amadey | b61d94fc68b720d98ad25cfc2be2fd1d5ba40a4cc63bd75094eb0f5f239dbde9

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	8b5ab76f19.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	8b5ab76f19.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	88135b9434.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	47e492f501.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	8b5ab76f19.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	8b5ab76f19.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	88135b9434.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	47e492f501.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	47e492f501.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	47e492f501.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	47e492f501.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	8b5ab76f19.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	8b5ab76f19.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	88135b9434.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	88135b9434.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	88135b9434.exe

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 2228 created 3444	2228	Jurisdiction.pif	56
PID 2228 created 3444	2228	Jurisdiction.pif	56

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 18 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

credential_access stealer

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	222.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	535bd66d58.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	6888c1230e.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	b61d94fc68b720d98ad25cfc2be2fd1d5ba40a4cc63bd75094eb0f5f239dbde9.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	34deb4d0d3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	8b5ab76f19.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	6888c1230e.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	115d71a8db.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	88135b9434.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	115d71a8db.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	47e492f501.exe

Downloads MZ/PE file

Uses browser remote debugging 2 TTPs 4 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

Steal Web Session Cookie

T1539

Modify Authentication Process

pid	Process
5368	chrome.exe
5112	chrome.exe
4536	chrome.exe
3904	chrome.exe

Checks BIOS information in registry 2 TTPs 36 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	535bd66d58.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	222.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	222.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	34deb4d0d3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	88135b9434.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	34deb4d0d3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8b5ab76f19.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	115d71a8db.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	b61d94fc68b720d98ad25cfc2be2fd1d5ba40a4cc63bd75094eb0f5f239dbde9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	88135b9434.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	6888c1230e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	8b5ab76f19.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	535bd66d58.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	6888c1230e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	115d71a8db.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	b61d94fc68b720d98ad25cfc2be2fd1d5ba40a4cc63bd75094eb0f5f239dbde9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	47e492f501.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	6888c1230e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	115d71a8db.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	47e492f501.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	6888c1230e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	115d71a8db.exe

Checks computer location settings 2 TTPs 12 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	34deb4d0d3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	axplong.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	splwow64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	FontCreator.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	Gxtuum.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	Updater.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	b61d94fc68b720d98ad25cfc2be2fd1d5ba40a4cc63bd75094eb0f5f239dbde9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	skotes.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	Offnewhere.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	FontCreator.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	Updater.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	JavUmar.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EcoCraft.url	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EcoCraft.url	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LgAmARwZ.url	97f3e3a782.exe

Executes dropped EXE 49 IoCs

pid	Process
2524	skotes.exe
1688	skotes.exe
2336	34deb4d0d3.exe
2640	axplong.exe
4880	stealc_default2.exe
212	Offnewhere.exe
520	8b5ab76f19.exe
2856	Gxtuum.exe
3352	splwow64.exe
4616	88135b9434.exe
2452	new_v8.exe
2228	Jurisdiction.pif
3896	97f3e3a782.exe
976	skotes.exe
4864	axplong.exe
848	FontCreator.exe
1320	Gxtuum.exe
1048	FontCreator.tmp
4928	FontCreator.exe
4092	FontCreator.tmp
3352	FontCreator.exe
4792	FontCreator.tmp
2800	535bd66d58.exe
2504	FontCreator.exe
1032	FontCreator.tmp
1336	GOLD1234.exe
3612	RDX123456.exe
2896	GOLD1234.exe
3004	222.exe
1632	JavUmar.exe
2288	Updater.exe
2936	yxrd0ob7.exe
4428	Updater.exe
4824	6888c1230e.exe
4508	6888c1230e.exe
740	115d71a8db.exe
4944	115d71a8db.exe
4940	yxrd0ob7.exe
3252	d1b2223e35.exe
4208	47e492f501.exe
5440	stail.exe
5476	stail.tmp
6096	blurayplayer32.exe
3532	skotes.exe
4312	axplong.exe
1744	Gxtuum.exe
2580	Updater.exe
5748	Updater.exe
5840	service123.exe

Identifies Wine through registry keys 2 TTPs 18 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	535bd66d58.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	b61d94fc68b720d98ad25cfc2be2fd1d5ba40a4cc63bd75094eb0f5f239dbde9.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	8b5ab76f19.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	88135b9434.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	222.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	6888c1230e.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	47e492f501.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	6888c1230e.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	115d71a8db.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	34deb4d0d3.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	115d71a8db.exe

Loads dropped DLL 12 IoCs

pid	Process
1048	FontCreator.tmp
1048	FontCreator.tmp
4092	FontCreator.tmp
4092	FontCreator.tmp
4792	FontCreator.tmp
4792	FontCreator.tmp
1032	FontCreator.tmp
1032	FontCreator.tmp
4880	stealc_default2.exe
4880	stealc_default2.exe
5476	stail.tmp
5840	service123.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	47e492f501.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	8b5ab76f19.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	8b5ab76f19.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	88135b9434.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d1b2223e35.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1003262001\\d1b2223e35.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\47e492f501.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1003263001\\47e492f501.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8b5ab76f19.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1001735001\\8b5ab76f19.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6888c1230e.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1001558001\\6888c1230e.exe"	axplong.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\115d71a8db.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1001559001\\115d71a8db.exe"	axplong.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6888c1230e.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1003260001\\6888c1230e.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\115d71a8db.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1003261001\\115d71a8db.exe"	skotes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0008000000023d46-1273.dat	autoit_exe

Enumerates processes with tasklist 1 TTPs 14 IoCs

discovery

Process Discovery

T1057

pid	Process
4116	tasklist.exe
4508	tasklist.exe
4764	tasklist.exe
752	tasklist.exe
3864	tasklist.exe
1072	tasklist.exe
2712	tasklist.exe
1116	tasklist.exe
932	tasklist.exe
896	tasklist.exe
824	tasklist.exe
848	tasklist.exe
1468	tasklist.exe
4864	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 18 IoCs

pid	Process
2260	b61d94fc68b720d98ad25cfc2be2fd1d5ba40a4cc63bd75094eb0f5f239dbde9.exe
2524	skotes.exe
1688	skotes.exe
2336	34deb4d0d3.exe
2640	axplong.exe
520	8b5ab76f19.exe
4616	88135b9434.exe
976	skotes.exe
4864	axplong.exe
2800	535bd66d58.exe
3004	222.exe
4824	6888c1230e.exe
4508	6888c1230e.exe
740	115d71a8db.exe
4944	115d71a8db.exe
4208	47e492f501.exe
3532	skotes.exe
4312	axplong.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 2524 set thread context of 1688	2524	skotes.exe	99
PID 1336 set thread context of 2896	1336	GOLD1234.exe	148
PID 3896 set thread context of 3004	3896	97f3e3a782.exe	214
PID 2936 set thread context of 4940	2936	yxrd0ob7.exe	221
PID 2580 set thread context of 5148	2580	Updater.exe	278
PID 5748 set thread context of 4708	5748	Updater.exe	279

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\HomelessLaser	splwow64.exe
File opened for modification	C:\Windows\EauOfficial	splwow64.exe
File created	C:\Windows\Tasks\skotes.job	b61d94fc68b720d98ad25cfc2be2fd1d5ba40a4cc63bd75094eb0f5f239dbde9.exe
File created	C:\Windows\Tasks\axplong.job	34deb4d0d3.exe
File opened for modification	C:\Windows\LuggageRepresentations	splwow64.exe
File opened for modification	C:\Windows\AdditionsSalvation	splwow64.exe
File created	C:\Windows\Tasks\Gxtuum.job	Offnewhere.exe
File opened for modification	C:\Windows\SixCream	splwow64.exe
File opened for modification	C:\Windows\ActuallyFtp	splwow64.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral2/files/0x0007000000023d02-1138.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 10 IoCs

pid	pid_target	Process	procid_target
852	1336	WerFault.exe	145
3960	2896	WerFault.exe	148
724	3004	WerFault.exe	150
4332	3612	WerFault.exe	147
384	2936	WerFault.exe	180
4536	4940	WerFault.exe	221
5684	1632	WerFault.exe	170
5844	5148	WerFault.exe	278
1992	5148	WerFault.exe	278
3788	4708	WerFault.exe	279

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	535bd66d58.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GOLD1234.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Offnewhere.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RDX123456.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axplong.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FontCreator.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d1b2223e35.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	new_v8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yxrd0ob7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yxrd0ob7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FontCreator.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GOLD1234.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b61d94fc68b720d98ad25cfc2be2fd1d5ba40a4cc63bd75094eb0f5f239dbde9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FontCreator.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JavUmar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6888c1230e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stail.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FontCreator.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	115d71a8db.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8b5ab76f19.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FontCreator.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6888c1230e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stail.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	blurayplayer32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FontCreator.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FontCreator.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	34deb4d0d3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stealc_default2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	222.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	115d71a8db.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	splwow64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jurisdiction.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	47e492f501.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gxtuum.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4784	cmd.exe
3492	PING.EXE
5752	cmd.exe
5384	PING.EXE

Checks processor information in registry 2 TTPs 16 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	stealc_default2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	stealc_default2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	JavUmar.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	JavUmar.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Updater.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Updater.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
4268	taskkill.exe
4556	taskkill.exe
3128	taskkill.exe
740	taskkill.exe
4744	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	firefox.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
3492	PING.EXE
5384	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2908	schtasks.exe
6092	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2260	b61d94fc68b720d98ad25cfc2be2fd1d5ba40a4cc63bd75094eb0f5f239dbde9.exe
2260	b61d94fc68b720d98ad25cfc2be2fd1d5ba40a4cc63bd75094eb0f5f239dbde9.exe
2524	skotes.exe
2524	skotes.exe
1688	skotes.exe
1688	skotes.exe
2336	34deb4d0d3.exe
2336	34deb4d0d3.exe
2640	axplong.exe
2640	axplong.exe
4880	stealc_default2.exe
4880	stealc_default2.exe
520	8b5ab76f19.exe
520	8b5ab76f19.exe
4616	88135b9434.exe
4616	88135b9434.exe
520	8b5ab76f19.exe
520	8b5ab76f19.exe
520	8b5ab76f19.exe
4616	88135b9434.exe
4616	88135b9434.exe
4616	88135b9434.exe
2228	Jurisdiction.pif
2228	Jurisdiction.pif
2228	Jurisdiction.pif
2228	Jurisdiction.pif
2228	Jurisdiction.pif
2228	Jurisdiction.pif
2228	Jurisdiction.pif
2228	Jurisdiction.pif
2228	Jurisdiction.pif
2228	Jurisdiction.pif
2228	Jurisdiction.pif
2228	Jurisdiction.pif
2228	Jurisdiction.pif
2228	Jurisdiction.pif
2228	Jurisdiction.pif
2228	Jurisdiction.pif
2228	Jurisdiction.pif
2228	Jurisdiction.pif
2228	Jurisdiction.pif
2228	Jurisdiction.pif
2228	Jurisdiction.pif
2228	Jurisdiction.pif
2228	Jurisdiction.pif
2228	Jurisdiction.pif
2228	Jurisdiction.pif
2228	Jurisdiction.pif
2228	Jurisdiction.pif
2228	Jurisdiction.pif
2228	Jurisdiction.pif
2228	Jurisdiction.pif
2228	Jurisdiction.pif
2228	Jurisdiction.pif
2228	Jurisdiction.pif
2228	Jurisdiction.pif
2228	Jurisdiction.pif
2228	Jurisdiction.pif
976	skotes.exe
976	skotes.exe
4864	axplong.exe
4864	axplong.exe
4092	FontCreator.tmp
4092	FontCreator.tmp

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5368	chrome.exe
5368	chrome.exe
5368	chrome.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	520	8b5ab76f19.exe
Token: SeDebugPrivilege	4616	88135b9434.exe
Token: SeDebugPrivilege	848	tasklist.exe
Token: SeDebugPrivilege	752	tasklist.exe
Token: SeDebugPrivilege	4116	tasklist.exe
Token: SeDebugPrivilege	4508	tasklist.exe
Token: SeDebugPrivilege	2712	tasklist.exe
Token: SeDebugPrivilege	3896	97f3e3a782.exe
Token: SeDebugPrivilege	1116	tasklist.exe
Token: SeDebugPrivilege	932	tasklist.exe
Token: SeDebugPrivilege	896	tasklist.exe
Token: SeDebugPrivilege	824	tasklist.exe
Token: SeDebugPrivilege	4764	tasklist.exe
Token: SeDebugPrivilege	4864	tasklist.exe
Token: SeDebugPrivilege	3864	tasklist.exe
Token: SeDebugPrivilege	1072	tasklist.exe
Token: SeDebugPrivilege	1468	tasklist.exe
Token: SeDebugPrivilege	4268	taskkill.exe
Token: SeDebugPrivilege	4556	taskkill.exe
Token: SeDebugPrivilege	3128	taskkill.exe
Token: SeDebugPrivilege	740	taskkill.exe
Token: SeDebugPrivilege	4744	taskkill.exe
Token: SeDebugPrivilege	544	firefox.exe
Token: SeDebugPrivilege	544	firefox.exe
Token: SeDebugPrivilege	4208	47e492f501.exe
Token: SeShutdownPrivilege	5368	chrome.exe
Token: SeCreatePagefilePrivilege	5368	chrome.exe
Token: SeShutdownPrivilege	5368	chrome.exe
Token: SeCreatePagefilePrivilege	5368	chrome.exe

Suspicious use of FindShellTrayWindow 63 IoCs

pid	Process
2228	Jurisdiction.pif
2228	Jurisdiction.pif
2228	Jurisdiction.pif
4092	FontCreator.tmp
1032	FontCreator.tmp
3252	d1b2223e35.exe
3252	d1b2223e35.exe
3252	d1b2223e35.exe
3252	d1b2223e35.exe
3252	d1b2223e35.exe
3252	d1b2223e35.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
3252	d1b2223e35.exe
3252	d1b2223e35.exe
3252	d1b2223e35.exe
3252	d1b2223e35.exe
5476	stail.tmp
5368	chrome.exe
5368	chrome.exe
5368	chrome.exe
5368	chrome.exe
5368	chrome.exe
5368	chrome.exe
5368	chrome.exe
5368	chrome.exe
5368	chrome.exe
5368	chrome.exe
5368	chrome.exe
5368	chrome.exe
5368	chrome.exe
5368	chrome.exe
5368	chrome.exe
5368	chrome.exe
5368	chrome.exe
5368	chrome.exe
5368	chrome.exe
5368	chrome.exe
5368	chrome.exe
5368	chrome.exe
5368	chrome.exe
5368	chrome.exe
5368	chrome.exe
5368	chrome.exe

Suspicious use of SendNotifyMessage 33 IoCs

pid	Process
2228	Jurisdiction.pif
2228	Jurisdiction.pif
2228	Jurisdiction.pif
3252	d1b2223e35.exe
3252	d1b2223e35.exe
3252	d1b2223e35.exe
3252	d1b2223e35.exe
3252	d1b2223e35.exe
3252	d1b2223e35.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
3252	d1b2223e35.exe
3252	d1b2223e35.exe
3252	d1b2223e35.exe
3252	d1b2223e35.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
544	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 2524	2260	b61d94fc68b720d98ad25cfc2be2fd1d5ba40a4cc63bd75094eb0f5f239dbde9.exe	87
PID 2260 wrote to memory of 2524	2260	b61d94fc68b720d98ad25cfc2be2fd1d5ba40a4cc63bd75094eb0f5f239dbde9.exe	87
PID 2260 wrote to memory of 2524	2260	b61d94fc68b720d98ad25cfc2be2fd1d5ba40a4cc63bd75094eb0f5f239dbde9.exe	87
PID 2524 wrote to memory of 2140	2524	skotes.exe	94
PID 2524 wrote to memory of 2140	2524	skotes.exe	94
PID 2524 wrote to memory of 2140	2524	skotes.exe	94
PID 2524 wrote to memory of 1688	2524	skotes.exe	99
PID 2524 wrote to memory of 1688	2524	skotes.exe	99
PID 2524 wrote to memory of 1688	2524	skotes.exe	99
PID 2524 wrote to memory of 1688	2524	skotes.exe	99
PID 2524 wrote to memory of 1688	2524	skotes.exe	99
PID 2524 wrote to memory of 1688	2524	skotes.exe	99
PID 2524 wrote to memory of 1688	2524	skotes.exe	99
PID 2524 wrote to memory of 1688	2524	skotes.exe	99
PID 2524 wrote to memory of 1688	2524	skotes.exe	99
PID 2524 wrote to memory of 1688	2524	skotes.exe	99
PID 2524 wrote to memory of 1688	2524	skotes.exe	99
PID 2524 wrote to memory of 2336	2524	skotes.exe	101
PID 2524 wrote to memory of 2336	2524	skotes.exe	101
PID 2524 wrote to memory of 2336	2524	skotes.exe	101
PID 2336 wrote to memory of 2640	2336	34deb4d0d3.exe	102
PID 2336 wrote to memory of 2640	2336	34deb4d0d3.exe	102
PID 2336 wrote to memory of 2640	2336	34deb4d0d3.exe	102
PID 2640 wrote to memory of 4880	2640	axplong.exe	103
PID 2640 wrote to memory of 4880	2640	axplong.exe	103
PID 2640 wrote to memory of 4880	2640	axplong.exe	103
PID 2640 wrote to memory of 212	2640	axplong.exe	104
PID 2640 wrote to memory of 212	2640	axplong.exe	104
PID 2640 wrote to memory of 212	2640	axplong.exe	104
PID 2524 wrote to memory of 520	2524	skotes.exe	105
PID 2524 wrote to memory of 520	2524	skotes.exe	105
PID 2524 wrote to memory of 520	2524	skotes.exe	105
PID 212 wrote to memory of 2856	212	Offnewhere.exe	106
PID 212 wrote to memory of 2856	212	Offnewhere.exe	106
PID 212 wrote to memory of 2856	212	Offnewhere.exe	106
PID 2640 wrote to memory of 3352	2640	axplong.exe	107
PID 2640 wrote to memory of 3352	2640	axplong.exe	107
PID 2640 wrote to memory of 3352	2640	axplong.exe	107
PID 2524 wrote to memory of 4616	2524	skotes.exe	108
PID 2524 wrote to memory of 4616	2524	skotes.exe	108
PID 2524 wrote to memory of 4616	2524	skotes.exe	108
PID 3352 wrote to memory of 2212	3352	splwow64.exe	109
PID 3352 wrote to memory of 2212	3352	splwow64.exe	109
PID 3352 wrote to memory of 2212	3352	splwow64.exe	109
PID 2212 wrote to memory of 848	2212	cmd.exe	111
PID 2212 wrote to memory of 848	2212	cmd.exe	111
PID 2212 wrote to memory of 848	2212	cmd.exe	111
PID 2212 wrote to memory of 3076	2212	cmd.exe	112
PID 2212 wrote to memory of 3076	2212	cmd.exe	112
PID 2212 wrote to memory of 3076	2212	cmd.exe	112
PID 2212 wrote to memory of 752	2212	cmd.exe	113
PID 2212 wrote to memory of 752	2212	cmd.exe	113
PID 2212 wrote to memory of 752	2212	cmd.exe	113
PID 2212 wrote to memory of 1776	2212	cmd.exe	114
PID 2212 wrote to memory of 1776	2212	cmd.exe	114
PID 2212 wrote to memory of 1776	2212	cmd.exe	114
PID 2212 wrote to memory of 1412	2212	cmd.exe	116
PID 2212 wrote to memory of 1412	2212	cmd.exe	116
PID 2212 wrote to memory of 1412	2212	cmd.exe	116
PID 2212 wrote to memory of 4780	2212	cmd.exe	117
PID 2212 wrote to memory of 4780	2212	cmd.exe	117
PID 2212 wrote to memory of 4780	2212	cmd.exe	117
PID 2640 wrote to memory of 2452	2640	axplong.exe	118
PID 2640 wrote to memory of 2452	2640	axplong.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3444
- C:\Users\Admin\AppData\Local\Temp\b61d94fc68b720d98ad25cfc2be2fd1d5ba40a4cc63bd75094eb0f5f239dbde9.exe
  "C:\Users\Admin\AppData\Local\Temp\b61d94fc68b720d98ad25cfc2be2fd1d5ba40a4cc63bd75094eb0f5f239dbde9.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
    "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Adds Run key to start application
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2524
  - - C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      4⤵
      PID:2140
  - - C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      PID:1688
  - - C:\Users\Admin\AppData\Local\Temp\1001698001\34deb4d0d3.exe
      "C:\Users\Admin\AppData\Local\Temp\1001698001\34deb4d0d3.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Checks computer location settings
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2336
    - - C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
        
        "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Checks computer location settings
        Executes dropped EXE
        Identifies Wine through registry keys
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2640
      - C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:4880
      - C:\Users\Admin\AppData\Local\Temp\1000477001\Offnewhere.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000477001\Offnewhere.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:212
        
        C:\Users\Admin\AppData\Local\Temp\23a0892ef8\Gxtuum.exe
        
        "C:\Users\Admin\AppData\Local\Temp\23a0892ef8\Gxtuum.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\10000020101\JavUmar.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10000020101\JavUmar.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        
        PID:1632
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
        9⤵
        Uses browser remote debugging
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:5368
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff95259cc40,0x7ff95259cc4c,0x7ff95259cc58
        10⤵
        
        PID:5400
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1928,i,12698440708688924988,3706864032836970792,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1924 /prefetch:2
        10⤵
        
        PID:5712
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1900,i,12698440708688924988,3706864032836970792,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2116 /prefetch:3
        10⤵
        
        PID:5724
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2256,i,12698440708688924988,3706864032836970792,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2480 /prefetch:8
        10⤵
        
        PID:5880
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3148,i,12698440708688924988,3706864032836970792,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3168 /prefetch:1
        10⤵
        Uses browser remote debugging
        
        PID:4536
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3176,i,12698440708688924988,3706864032836970792,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3224 /prefetch:1
        10⤵
        Uses browser remote debugging
        
        PID:5112
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3472,i,12698440708688924988,3706864032836970792,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4524 /prefetch:1
        10⤵
        Uses browser remote debugging
        
        PID:3904
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4544,i,12698440708688924988,3706864032836970792,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4560 /prefetch:8
        10⤵
        
        PID:4120
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4680,i,12698440708688924988,3706864032836970792,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4740 /prefetch:8
        10⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\service123.exe
        
        "C:\Users\Admin\AppData\Local\Temp\service123.exe"
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:5840
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6092
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 768
        9⤵
        Program crash
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\10000061101\stail.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10000061101\stail.exe"
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\is-C6607.tmp\stail.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-C6607.tmp\stail.tmp" /SL5="$E0114,5239339,56832,C:\Users\Admin\AppData\Local\Temp\10000061101\stail.exe"
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\BluRay Player 1.2.16\blurayplayer32.exe
        
        "C:\Users\Admin\AppData\Local\BluRay Player 1.2.16\blurayplayer32.exe" -i
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:6096
      - C:\Users\Admin\AppData\Local\Temp\1000817001\splwow64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000817001\splwow64.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3352
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy Beijing Beijing.bat & Beijing.bat
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2212
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:848
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa opssvc"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3076
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:752
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1776
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 197036
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1412
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "CRAWFORDFILLEDVERIFYSCALE" Mtv
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4780
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Twisted + ..\Molecular + ..\Sponsorship + ..\Various + ..\Witch + ..\Spirit + ..\See + ..\Fitting T
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\197036\Jurisdiction.pif
        
        Jurisdiction.pif T
        8⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2228
        
        C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1860
      - C:\Users\Admin\AppData\Local\Temp\1000828001\new_v8.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000828001\new_v8.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2452
      - C:\Users\Admin\AppData\Local\Temp\1000833001\97f3e3a782.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000833001\97f3e3a782.exe"
        6⤵
        Drops startup file
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:3896
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        
        PID:1860
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        
        PID:976
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        
        PID:4480
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3004
      - C:\Users\Admin\AppData\Local\Temp\1000857001\535bd66d58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000857001\535bd66d58.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:2800
      - C:\Users\Admin\AppData\Local\Temp\1000965001\GOLD1234.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\GOLD1234.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1336
        
        C:\Users\Admin\AppData\Local\Temp\1000965001\GOLD1234.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\GOLD1234.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2896
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1284
        8⤵
        Program crash
        
        PID:3960
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 264
        7⤵
        Program crash
        
        PID:852
      - C:\Users\Admin\AppData\Local\Temp\1001096001\RDX123456.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1001096001\RDX123456.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3612
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3612 -s 1260
        7⤵
        Program crash
        
        PID:4332
      - C:\Users\Admin\AppData\Local\Temp\1001527001\yxrd0ob7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1001527001\yxrd0ob7.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\1001527001\yxrd0ob7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1001527001\yxrd0ob7.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4940
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 1240
        8⤵
        Program crash
        
        PID:4536
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 252
        7⤵
        Program crash
        
        PID:384
      - C:\Users\Admin\AppData\Local\Temp\1001558001\6888c1230e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1001558001\6888c1230e.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:4508
      - C:\Users\Admin\AppData\Local\Temp\1001559001\115d71a8db.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1001559001\115d71a8db.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:740
  - - C:\Users\Admin\AppData\Local\Temp\1001735001\8b5ab76f19.exe
      "C:\Users\Admin\AppData\Local\Temp\1001735001\8b5ab76f19.exe"
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Windows security modification
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:520
  - - C:\Users\Admin\AppData\Local\Temp\1001776101\88135b9434.exe
      "C:\Users\Admin\AppData\Local\Temp\1001776101\88135b9434.exe"
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Windows security modification
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4616
  - - C:\Users\Admin\AppData\Local\Temp\1003142001\FontCreator.exe
      "C:\Users\Admin\AppData\Local\Temp\1003142001\FontCreator.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:848
    - - C:\Users\Admin\AppData\Local\Temp\is-PIEL3.tmp\FontCreator.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-PIEL3.tmp\FontCreator.tmp" /SL5="$1601F2,2820349,845824,C:\Users\Admin\AppData\Local\Temp\1003142001\FontCreator.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1048
      - C:\Users\Admin\AppData\Local\Temp\1003142001\FontCreator.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1003142001\FontCreator.exe" /VERYSILENT
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\is-HF1A2.tmp\FontCreator.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-HF1A2.tmp\FontCreator.tmp" /SL5="$1701F2,2820349,845824,C:\Users\Admin\AppData\Local\Temp\1003142001\FontCreator.exe" /VERYSILENT
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        
        PID:4092
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH | find /I "wrsa.exe"
        8⤵
        
        PID:1848
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
        9⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4116
        
        C:\Windows\system32\find.exe
        
        find /I "wrsa.exe"
        9⤵
        
        PID:1564
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe"
        8⤵
        
        PID:1912
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
        9⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4508
        
        C:\Windows\system32\find.exe
        
        find /I "opssvc.exe"
        9⤵
        
        PID:4524
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH | find /I "avastui.exe"
        8⤵
        
        PID:1072
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
        9⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2712
        
        C:\Windows\system32\find.exe
        
        find /I "avastui.exe"
        9⤵
        
        PID:944
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH | find /I "avgui.exe"
        8⤵
        
        PID:1740
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
        9⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1116
        
        C:\Windows\system32\find.exe
        
        find /I "avgui.exe"
        9⤵
        
        PID:4132
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH | find /I "nswscsvc.exe"
        8⤵
        
        PID:4824
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
        9⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:932
        
        C:\Windows\system32\find.exe
        
        find /I "nswscsvc.exe"
        9⤵
        
        PID:1404
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH | find /I "sophoshealth.exe"
        8⤵
        
        PID:3368
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
        9⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:896
        
        C:\Windows\system32\find.exe
        
        find /I "sophoshealth.exe"
        9⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\hangbird\Updater.exe
        
        "C:\Users\Admin\AppData\Local\hangbird\\Updater.exe" "C:\Users\Admin\AppData\Local\hangbird\\caliculus.csv"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2288
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c ping -n 5 127.0.0.1 >nul && updater.exe C:\ProgramData\\iaeaqn9.a3x && del C:\ProgramData\\iaeaqn9.a3x
        9⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4784
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 5 127.0.0.1
        10⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\hangbird\Updater.exe
        
        updater.exe C:\ProgramData\\iaeaqn9.a3x
        10⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        
        PID:2580
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:5148
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5148 -s 1224
        12⤵
        Program crash
        
        PID:5844
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5148 -s 1192
        12⤵
        Program crash
        
        PID:1992
  - - C:\Users\Admin\AppData\Local\Temp\1003143001\FontCreator.exe
      "C:\Users\Admin\AppData\Local\Temp\1003143001\FontCreator.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3352
    - - C:\Users\Admin\AppData\Local\Temp\is-4CH29.tmp\FontCreator.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-4CH29.tmp\FontCreator.tmp" /SL5="$30254,2820349,845824,C:\Users\Admin\AppData\Local\Temp\1003143001\FontCreator.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4792
      - C:\Users\Admin\AppData\Local\Temp\1003143001\FontCreator.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1003143001\FontCreator.exe" /VERYSILENT
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\is-3M3S3.tmp\FontCreator.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-3M3S3.tmp\FontCreator.tmp" /SL5="$40254,2820349,845824,C:\Users\Admin\AppData\Local\Temp\1003143001\FontCreator.exe" /VERYSILENT
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:1032
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH | find /I "wrsa.exe"
        8⤵
        
        PID:2452
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
        9⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:824
        
        C:\Windows\system32\find.exe
        
        find /I "wrsa.exe"
        9⤵
        
        PID:3124
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe"
        8⤵
        
        PID:4380
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
        9⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4764
        
        C:\Windows\system32\find.exe
        
        find /I "opssvc.exe"
        9⤵
        
        PID:2020
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH | find /I "avastui.exe"
        8⤵
        
        PID:4812
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
        9⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4864
        
        C:\Windows\system32\find.exe
        
        find /I "avastui.exe"
        9⤵
        
        PID:4008
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH | find /I "avgui.exe"
        8⤵
        
        PID:4732
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
        9⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3864
        
        C:\Windows\system32\find.exe
        
        find /I "avgui.exe"
        9⤵
        
        PID:4988
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH | find /I "nswscsvc.exe"
        8⤵
        
        PID:3924
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
        9⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1072
        
        C:\Windows\system32\find.exe
        
        find /I "nswscsvc.exe"
        9⤵
        
        PID:1204
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH | find /I "sophoshealth.exe"
        8⤵
        
        PID:4000
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
        9⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1468
        
        C:\Windows\system32\find.exe
        
        find /I "sophoshealth.exe"
        9⤵
        
        PID:1116
        
        C:\Users\Admin\AppData\Local\hangbird\Updater.exe
        
        "C:\Users\Admin\AppData\Local\hangbird\\Updater.exe" "C:\Users\Admin\AppData\Local\hangbird\\caliculus.csv"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4428
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c ping -n 5 127.0.0.1 >nul && updater.exe C:\ProgramData\\ALPHjXTc.a3x && del C:\ProgramData\\ALPHjXTc.a3x
        9⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:5752
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 5 127.0.0.1
        10⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\hangbird\Updater.exe
        
        updater.exe C:\ProgramData\\ALPHjXTc.a3x
        10⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        
        PID:5748
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:4708
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 1196
        12⤵
        Program crash
        
        PID:3788
  - - C:\Users\Admin\AppData\Local\Temp\1003238001\222.exe
      "C:\Users\Admin\AppData\Local\Temp\1003238001\222.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      PID:3004
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 1488
        5⤵
        Program crash
        
        PID:724
  - - C:\Users\Admin\AppData\Local\Temp\1003260001\6888c1230e.exe
      "C:\Users\Admin\AppData\Local\Temp\1003260001\6888c1230e.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      PID:4824
  - - C:\Users\Admin\AppData\Local\Temp\1003261001\115d71a8db.exe
      "C:\Users\Admin\AppData\Local\Temp\1003261001\115d71a8db.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      PID:4944
  - - C:\Users\Admin\AppData\Local\Temp\1003262001\d1b2223e35.exe
      "C:\Users\Admin\AppData\Local\Temp\1003262001\d1b2223e35.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:3252
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM firefox.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4268
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4556
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3128
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:740
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4744
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
        5⤵
        
        PID:1992
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        6⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:544
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2024 -parentBuildID 20240401114208 -prefsHandle 1940 -prefMapHandle 1932 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1e32e70b-94b4-46b4-85a7-228545d4bd27} 544 "\\.\pipe\gecko-crash-server-pipe.544" gpu
        7⤵
        
        PID:3696
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2464 -parentBuildID 20240401114208 -prefsHandle 2456 -prefMapHandle 2444 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d82c537c-7923-43e7-b3b5-2d4220a08795} 544 "\\.\pipe\gecko-crash-server-pipe.544" socket
        7⤵
        
        PID:1952
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2692 -childID 1 -isForBrowser -prefsHandle 3012 -prefMapHandle 2908 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f74d92cf-41c3-486a-ba48-ceaf340a732a} 544 "\\.\pipe\gecko-crash-server-pipe.544" tab
        7⤵
        
        PID:4412
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3832 -childID 2 -isForBrowser -prefsHandle 3836 -prefMapHandle 3168 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {36d560b4-86ff-4905-a16d-a2beb4a54153} 544 "\\.\pipe\gecko-crash-server-pipe.544" tab
        7⤵
        
        PID:2172
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4480 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4472 -prefMapHandle 4468 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e3b1f92f-dcc3-4368-bd74-accee2c37153} 544 "\\.\pipe\gecko-crash-server-pipe.544" utility
        7⤵
        Checks processor information in registry
        
        PID:5896
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5244 -childID 3 -isForBrowser -prefsHandle 5320 -prefMapHandle 5252 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {18dc94f7-09f5-4ec4-b29b-ab8b738dbfca} 544 "\\.\pipe\gecko-crash-server-pipe.544" tab
        7⤵
        
        PID:5524
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5492 -childID 4 -isForBrowser -prefsHandle 5452 -prefMapHandle 5448 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6f505a75-0f14-4134-98fa-5e4a92b3cecb} 544 "\\.\pipe\gecko-crash-server-pipe.544" tab
        7⤵
        
        PID:5536
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5760 -childID 5 -isForBrowser -prefsHandle 5752 -prefMapHandle 5748 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3d4aca21-d4ec-41f6-8856-00589b2fcddc} 544 "\\.\pipe\gecko-crash-server-pipe.544" tab
        7⤵
        
        PID:5548
  - - C:\Users\Admin\AppData\Local\Temp\1003263001\47e492f501.exe
      "C:\Users\Admin\AppData\Local\Temp\1003263001\47e492f501.exe"
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Windows security modification
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4208
- C:\Windows\SysWOW64\cmd.exe
  cmd /c schtasks.exe /create /tn "Wall" /tr "wscript //B 'C:\Users\Admin\AppData\Local\GreenTech Dynamics\EcoCraft.js'" /sc minute /mo 5 /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1624
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /create /tn "Wall" /tr "wscript //B 'C:\Users\Admin\AppData\Local\GreenTech Dynamics\EcoCraft.js'" /sc minute /mo 5 /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2908
- C:\Windows\SysWOW64\cmd.exe
  cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EcoCraft.url" & echo URL="C:\Users\Admin\AppData\Local\GreenTech Dynamics\EcoCraft.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EcoCraft.url" & exit
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  PID:3544

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:976

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4864

C:\Users\Admin\AppData\Local\Temp\23a0892ef8\Gxtuum.exe
C:\Users\Admin\AppData\Local\Temp\23a0892ef8\Gxtuum.exe
1⤵
- Executes dropped EXE
PID:1320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1336 -ip 1336
1⤵
PID:2060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2896 -ip 2896
1⤵
PID:2776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3004 -ip 3004
1⤵
PID:2548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3612 -ip 3612
1⤵
PID:1720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2936 -ip 2936
1⤵
PID:2700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4940 -ip 4940
1⤵
PID:2960

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4936

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3532

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4312

C:\Users\Admin\AppData\Local\Temp\23a0892ef8\Gxtuum.exe
C:\Users\Admin\AppData\Local\Temp\23a0892ef8\Gxtuum.exe
1⤵
- Executes dropped EXE
PID:1744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1632 -ip 1632
1⤵
PID:5704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5148 -ip 5148
1⤵
PID:5256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5148 -ip 5148
1⤵
PID:4312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4708 -ip 4708
1⤵
PID:4924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Modify Authentication Process

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Authentication Process

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

Remote System Discovery

T1018

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion