amadey | 67c0ad50ed01f2877356c9781b1bd7d3270552a97b5aab5de13c4fa3a78e3f50

Virtualization/Sandbox Evasion

Processes:

67c0ad50ed01f2877356c9781b1bd7d3270552a97b5aab5de13c4fa3a78e3f50.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	67c0ad50ed01f2877356c9781b1bd7d3270552a97b5aab5de13c4fa3a78e3f50.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

Processes:

67c0ad50ed01f2877356c9781b1bd7d3270552a97b5aab5de13c4fa3a78e3f50.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	67c0ad50ed01f2877356c9781b1bd7d3270552a97b5aab5de13c4fa3a78e3f50.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	67c0ad50ed01f2877356c9781b1bd7d3270552a97b5aab5de13c4fa3a78e3f50.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

Processes:

67c0ad50ed01f2877356c9781b1bd7d3270552a97b5aab5de13c4fa3a78e3f50.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine	67c0ad50ed01f2877356c9781b1bd7d3270552a97b5aab5de13c4fa3a78e3f50.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/files/0x000500000001a59f-1363.dat	autoit_exe

Enumerates processes with tasklist 1 TTPs 14 IoCs

Process Discovery

T1057

Processes:

tasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exe

pid	Process
2716	tasklist.exe
888	tasklist.exe
1628	tasklist.exe
672	tasklist.exe
1308	tasklist.exe
1976	tasklist.exe
2204	tasklist.exe
1552	tasklist.exe
2356	tasklist.exe
892	tasklist.exe
820	tasklist.exe
1452	tasklist.exe
2712	tasklist.exe
1676	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

67c0ad50ed01f2877356c9781b1bd7d3270552a97b5aab5de13c4fa3a78e3f50.exe

pid	Process
1448	67c0ad50ed01f2877356c9781b1bd7d3270552a97b5aab5de13c4fa3a78e3f50.exe

Drops file in Windows directory 1 IoCs

Processes:

67c0ad50ed01f2877356c9781b1bd7d3270552a97b5aab5de13c4fa3a78e3f50.exe

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	67c0ad50ed01f2877356c9781b1bd7d3270552a97b5aab5de13c4fa3a78e3f50.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	Process	procid_target
2376	3000	WerFault.exe	121
2260	2576	WerFault.exe	128

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

T1614.001

Processes:

67c0ad50ed01f2877356c9781b1bd7d3270552a97b5aab5de13c4fa3a78e3f50.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	67c0ad50ed01f2877356c9781b1bd7d3270552a97b5aab5de13c4fa3a78e3f50.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

Internet Connection Discovery

T1016.001

Processes:

PING.EXEcmd.execmd.exePING.EXE

pid	Process
4032	PING.EXE
972	cmd.exe
3000	cmd.exe
3200	PING.EXE

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

Wi-Fi Discovery

T1016.002

Processes:

netsh.execmd.exe

pid	Process
3028	netsh.exe
2324	cmd.exe

Kills process with taskkill 5 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	Process
1640	taskkill.exe
1320	taskkill.exe
2056	taskkill.exe
588	taskkill.exe
2720	taskkill.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

Processes:

PING.EXEPING.EXE

pid	Process
4032	PING.EXE
3200	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

Processes:

schtasks.exe

pid	Process
2700	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

67c0ad50ed01f2877356c9781b1bd7d3270552a97b5aab5de13c4fa3a78e3f50.exe

pid	Process
1448	67c0ad50ed01f2877356c9781b1bd7d3270552a97b5aab5de13c4fa3a78e3f50.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

67c0ad50ed01f2877356c9781b1bd7d3270552a97b5aab5de13c4fa3a78e3f50.exe

pid	Process
1448	67c0ad50ed01f2877356c9781b1bd7d3270552a97b5aab5de13c4fa3a78e3f50.exe

C:\Users\Admin\AppData\Local\Temp\67c0ad50ed01f2877356c9781b1bd7d3270552a97b5aab5de13c4fa3a78e3f50.exe
"C:\Users\Admin\AppData\Local\Temp\67c0ad50ed01f2877356c9781b1bd7d3270552a97b5aab5de13c4fa3a78e3f50.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:1448
- C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
  "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
  2⤵
  PID:2676
- - C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
    "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
    3⤵
    PID:2828
- - C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
    "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
    3⤵
    PID:2920
- - C:\Users\Admin\AppData\Local\Temp\1001698001\ded97e756d.exe
    "C:\Users\Admin\AppData\Local\Temp\1001698001\ded97e756d.exe"
    3⤵
    PID:2712
  - - C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
      "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
      4⤵
      PID:1044
    - - C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
        5⤵
        
        PID:2808
    - - C:\Users\Admin\AppData\Local\Temp\1000477001\Offnewhere.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000477001\Offnewhere.exe"
        5⤵
        
        PID:772
    - - C:\Users\Admin\AppData\Local\Temp\1000817001\splwow64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000817001\splwow64.exe"
        5⤵
        
        PID:1380
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy Beijing Beijing.bat & Beijing.bat
        6⤵
        
        PID:684
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        
        PID:1308
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa opssvc"
        7⤵
        
        PID:1536
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        
        PID:1552
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"
        7⤵
        
        PID:1708
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 197036
        7⤵
        
        PID:1160
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "CRAWFORDFILLEDVERIFYSCALE" Mtv
        7⤵
        
        PID:2960
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Twisted + ..\Molecular + ..\Sponsorship + ..\Various + ..\Witch + ..\Spirit + ..\See + ..\Fitting T
        7⤵
        
        PID:1848
        
        C:\Users\Admin\AppData\Local\Temp\197036\Jurisdiction.pif
        
        Jurisdiction.pif T
        7⤵
        
        PID:2972
        
        C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        7⤵
        
        PID:1364
    - - C:\Users\Admin\AppData\Local\Temp\1000828001\new_v8.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000828001\new_v8.exe"
        5⤵
        
        PID:1604
    - - C:\Users\Admin\AppData\Local\Temp\1000833001\6f97d839eb.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000833001\6f97d839eb.exe"
        5⤵
        
        PID:2856
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:4072
    - - C:\Users\Admin\AppData\Local\Temp\1000857001\c161707b92.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000857001\c161707b92.exe"
        5⤵
        
        PID:772
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\GOLD1234.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\GOLD1234.exe"
        5⤵
        
        PID:3000
      - C:\Users\Admin\AppData\Local\Temp\1000965001\GOLD1234.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\GOLD1234.exe"
        6⤵
        
        PID:1068
      - C:\Users\Admin\AppData\Local\Temp\1000965001\GOLD1234.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\GOLD1234.exe"
        6⤵
        
        PID:964
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 60
        6⤵
        Program crash
        
        PID:2376
    - - C:\Users\Admin\AppData\Local\Temp\1001096001\RDX123456.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1001096001\RDX123456.exe"
        5⤵
        
        PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\1001425001\shop.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1001425001\shop.exe"
        5⤵
        
        PID:2576
      - C:\Users\Admin\AppData\Local\Temp\1001425001\shop.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1001425001\shop.exe"
        6⤵
        
        PID:2172
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 52
        6⤵
        Program crash
        
        PID:2260
    - - C:\Users\Admin\AppData\Local\Temp\1001510001\v7wa24td.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1001510001\v7wa24td.exe"
        5⤵
        
        PID:2232
      - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]"
        6⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:2324
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:1088
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        7⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:3028
        
        C:\Windows\system32\findstr.exe
        
        findstr /R /C:"[ ]:[ ]"
        7⤵
        
        PID:292
      - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid | findstr "SSID BSSID Signal"
        6⤵
        
        PID:2872
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:1096
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show networks mode=bssid
        7⤵
        
        PID:764
        
        C:\Windows\system32\findstr.exe
        
        findstr "SSID BSSID Signal"
        7⤵
        
        PID:2140
    - - C:\Users\Admin\AppData\Local\Temp\1001521001\1755c2a29c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1001521001\1755c2a29c.exe"
        5⤵
        
        PID:2416
    - - C:\Users\Admin\AppData\Local\Temp\1001522001\d644160cd8.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1001522001\d644160cd8.exe"
        5⤵
        
        PID:1936
- - C:\Users\Admin\AppData\Local\Temp\1001735001\49b489310f.exe
    "C:\Users\Admin\AppData\Local\Temp\1001735001\49b489310f.exe"
    3⤵
    PID:2836
- - C:\Users\Admin\AppData\Local\Temp\1001776101\d72de4f118.exe
    "C:\Users\Admin\AppData\Local\Temp\1001776101\d72de4f118.exe"
    3⤵
    PID:560
- - C:\Users\Admin\AppData\Local\Temp\1003142001\FontCreator.exe
    "C:\Users\Admin\AppData\Local\Temp\1003142001\FontCreator.exe"
    3⤵
    PID:2140
  - - C:\Users\Admin\AppData\Local\Temp\is-7K5RL.tmp\FontCreator.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-7K5RL.tmp\FontCreator.tmp" /SL5="$E01D0,2820349,845824,C:\Users\Admin\AppData\Local\Temp\1003142001\FontCreator.exe"
      4⤵
      PID:920
    - - C:\Users\Admin\AppData\Local\Temp\1003142001\FontCreator.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1003142001\FontCreator.exe" /VERYSILENT
        5⤵
        
        PID:1180
      - C:\Users\Admin\AppData\Local\Temp\is-ONK7O.tmp\FontCreator.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-ONK7O.tmp\FontCreator.tmp" /SL5="$B0190,2820349,845824,C:\Users\Admin\AppData\Local\Temp\1003142001\FontCreator.exe" /VERYSILENT
        6⤵
        
        PID:2024
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH | find /I "wrsa.exe"
        7⤵
        
        PID:2172
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:672
        
        C:\Windows\system32\find.exe
        
        find /I "wrsa.exe"
        8⤵
        
        PID:2960
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe"
        7⤵
        
        PID:2528
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:1676
        
        C:\Windows\system32\find.exe
        
        find /I "opssvc.exe"
        8⤵
        
        PID:1884
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH | find /I "avastui.exe"
        7⤵
        
        PID:1880
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:2712
        
        C:\Windows\system32\find.exe
        
        find /I "avastui.exe"
        8⤵
        
        PID:3036
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH | find /I "avgui.exe"
        7⤵
        
        PID:2776
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:1976
        
        C:\Windows\system32\find.exe
        
        find /I "avgui.exe"
        8⤵
        
        PID:1964
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH | find /I "nswscsvc.exe"
        7⤵
        
        PID:2860
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:2716
        
        C:\Windows\system32\find.exe
        
        find /I "nswscsvc.exe"
        8⤵
        
        PID:1468
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH | find /I "sophoshealth.exe"
        7⤵
        
        PID:2404
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:2356
        
        C:\Windows\system32\find.exe
        
        find /I "sophoshealth.exe"
        8⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\hangbird\Updater.exe
        
        "C:\Users\Admin\AppData\Local\hangbird\\Updater.exe" "C:\Users\Admin\AppData\Local\hangbird\\caliculus.csv"
        7⤵
        
        PID:1564
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c ping -n 5 127.0.0.1 >nul && updater.exe C:\ProgramData\\lLQ9SV5h.a3x && del C:\ProgramData\\lLQ9SV5h.a3x
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:972
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 5 127.0.0.1
        9⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4032
        
        C:\Users\Admin\AppData\Local\hangbird\Updater.exe
        
        updater.exe C:\ProgramData\\lLQ9SV5h.a3x
        9⤵
        
        PID:1736
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        10⤵
        
        PID:1468
- - C:\Users\Admin\AppData\Local\Temp\1003143001\FontCreator.exe
    "C:\Users\Admin\AppData\Local\Temp\1003143001\FontCreator.exe"
    3⤵
    PID:2812
  - - C:\Users\Admin\AppData\Local\Temp\is-ERKTR.tmp\FontCreator.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-ERKTR.tmp\FontCreator.tmp" /SL5="$5017E,2820349,845824,C:\Users\Admin\AppData\Local\Temp\1003143001\FontCreator.exe"
      4⤵
      PID:2204
    - - C:\Users\Admin\AppData\Local\Temp\1003143001\FontCreator.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1003143001\FontCreator.exe" /VERYSILENT
        5⤵
        
        PID:2892
      - C:\Users\Admin\AppData\Local\Temp\is-IAD5N.tmp\FontCreator.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-IAD5N.tmp\FontCreator.tmp" /SL5="$701DE,2820349,845824,C:\Users\Admin\AppData\Local\Temp\1003143001\FontCreator.exe" /VERYSILENT
        6⤵
        
        PID:2004
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH | find /I "wrsa.exe"
        7⤵
        
        PID:1724
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:2204
        
        C:\Windows\system32\find.exe
        
        find /I "wrsa.exe"
        8⤵
        
        PID:3028
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe"
        7⤵
        
        PID:1368
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:1452
        
        C:\Windows\system32\find.exe
        
        find /I "opssvc.exe"
        8⤵
        
        PID:2108
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH | find /I "avastui.exe"
        7⤵
        
        PID:2104
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:820
        
        C:\Windows\system32\find.exe
        
        find /I "avastui.exe"
        8⤵
        
        PID:960
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH | find /I "avgui.exe"
        7⤵
        
        PID:764
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:892
        
        C:\Windows\system32\find.exe
        
        find /I "avgui.exe"
        8⤵
        
        PID:1760
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH | find /I "nswscsvc.exe"
        7⤵
        
        PID:2852
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:1628
        
        C:\Windows\system32\find.exe
        
        find /I "nswscsvc.exe"
        8⤵
        
        PID:1720
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH | find /I "sophoshealth.exe"
        7⤵
        
        PID:920
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
        8⤵
        Enumerates processes with tasklist
        
        PID:888
        
        C:\Windows\system32\find.exe
        
        find /I "sophoshealth.exe"
        8⤵
        
        PID:624
        
        C:\Users\Admin\AppData\Local\hangbird\Updater.exe
        
        "C:\Users\Admin\AppData\Local\hangbird\\Updater.exe" "C:\Users\Admin\AppData\Local\hangbird\\caliculus.csv"
        7⤵
        
        PID:1656
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c ping -n 5 127.0.0.1 >nul && updater.exe C:\ProgramData\\kvkANFkWc.a3x && del C:\ProgramData\\kvkANFkWc.a3x
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:3000
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 5 127.0.0.1
        9⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\hangbird\Updater.exe
        
        updater.exe C:\ProgramData\\kvkANFkWc.a3x
        9⤵
        
        PID:1060
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        10⤵
        
        PID:3484
- - C:\Users\Admin\AppData\Local\Temp\1003176001\giganticurtain.exe
    "C:\Users\Admin\AppData\Local\Temp\1003176001\giganticurtain.exe"
    3⤵
    PID:2820
- - C:\Users\Admin\AppData\Local\Temp\1003185001\aa9ec2a4a8.exe
    "C:\Users\Admin\AppData\Local\Temp\1003185001\aa9ec2a4a8.exe"
    3⤵
    PID:840
- - C:\Users\Admin\AppData\Local\Temp\1003186001\00e3407770.exe
    "C:\Users\Admin\AppData\Local\Temp\1003186001\00e3407770.exe"
    3⤵
    PID:2240
- - C:\Users\Admin\AppData\Local\Temp\1003187001\d644160cd8.exe
    "C:\Users\Admin\AppData\Local\Temp\1003187001\d644160cd8.exe"
    3⤵
    PID:972
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM firefox.exe /T
      4⤵
      Kills process with taskkill
      PID:1640
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM chrome.exe /T
      4⤵
      Kills process with taskkill
      PID:1320
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM msedge.exe /T
      4⤵
      Kills process with taskkill
      PID:2056
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM opera.exe /T
      4⤵
      Kills process with taskkill
      PID:588
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM brave.exe /T
      4⤵
      Kills process with taskkill
      PID:2720
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
      4⤵
      PID:2156
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        5⤵
        
        PID:3020
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3020.0.718388602\1734467904" -parentBuildID 20221007134813 -prefsHandle 1236 -prefMapHandle 1212 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {df33b5d8-0579-431b-aa0f-a6616ad08946} 3020 "\\.\pipe\gecko-crash-server-pipe.3020" 1300 10aee758 gpu
        6⤵
        
        PID:1992
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3020.1.1432990157\472340263" -parentBuildID 20221007134813 -prefsHandle 1492 -prefMapHandle 1488 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {40b2cc9d-d3fc-48ec-88de-cb8509c095d5} 3020 "\\.\pipe\gecko-crash-server-pipe.3020" 1504 f8e2e58 socket
        6⤵
        
        PID:2248
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3020.2.339802401\1154604493" -childID 1 -isForBrowser -prefsHandle 2008 -prefMapHandle 2004 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 640 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {351e739c-e0ac-45cb-8ca4-bcbc109c3198} 3020 "\\.\pipe\gecko-crash-server-pipe.3020" 2020 10a64858 tab
        6⤵
        
        PID:3188
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3020.3.1835556565\405795759" -childID 2 -isForBrowser -prefsHandle 2768 -prefMapHandle 2764 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 640 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1005b167-22ac-4c3e-9a5b-d9504b9d0f39} 3020 "\\.\pipe\gecko-crash-server-pipe.3020" 2780 1ccb8158 tab
        6⤵
        
        PID:3596
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3020.4.1564049600\1906785541" -childID 3 -isForBrowser -prefsHandle 3788 -prefMapHandle 3768 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 640 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dd0e83a2-7698-4930-ae7d-ba8ac3416665} 3020 "\\.\pipe\gecko-crash-server-pipe.3020" 3536 20678e58 tab
        6⤵
        
        PID:3464
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3020.5.902369106\357156867" -childID 4 -isForBrowser -prefsHandle 3900 -prefMapHandle 3904 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 640 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {db2007fe-d382-4f1c-81b2-3e2d1d0b94b5} 3020 "\\.\pipe\gecko-crash-server-pipe.3020" 3888 20678558 tab
        6⤵
        
        PID:3476
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3020.6.1989878754\1123673200" -childID 5 -isForBrowser -prefsHandle 4064 -prefMapHandle 4068 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 640 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e2389629-064f-489c-a1bf-45a4f8c90386} 3020 "\\.\pipe\gecko-crash-server-pipe.3020" 4052 20679458 tab
        6⤵
        
        PID:3608
- - C:\Users\Admin\AppData\Local\Temp\1003188001\num.exe
    "C:\Users\Admin\AppData\Local\Temp\1003188001\num.exe"
    3⤵
    PID:3420

C:\Windows\SysWOW64\cmd.exe
cmd /c schtasks.exe /create /tn "Wall" /tr "wscript //B 'C:\Users\Admin\AppData\Local\GreenTech Dynamics\EcoCraft.js'" /sc minute /mo 5 /F
1⤵
PID:2772
- C:\Windows\SysWOW64\schtasks.exe
  schtasks.exe /create /tn "Wall" /tr "wscript //B 'C:\Users\Admin\AppData\Local\GreenTech Dynamics\EcoCraft.js'" /sc minute /mo 5 /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2700

C:\Windows\SysWOW64\cmd.exe
cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EcoCraft.url" & echo URL="C:\Users\Admin\AppData\Local\GreenTech Dynamics\EcoCraft.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EcoCraft.url" & exit
1⤵
PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Virtualization/Sandbox Evasion