Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
05/11/2024, 20:48
Static task
static1
General
-
Target
04c18f3e5a5fb35a1f7af50293f2abf787658ed10f30deaf3198b1c2d5546035.exe
-
Size
5.5MB
-
MD5
6346a84057e1475430792d4cf71fe69e
-
SHA1
8254b2484ec21ba3a1207349d8f46561cc43f281
-
SHA256
04c18f3e5a5fb35a1f7af50293f2abf787658ed10f30deaf3198b1c2d5546035
-
SHA512
03baa6a5771a3aaeb0a2f0eb03ba5e9c94d187613b907cd21b2e59f12eee9651f9e31d78d4784c9984b7cbe564e4ccc291078154cd871e4c3caf8f6097f4f993
-
SSDEEP
98304:5uqTOeE+Rt16PcNxsEPkUUBcGZktu5hECLLtijojjFC0oe3Pa1H9UkSV4:5NTHRt160NiEPkpBcWFLwjIFpV6UkSm
Malware Config
Extracted
stealc
tale
http://185.215.113.206
-
url_path
/6c4adf523b719729.php
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
lumma
https://founpiuer.store/api
Signatures
-
Amadey family
-
Lumma family
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection ec5201bef4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" ec5201bef4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" ec5201bef4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" ec5201bef4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" ec5201bef4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" ec5201bef4.exe -
Stealc family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 3G88f.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ b26a6da3e1.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 2h6164.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 4Z126r.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ cf827575e9.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ec5201bef4.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe -
Downloads MZ/PE file
-
Uses browser remote debugging 2 TTPs 4 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
pid Process 2184 chrome.exe 3432 chrome.exe 4004 chrome.exe 1664 chrome.exe -
Checks BIOS information in registry 2 TTPs 18 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 2h6164.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion b26a6da3e1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion b26a6da3e1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2h6164.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 3G88f.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 3G88f.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 4Z126r.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 4Z126r.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion cf827575e9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ec5201bef4.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion cf827575e9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ec5201bef4.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation 4Z126r.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation skotes.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation Set-up.exe -
Executes dropped EXE 13 IoCs
pid Process 4140 t3H86.exe 3296 2h6164.exe 3588 3G88f.exe 4820 4Z126r.exe 1520 skotes.exe 2524 Set-up.exe 2236 b26a6da3e1.exe 2456 cf827575e9.exe 4436 ec5201bef4.exe 3112 skotes.exe 4708 service123.exe 3760 skotes.exe 3864 service123.exe -
Identifies Wine through registry keys 2 TTPs 9 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine cf827575e9.exe Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine ec5201bef4.exe Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine 2h6164.exe Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine b26a6da3e1.exe Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine 3G88f.exe Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine 4Z126r.exe -
Loads dropped DLL 2 IoCs
pid Process 4708 service123.exe 3864 service123.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features ec5201bef4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" ec5201bef4.exe -
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cf827575e9.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1004204001\\cf827575e9.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ec5201bef4.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1004206001\\ec5201bef4.exe" skotes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 04c18f3e5a5fb35a1f7af50293f2abf787658ed10f30deaf3198b1c2d5546035.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" t3H86.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b26a6da3e1.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1004203001\\b26a6da3e1.exe" skotes.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
pid Process 3296 2h6164.exe 3588 3G88f.exe 4820 4Z126r.exe 1520 skotes.exe 2236 b26a6da3e1.exe 2456 cf827575e9.exe 4436 ec5201bef4.exe 3112 skotes.exe 3760 skotes.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job 4Z126r.exe -
Embeds OpenSSL 1 IoCs
Embeds OpenSSL, may be used to circumvent TLS interception.
resource yara_rule behavioral1/files/0x0008000000023bfe-49.dat embeds_openssl -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 5 IoCs
pid pid_target Process procid_target 4032 3296 WerFault.exe 88 4592 3296 WerFault.exe 88 2036 2236 WerFault.exe 107 2680 2236 WerFault.exe 107 2272 2524 WerFault.exe 106 -
System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Set-up.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b26a6da3e1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cf827575e9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 04c18f3e5a5fb35a1f7af50293f2abf787658ed10f30deaf3198b1c2d5546035.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language t3H86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3G88f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4Z126r.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ec5201bef4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language service123.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2h6164.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Set-up.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Set-up.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2520 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 3296 2h6164.exe 3296 2h6164.exe 3588 3G88f.exe 3588 3G88f.exe 4820 4Z126r.exe 4820 4Z126r.exe 1520 skotes.exe 1520 skotes.exe 2236 b26a6da3e1.exe 2236 b26a6da3e1.exe 2456 cf827575e9.exe 2456 cf827575e9.exe 4436 ec5201bef4.exe 4436 ec5201bef4.exe 4436 ec5201bef4.exe 4436 ec5201bef4.exe 4436 ec5201bef4.exe 2184 chrome.exe 2184 chrome.exe 3112 skotes.exe 3112 skotes.exe 3760 skotes.exe 3760 skotes.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 2184 chrome.exe 2184 chrome.exe 2184 chrome.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4436 ec5201bef4.exe Token: SeShutdownPrivilege 2184 chrome.exe Token: SeCreatePagefilePrivilege 2184 chrome.exe Token: SeShutdownPrivilege 2184 chrome.exe Token: SeCreatePagefilePrivilege 2184 chrome.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
pid Process 4820 4Z126r.exe 2184 chrome.exe 2184 chrome.exe 2184 chrome.exe 2184 chrome.exe 2184 chrome.exe 2184 chrome.exe 2184 chrome.exe 2184 chrome.exe 2184 chrome.exe 2184 chrome.exe 2184 chrome.exe 2184 chrome.exe 2184 chrome.exe 2184 chrome.exe 2184 chrome.exe 2184 chrome.exe 2184 chrome.exe 2184 chrome.exe 2184 chrome.exe 2184 chrome.exe 2184 chrome.exe 2184 chrome.exe 2184 chrome.exe 2184 chrome.exe 2184 chrome.exe 2184 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4420 wrote to memory of 4140 4420 04c18f3e5a5fb35a1f7af50293f2abf787658ed10f30deaf3198b1c2d5546035.exe 84 PID 4420 wrote to memory of 4140 4420 04c18f3e5a5fb35a1f7af50293f2abf787658ed10f30deaf3198b1c2d5546035.exe 84 PID 4420 wrote to memory of 4140 4420 04c18f3e5a5fb35a1f7af50293f2abf787658ed10f30deaf3198b1c2d5546035.exe 84 PID 4140 wrote to memory of 3296 4140 t3H86.exe 88 PID 4140 wrote to memory of 3296 4140 t3H86.exe 88 PID 4140 wrote to memory of 3296 4140 t3H86.exe 88 PID 4140 wrote to memory of 3588 4140 t3H86.exe 100 PID 4140 wrote to memory of 3588 4140 t3H86.exe 100 PID 4140 wrote to memory of 3588 4140 t3H86.exe 100 PID 4420 wrote to memory of 4820 4420 04c18f3e5a5fb35a1f7af50293f2abf787658ed10f30deaf3198b1c2d5546035.exe 101 PID 4420 wrote to memory of 4820 4420 04c18f3e5a5fb35a1f7af50293f2abf787658ed10f30deaf3198b1c2d5546035.exe 101 PID 4420 wrote to memory of 4820 4420 04c18f3e5a5fb35a1f7af50293f2abf787658ed10f30deaf3198b1c2d5546035.exe 101 PID 4820 wrote to memory of 1520 4820 4Z126r.exe 105 PID 4820 wrote to memory of 1520 4820 4Z126r.exe 105 PID 4820 wrote to memory of 1520 4820 4Z126r.exe 105 PID 1520 wrote to memory of 2524 1520 skotes.exe 106 PID 1520 wrote to memory of 2524 1520 skotes.exe 106 PID 1520 wrote to memory of 2524 1520 skotes.exe 106 PID 1520 wrote to memory of 2236 1520 skotes.exe 107 PID 1520 wrote to memory of 2236 1520 skotes.exe 107 PID 1520 wrote to memory of 2236 1520 skotes.exe 107 PID 1520 wrote to memory of 2456 1520 skotes.exe 113 PID 1520 wrote to memory of 2456 1520 skotes.exe 113 PID 1520 wrote to memory of 2456 1520 skotes.exe 113 PID 1520 wrote to memory of 1804 1520 skotes.exe 116 PID 1520 wrote to memory of 1804 1520 skotes.exe 116 PID 1520 wrote to memory of 1804 1520 skotes.exe 116 PID 1520 wrote to memory of 4436 1520 skotes.exe 119 PID 1520 wrote to memory of 4436 1520 skotes.exe 119 PID 1520 wrote to memory of 4436 1520 skotes.exe 119 PID 2524 wrote to memory of 2184 2524 Set-up.exe 120 PID 2524 wrote to memory of 2184 2524 Set-up.exe 120 PID 2184 wrote to memory of 3296 2184 chrome.exe 121 PID 2184 wrote to memory of 3296 2184 chrome.exe 121 PID 2184 wrote to memory of 220 2184 chrome.exe 122 PID 2184 wrote to memory of 220 2184 chrome.exe 122 PID 2184 wrote to memory of 220 2184 chrome.exe 122 PID 2184 wrote to memory of 220 2184 chrome.exe 122 PID 2184 wrote to memory of 220 2184 chrome.exe 122 PID 2184 wrote to memory of 220 2184 chrome.exe 122 PID 2184 wrote to memory of 220 2184 chrome.exe 122 PID 2184 wrote to memory of 220 2184 chrome.exe 122 PID 2184 wrote to memory of 220 2184 chrome.exe 122 PID 2184 wrote to memory of 220 2184 chrome.exe 122 PID 2184 wrote to memory of 220 2184 chrome.exe 122 PID 2184 wrote to memory of 220 2184 chrome.exe 122 PID 2184 wrote to memory of 220 2184 chrome.exe 122 PID 2184 wrote to memory of 220 2184 chrome.exe 122 PID 2184 wrote to memory of 220 2184 chrome.exe 122 PID 2184 wrote to memory of 220 2184 chrome.exe 122 PID 2184 wrote to memory of 220 2184 chrome.exe 122 PID 2184 wrote to memory of 220 2184 chrome.exe 122 PID 2184 wrote to memory of 220 2184 chrome.exe 122 PID 2184 wrote to memory of 220 2184 chrome.exe 122 PID 2184 wrote to memory of 220 2184 chrome.exe 122 PID 2184 wrote to memory of 220 2184 chrome.exe 122 PID 2184 wrote to memory of 220 2184 chrome.exe 122 PID 2184 wrote to memory of 220 2184 chrome.exe 122 PID 2184 wrote to memory of 220 2184 chrome.exe 122 PID 2184 wrote to memory of 220 2184 chrome.exe 122 PID 2184 wrote to memory of 220 2184 chrome.exe 122 PID 2184 wrote to memory of 220 2184 chrome.exe 122 PID 2184 wrote to memory of 220 2184 chrome.exe 122 PID 2184 wrote to memory of 220 2184 chrome.exe 122
Processes
-
C:\Users\Admin\AppData\Local\Temp\04c18f3e5a5fb35a1f7af50293f2abf787658ed10f30deaf3198b1c2d5546035.exe"C:\Users\Admin\AppData\Local\Temp\04c18f3e5a5fb35a1f7af50293f2abf787658ed10f30deaf3198b1c2d5546035.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t3H86.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t3H86.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2h6164.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2h6164.exe3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3296 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3296 -s 16284⤵
- Program crash
PID:4032
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3296 -s 16084⤵
- Program crash
PID:4592
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3G88f.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3G88f.exe3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3588
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4Z126r.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4Z126r.exe2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\1004198001\Set-up.exe"C:\Users\Admin\AppData\Local\Temp\1004198001\Set-up.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"5⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffa90eacc40,0x7ffa90eacc4c,0x7ffa90eacc586⤵PID:3296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1912,i,17080000695405429882,4720796313218266511,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1900 /prefetch:26⤵PID:220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2132,i,17080000695405429882,4720796313218266511,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2196 /prefetch:36⤵PID:3228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2232,i,17080000695405429882,4720796313218266511,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2428 /prefetch:86⤵PID:3820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3220,i,17080000695405429882,4720796313218266511,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3236 /prefetch:16⤵
- Uses browser remote debugging
PID:3432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3472,i,17080000695405429882,4720796313218266511,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3484 /prefetch:16⤵
- Uses browser remote debugging
PID:4004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4472,i,17080000695405429882,4720796313218266511,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4504 /prefetch:16⤵
- Uses browser remote debugging
PID:1664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4276,i,17080000695405429882,4720796313218266511,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4272 /prefetch:86⤵PID:1180
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3680,i,17080000695405429882,4720796313218266511,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4960 /prefetch:86⤵PID:452
-
-
-
C:\Users\Admin\AppData\Local\Temp\service123.exe"C:\Users\Admin\AppData\Local\Temp\service123.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4708
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2520
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 11645⤵
- Program crash
PID:2272
-
-
-
C:\Users\Admin\AppData\Local\Temp\1004203001\b26a6da3e1.exe"C:\Users\Admin\AppData\Local\Temp\1004203001\b26a6da3e1.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2236 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 15685⤵
- Program crash
PID:2036
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 15525⤵
- Program crash
PID:2680
-
-
-
C:\Users\Admin\AppData\Local\Temp\1004204001\cf827575e9.exe"C:\Users\Admin\AppData\Local\Temp\1004204001\cf827575e9.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2456
-
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"4⤵PID:1804
-
-
C:\Users\Admin\AppData\Local\Temp\1004206001\ec5201bef4.exe"C:\Users\Admin\AppData\Local\Temp\1004206001\ec5201bef4.exe"4⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4436
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3296 -ip 32961⤵PID:2524
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 3296 -ip 32961⤵PID:3312
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2236 -ip 22361⤵PID:2244
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 2236 -ip 22361⤵PID:3044
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3112
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2524 -ip 25241⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3760
-
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3864
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Modify Authentication Process
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Authentication Process
1Modify Registry
3Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
6.9MB
MD55a4bac60b4b5c2889a19197e077f0916
SHA111e3e2903c663477505f2f92dde1a09c9433c1e4
SHA256a175dbaa581c7064effea9150163c84d5e6e12f975103c31dc13caeb85b62e47
SHA5122cd7c793202c8779e8b4cf358d9c621589037ab99a7330353bfd346a4106b72702e61d8b115a97d4b0c9da5744c447c3ca4422fd2468fd38703d18c8d133ffce
-
Filesize
3.0MB
MD5a8a772f1f0079343361cb7a043b09231
SHA1efa3d18b687074c2019ef23d9f9fd6e7496ea80d
SHA2563205288e45b25713f57a8aa1d40ef0329e7dc5cd0b490a6a0f0d929bfebf440b
SHA512cfe2cf8c1293007efbf2d7b5dedbfbb7f412e51f3a70cc32bfaf59155ccc53d37241bc55fbe3b5cd77b57d6391d1ae5cda093dcfba4210b230fb3ddfd9f3fcf1
-
Filesize
2.0MB
MD5a32b06941c36f3d4b09a2797c2d5fc08
SHA13931aa08f0986a8e6a61bb3652aa650789799eec
SHA256d779abd2ed475c8cd4ec720d19d8330f2871ca537c8d7a045bab0bfcea622846
SHA51260517883a43c48377249ca62ce3dfa6edeaa0696dfcc2d2e3e48daa5c2dcfc595b663233ff886f1d522533b384f8c01524229126edbf0f16b35eff2422de5fec
-
Filesize
2.6MB
MD59371abacbd7ae965a9f2e595357f54a6
SHA1f3e2b9d56bf7aa3e4986aeca5dc7fe868cf1e379
SHA25622890a496bc2095497b65fa5f4eee5e6ca68a1545fd58eeb1bd8f4cc709d6dbf
SHA512d053966b086b42da4ca1fad756544892e3a35a7f3eb35e461ab57289fd163986f808276d290ac136be6ddc4c631c6ba7ab83315358c8b6643c55d6d854c7f838
-
Filesize
3.1MB
MD5b4f2aa92d1d6d190be76e7ddb2af5435
SHA1f758b1cd6c58f53ec6680cefab4c86b82466cc55
SHA256508b3b9eeae0b67042ce0ab22785fadbbb0917131f8dc2f3a9ac5e41c81eb2bf
SHA5128144764cbb650941e0cef922a6325ec686ef955b524a631a56618a40b8e42e4bd1cb93e7a59d49757733b092a52d197bc3b3eafe6aa0e88fc26efa35f46294ef
-
Filesize
3.7MB
MD537fcd255298ed9e4eba09e093292a44a
SHA1cbf13bd8373431f6f6469ed9f49947ce7b8297da
SHA2567e297f5296e1d1dcd4cf833571b7effec12a393022fcbf8dd4c4956fd19db25c
SHA512e549c29639c70aa8c23c6f96f67125b31e49ed2f9c3c67c6551f939f77a8b05dd7a69d3ba8885f0a61d5ce1572b2b1018b6402f9259e52adc412fbd23fdb20b6
-
Filesize
3.0MB
MD56a811d032fe3feb1d20c7d531b430c70
SHA1b9f31f21dbeb13356fc216c6ad20f4a016672807
SHA256dcd5ab5063f5498fb2dd077bfa2490f046cf91ff5c7fde3ddcee2faef087ca6f
SHA51220d03a25c9beda734d39e8eaf170636cb1d66361705dc63a46bac9e926af8ae7003247e6c6aba11989b094fa6dc75074be095dec1139379a97585cf96d802db8
-
Filesize
2.0MB
MD52093c6e52262aba12a530a15eb025af1
SHA12f8bca8aca4d50acd3607c70da2350aa5c12f0f7
SHA2569d15aefd953e3b02812f0fd4f5e1e84356bc28a7ec904c0398581b97b1b96d82
SHA5121d0f0179ab4fd31c31ceff57bfce5d2c8918f7633990e2d010173b6fa0b1ee1f4c2f75be96b0a29a97d9c60518287dd669df7166ffa0767ce1d61f5491fb24d9