f92dc0462463d35e248eb6a97736731484135f0afb9.exe
File created	C:\Windows\rescache\_merged\4183903823\2290032291.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\2717123927\1590785016.pri	taskmgr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9b3d425b8de19aa8d89f3f92dc0462463d35e248eb6a97736731484135f0afb9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axplong.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9b3d425b8de19aa8d89f3f92dc0462463d35e248eb6a97736731484135f0afb9.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\240919-2kyt6svenl_pw_infected.zip:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2076	9b3d425b8de19aa8d89f3f92dc0462463d35e248eb6a97736731484135f0afb9.exe
2076	9b3d425b8de19aa8d89f3f92dc0462463d35e248eb6a97736731484135f0afb9.exe
3428	axplong.exe
3428	axplong.exe
2436	axplong.exe
2436	axplong.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2448	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	2448	taskmgr.exe
Token: SeSystemProfilePrivilege	2448	taskmgr.exe
Token: SeCreateGlobalPrivilege	2448	taskmgr.exe
Token: SeDebugPrivilege	3740	firefox.exe
Token: SeDebugPrivilege	3740	firefox.exe
Token: SeDebugPrivilege	3740	firefox.exe
Token: SeDebugPrivilege	3740	firefox.exe
Token: SeDebugPrivilege	3740	firefox.exe
Token: SeDebugPrivilege	3740	firefox.exe
Token: SeRestorePrivilege	4488	7zG.exe
Token: 35	4488	7zG.exe
Token: SeSecurityPrivilege	4488	7zG.exe
Token: SeSecurityPrivilege	4488	7zG.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3740	firefox.exe
3740	firefox.exe
3740	firefox.exe
3740	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 3428	2076	9b3d425b8de19aa8d89f3f92dc0462463d35e248eb6a97736731484135f0afb9.exe	73
PID 2076 wrote to memory of 3428	2076	9b3d425b8de19aa8d89f3f92dc0462463d35e248eb6a97736731484135f0afb9.exe	73
PID 2076 wrote to memory of 3428	2076	9b3d425b8de19aa8d89f3f92dc0462463d35e248eb6a97736731484135f0afb9.exe	73
PID 3244 wrote to memory of 3740	3244	firefox.exe	88
PID 3244 wrote to memory of 3740	3244	firefox.exe	88
PID 3244 wrote to memory of 3740	3244	firefox.exe	88
PID 3244 wrote to memory of 3740	3244	firefox.exe	88
PID 3244 wrote to memory of 3740	3244	firefox.exe	88
PID 3244 wrote to memory of 3740	3244	firefox.exe	88
PID 3244 wrote to memory of 3740	3244	firefox.exe	88
PID 3244 wrote to memory of 3740	3244	firefox.exe	88
PID 3244 wrote to memory of 3740	3244	firefox.exe	88
PID 3244 wrote to memory of 3740	3244	firefox.exe	88
PID 3244 wrote to memory of 3740	3244	firefox.exe	88
PID 3740 wrote to memory of 3200	3740	firefox.exe	89
PID 3740 wrote to memory of 3200	3740	firefox.exe	89
PID 3740 wrote to memory of 3560	3740	firefox.exe	90
PID 3740 wrote to memory of 3560	3740	firefox.exe	90
PID 3740 wrote to memory of 3560	3740	firefox.exe	90
PID 3740 wrote to memory of 3560	3740	firefox.exe	90
PID 3740 wrote to memory of 3560	3740	firefox.exe	90
PID 3740 wrote to memory of 3560	3740	firefox.exe	90
PID 3740 wrote to memory of 3560	3740	firefox.exe	90
PID 3740 wrote to memory of 3560	3740	firefox.exe	90
PID 3740 wrote to memory of 3560	3740	firefox.exe	90
PID 3740 wrote to memory of 3560	3740	firefox.exe	90
PID 3740 wrote to memory of 3560	3740	firefox.exe	90
PID 3740 wrote to memory of 3560	3740	firefox.exe	90
PID 3740 wrote to memory of 3560	3740	firefox.exe	90
PID 3740 wrote to memory of 3560	3740	firefox.exe	90
PID 3740 wrote to memory of 3560	3740	firefox.exe	90
PID 3740 wrote to memory of 3560	3740	firefox.exe	90
PID 3740 wrote to memory of 3560	3740	firefox.exe	90
PID 3740 wrote to memory of 3560	3740	firefox.exe	90
PID 3740 wrote to memory of 3560	3740	firefox.exe	90
PID 3740 wrote to memory of 3560	3740	firefox.exe	90
PID 3740 wrote to memory of 3560	3740	firefox.exe	90
PID 3740 wrote to memory of 3560	3740	firefox.exe	90
PID 3740 wrote to memory of 3560	3740	firefox.exe	90
PID 3740 wrote to memory of 3560	3740	firefox.exe	90
PID 3740 wrote to memory of 3560	3740	firefox.exe	90
PID 3740 wrote to memory of 3560	3740	firefox.exe	90
PID 3740 wrote to memory of 3560	3740	firefox.exe	90
PID 3740 wrote to memory of 3560	3740	firefox.exe	90
PID 3740 wrote to memory of 3560	3740	firefox.exe	90
PID 3740 wrote to memory of 3560	3740	firefox.exe	90
PID 3740 wrote to memory of 3560	3740	firefox.exe	90
PID 3740 wrote to memory of 3560	3740	firefox.exe	90
PID 3740 wrote to memory of 3560	3740	firefox.exe	90
PID 3740 wrote to memory of 3560	3740	firefox.exe	90
PID 3740 wrote to memory of 3560	3740	firefox.exe	90
PID 3740 wrote to memory of 3560	3740	firefox.exe	90
PID 3740 wrote to memory of 3560	3740	firefox.exe	90
PID 3740 wrote to memory of 3560	3740	firefox.exe	90
PID 3740 wrote to memory of 3560	3740	firefox.exe	90
PID 3740 wrote to memory of 3560	3740	firefox.exe	90
PID 3740 wrote to memory of 3560	3740	firefox.exe	90
PID 3740 wrote to memory of 3560	3740	firefox.exe	90
PID 3740 wrote to memory of 3560	3740	firefox.exe	90
PID 3740 wrote to memory of 3560	3740	firefox.exe	90
PID 3740 wrote to memory of 3560	3740	firefox.exe	90
PID 3740 wrote to memory of 3560	3740	firefox.exe	90
PID 3740 wrote to memory of 3560	3740	firefox.exe	90
PID 3740 wrote to memory of 3560	3740	firefox.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\9b3d425b8de19aa8d89f3f92dc0462463d35e248eb6a97736731484135f0afb9.exe
"C:\Users\Admin\AppData\Local\Temp\9b3d425b8de19aa8d89f3f92dc0462463d35e248eb6a97736731484135f0afb9.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
  "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3428

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2436

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2448

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" LanguagePackInstaller
1⤵
PID:2856

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3828

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" LanguagePackInstaller
1⤵
PID:2084

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1876

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3244
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3740.0.512120987\93767357" -parentBuildID 20221007134813 -prefsHandle 1720 -prefMapHandle 1712 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {72bbc2dd-552f-4745-be57-f76213e1a457} 3740 "\\.\pipe\gecko-crash-server-pipe.3740" 1812 26cbfcd2558 gpu
    3⤵
    PID:3200
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3740.1.1970912986\2107940786" -parentBuildID 20221007134813 -prefsHandle 2152 -prefMapHandle 2148 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a6d76ef8-4d53-4bcc-9a75-8b6b8b82e6c6} 3740 "\\.\pipe\gecko-crash-server-pipe.3740" 2164 26cbf7e5458 socket
    3⤵
    PID:3560
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3740.2.500639762\1665478433" -childID 1 -isForBrowser -prefsHandle 2728 -prefMapHandle 2780 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1016 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5cd3991f-00dc-42d2-a0df-3910be2940b3} 3740 "\\.\pipe\gecko-crash-server-pipe.3740" 2704 26cc3bd1558 tab
    3⤵
    PID:2276
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3740.3.1596933416\1073279200" -childID 2 -isForBrowser -prefsHandle 3520 -prefMapHandle 3516 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1016 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {da03f4f1-74bb-4b9c-8acd-9361d0844fcd} 3740 "\\.\pipe\gecko-crash-server-pipe.3740" 3488 26cad560158 tab
    3⤵
    PID:1096
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3740.4.366797445\1666459173" -childID 3 -isForBrowser -prefsHandle 3964 -prefMapHandle 3972 -prefsLen 26247 -prefMapSize 233444 -jsInitHandle 1016 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {635e267c-fd71-40fa-9d64-75406da96924} 3740 "\\.\pipe\gecko-crash-server-pipe.3740" 4344 26cc588d458 tab
    3⤵
    PID:4128
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3740.5.1185336328\1504701930" -childID 4 -isForBrowser -prefsHandle 4912 -prefMapHandle 4904 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1016 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5181be5d-bc5e-41c3-b07d-a1cc4b537279} 3740 "\\.\pipe\gecko-crash-server-pipe.3740" 4924 26cc588da58 tab
    3⤵
    PID:2452
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3740.6.162779850\1290939275" -childID 5 -isForBrowser -prefsHandle 5076 -prefMapHandle 5080 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1016 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f16b49c9-6f09-44f2-9779-2a9acd3386d3} 3740 "\\.\pipe\gecko-crash-server-pipe.3740" 5064 26cc60b8558 tab
    3⤵
    PID:2240
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3740.7.1298785760\364561883" -childID 6 -isForBrowser -prefsHandle 5268 -prefMapHandle 5272 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1016 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ff764218-3308-40d4-b2ea-f84f2ac74cca} 3740 "\\.\pipe\gecko-crash-server-pipe.3740" 5260 26cc6f43358 tab
    3⤵
    PID:4428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3740.8.619767892\105131320" -childID 7 -isForBrowser -prefsHandle 4392 -prefMapHandle 4784 -prefsLen 29737 -prefMapSize 233444 -jsInitHandle 1016 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4569f7c1-98c7-4400-a44e-7f9960a0d48a} 3740 "\\.\pipe\gecko-crash-server-pipe.3740" 5700 26ccb3adc58 tab
    3⤵
    PID:3580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3740.9.630428991\921658140" -childID 8 -isForBrowser -prefsHandle 5876 -prefMapHandle 5868 -prefsLen 29737 -prefMapSize 233444 -jsInitHandle 1016 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cb8d4291-6876-4e4a-b902-c2cab1651c09} 3740 "\\.\pipe\gecko-crash-server-pipe.3740" 5888 26cc5068458 tab
    3⤵
    PID:4192
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3740.10.1800682787\1861559862" -childID 9 -isForBrowser -prefsHandle 3316 -prefMapHandle 3284 -prefsLen 29786 -prefMapSize 233444 -jsInitHandle 1016 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bf70b3ea-cd93-4eef-a34b-ae30547cbbaa} 3740 "\\.\pipe\gecko-crash-server-pipe.3740" 6316 26cad55fe58 tab
    3⤵
    PID:5184
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3740.11.921910269\459923840" -childID 10 -isForBrowser -prefsHandle 6496 -prefMapHandle 6492 -prefsLen 29786 -prefMapSize 233444 -jsInitHandle 1016 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5920c348-7226-4913-bf9e-2a06beeadbda} 3740 "\\.\pipe\gecko-crash-server-pipe.3740" 6516 26cccb1d758 tab
    3⤵
    PID:5600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3740.12.1961260280\1070680610" -childID 11 -isForBrowser -prefsHandle 6568 -prefMapHandle 6672 -prefsLen 29786 -prefMapSize 233444 -jsInitHandle 1016 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d99598b7-6353-4cb2-90fe-e6adc6132d19} 3740 "\\.\pipe\gecko-crash-server-pipe.3740" 6700 26cccb1da58 tab
    3⤵
    PID:5632

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1924

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:424

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2856

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\240919-2kyt6svenl_pw_infected\" -spe -an -ai#7zMap19401:120:7zEvent7387
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4488

C:\Users\Admin\Downloads\240919-2kyt6svenl_pw_infected\9b3d425b8de19aa8d89f3f92dc0462463d35e248eb6a97736731484135f0afb9.exe
"C:\Users\Admin\Downloads\240919-2kyt6svenl_pw_infected\9b3d425b8de19aa8d89f3f92dc0462463d35e248eb6a97736731484135f0afb9.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
PID:2856

C:\Users\Admin\Downloads\240919-2kyt6svenl_pw_infected\9b3d425b8de19aa8d89f3f92dc0462463d35e248eb6a97736731484135f0afb9.exe
"C:\Users\Admin\Downloads\240919-2kyt6svenl_pw_infected\9b3d425b8de19aa8d89f3f92dc0462463d35e248eb6a97736731484135f0afb9.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4448

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2844

C:\Users\Admin\Downloads\240919-2kyt6svenl_pw_infected\9b3d425b8de19aa8d89f3f92dc0462463d35e248eb6a97736731484135f0afb9.exe
"C:\Users\Admin\Downloads\240919-2kyt6svenl_pw_infected\9b3d425b8de19aa8d89f3f92dc0462463d35e248eb6a97736731484135f0afb9.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5176

C:\Users\Admin\Downloads\240919-2kyt6svenl_pw_infected\9b3d425b8de19aa8d89f3f92dc0462463d35e248eb6a97736731484135f0afb9.exe
"C:\Users\Admin\Downloads\240919-2kyt6svenl_pw_infected\9b3d425b8de19aa8d89f3f92dc0462463d35e248eb6a97736731484135f0afb9.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion