Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2024, 02:21
Static task
static1
Behavioral task
behavioral1
Sample
44468177822195c3b86c797d050d3752a158218f91f236a8ee8ed027a48ad236.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
44468177822195c3b86c797d050d3752a158218f91f236a8ee8ed027a48ad236.exe
Resource
win10v2004-20241007-en
General
-
Target
44468177822195c3b86c797d050d3752a158218f91f236a8ee8ed027a48ad236.exe
-
Size
3.1MB
-
MD5
bcbe71a530c6211a1bd93c7b3226876c
-
SHA1
cfe3d8fd44282ccdd7c67d96c03380df4013a49d
-
SHA256
44468177822195c3b86c797d050d3752a158218f91f236a8ee8ed027a48ad236
-
SHA512
bd0f421538e71443b4d0165ab432d7056114dcfdb61aea9b2ee191910a88ed7e22adaf54e748814cdd5604c5dcf59e70bd849beace2b913488cf5aa95e48e537
-
SSDEEP
49152:9T+Vp5sijVLio12jGnbXS2sEbFMtz76vxvSi5HIV+:B+Vp+ijVLioSGnbiJEbszShSi5oV+
Malware Config
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
stealc
tale
http://185.215.113.206
-
url_path
/6c4adf523b719729.php
Extracted
lumma
https://founpiuer.store/api
Signatures
-
Amadey family
-
Lumma family
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection 72d5f8e468.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 72d5f8e468.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 72d5f8e468.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 72d5f8e468.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 72d5f8e468.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 72d5f8e468.exe -
Stealc family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 72d5f8e468.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 44468177822195c3b86c797d050d3752a158218f91f236a8ee8ed027a48ad236.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 65f9d4e8e0.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ a472c331d4.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 16 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion a472c331d4.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 65f9d4e8e0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 44468177822195c3b86c797d050d3752a158218f91f236a8ee8ed027a48ad236.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion a472c331d4.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 72d5f8e468.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 72d5f8e468.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 44468177822195c3b86c797d050d3752a158218f91f236a8ee8ed027a48ad236.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 65f9d4e8e0.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation 44468177822195c3b86c797d050d3752a158218f91f236a8ee8ed027a48ad236.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation skotes.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation buildd.exe -
Executes dropped EXE 8 IoCs
pid Process 4240 skotes.exe 3720 buildd.exe 348 65f9d4e8e0.exe 3276 a472c331d4.exe 2168 72d5f8e468.exe 2496 skotes.exe 2252 skotes.exe 456 skotes.exe -
Identifies Wine through registry keys 2 TTPs 8 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Wine 65f9d4e8e0.exe Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Wine a472c331d4.exe Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Wine 72d5f8e468.exe Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Wine 44468177822195c3b86c797d050d3752a158218f91f236a8ee8ed027a48ad236.exe Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Wine skotes.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 72d5f8e468.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 72d5f8e468.exe -
Accesses Microsoft Outlook profiles 1 TTPs 9 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 buildd.exe Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 buildd.exe Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 buildd.exe Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 buildd.exe Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 buildd.exe Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 buildd.exe Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 buildd.exe Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 buildd.exe Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 buildd.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\65f9d4e8e0.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1004507001\\65f9d4e8e0.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a472c331d4.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1004508001\\a472c331d4.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\72d5f8e468.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1004510001\\72d5f8e468.exe" skotes.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 19 ip-api.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
pid Process 3132 44468177822195c3b86c797d050d3752a158218f91f236a8ee8ed027a48ad236.exe 4240 skotes.exe 348 65f9d4e8e0.exe 3276 a472c331d4.exe 2168 72d5f8e468.exe 2496 skotes.exe 2252 skotes.exe 456 skotes.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job 44468177822195c3b86c797d050d3752a158218f91f236a8ee8ed027a48ad236.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4060 348 WerFault.exe 115 -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65f9d4e8e0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a472c331d4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72d5f8e468.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44468177822195c3b86c797d050d3752a158218f91f236a8ee8ed027a48ad236.exe -
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 2244 cmd.exe 5072 netsh.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 3136 timeout.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 3132 44468177822195c3b86c797d050d3752a158218f91f236a8ee8ed027a48ad236.exe 3132 44468177822195c3b86c797d050d3752a158218f91f236a8ee8ed027a48ad236.exe 4240 skotes.exe 4240 skotes.exe 3720 buildd.exe 3720 buildd.exe 3720 buildd.exe 3720 buildd.exe 3720 buildd.exe 348 65f9d4e8e0.exe 348 65f9d4e8e0.exe 3276 a472c331d4.exe 3276 a472c331d4.exe 2168 72d5f8e468.exe 2168 72d5f8e468.exe 2168 72d5f8e468.exe 2168 72d5f8e468.exe 2496 skotes.exe 2496 skotes.exe 2252 skotes.exe 2252 skotes.exe 456 skotes.exe 456 skotes.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeDebugPrivilege 3720 buildd.exe Token: SeAssignPrimaryTokenPrivilege 3720 buildd.exe Token: SeIncreaseQuotaPrivilege 3720 buildd.exe Token: SeSecurityPrivilege 3720 buildd.exe Token: SeTakeOwnershipPrivilege 3720 buildd.exe Token: SeLoadDriverPrivilege 3720 buildd.exe Token: SeSystemtimePrivilege 3720 buildd.exe Token: SeBackupPrivilege 3720 buildd.exe Token: SeRestorePrivilege 3720 buildd.exe Token: SeShutdownPrivilege 3720 buildd.exe Token: SeSystemEnvironmentPrivilege 3720 buildd.exe Token: SeUndockPrivilege 3720 buildd.exe Token: SeManageVolumePrivilege 3720 buildd.exe Token: 31 3720 buildd.exe Token: 32 3720 buildd.exe Token: SeDebugPrivilege 2168 72d5f8e468.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3132 44468177822195c3b86c797d050d3752a158218f91f236a8ee8ed027a48ad236.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 3132 wrote to memory of 4240 3132 44468177822195c3b86c797d050d3752a158218f91f236a8ee8ed027a48ad236.exe 86 PID 3132 wrote to memory of 4240 3132 44468177822195c3b86c797d050d3752a158218f91f236a8ee8ed027a48ad236.exe 86 PID 3132 wrote to memory of 4240 3132 44468177822195c3b86c797d050d3752a158218f91f236a8ee8ed027a48ad236.exe 86 PID 4240 wrote to memory of 3720 4240 skotes.exe 94 PID 4240 wrote to memory of 3720 4240 skotes.exe 94 PID 3720 wrote to memory of 2244 3720 buildd.exe 95 PID 3720 wrote to memory of 2244 3720 buildd.exe 95 PID 2244 wrote to memory of 3276 2244 cmd.exe 97 PID 2244 wrote to memory of 3276 2244 cmd.exe 97 PID 2244 wrote to memory of 5072 2244 cmd.exe 98 PID 2244 wrote to memory of 5072 2244 cmd.exe 98 PID 2244 wrote to memory of 3272 2244 cmd.exe 99 PID 2244 wrote to memory of 3272 2244 cmd.exe 99 PID 3720 wrote to memory of 2756 3720 buildd.exe 100 PID 3720 wrote to memory of 2756 3720 buildd.exe 100 PID 2756 wrote to memory of 2724 2756 cmd.exe 102 PID 2756 wrote to memory of 2724 2756 cmd.exe 102 PID 2756 wrote to memory of 2692 2756 cmd.exe 103 PID 2756 wrote to memory of 2692 2756 cmd.exe 103 PID 2756 wrote to memory of 3184 2756 cmd.exe 104 PID 2756 wrote to memory of 3184 2756 cmd.exe 104 PID 3720 wrote to memory of 4480 3720 buildd.exe 108 PID 3720 wrote to memory of 4480 3720 buildd.exe 108 PID 4480 wrote to memory of 1188 4480 cmd.exe 111 PID 4480 wrote to memory of 1188 4480 cmd.exe 111 PID 4480 wrote to memory of 3136 4480 cmd.exe 113 PID 4480 wrote to memory of 3136 4480 cmd.exe 113 PID 4240 wrote to memory of 348 4240 skotes.exe 115 PID 4240 wrote to memory of 348 4240 skotes.exe 115 PID 4240 wrote to memory of 348 4240 skotes.exe 115 PID 4240 wrote to memory of 3276 4240 skotes.exe 122 PID 4240 wrote to memory of 3276 4240 skotes.exe 122 PID 4240 wrote to memory of 3276 4240 skotes.exe 122 PID 4240 wrote to memory of 1708 4240 skotes.exe 123 PID 4240 wrote to memory of 1708 4240 skotes.exe 123 PID 4240 wrote to memory of 1708 4240 skotes.exe 123 PID 4240 wrote to memory of 2168 4240 skotes.exe 124 PID 4240 wrote to memory of 2168 4240 skotes.exe 124 PID 4240 wrote to memory of 2168 4240 skotes.exe 124 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 buildd.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 buildd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\44468177822195c3b86c797d050d3752a158218f91f236a8ee8ed027a48ad236.exe"C:\Users\Admin\AppData\Local\Temp\44468177822195c3b86c797d050d3752a158218f91f236a8ee8ed027a48ad236.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\1004506001\buildd.exe"C:\Users\Admin\AppData\Local\Temp\1004506001\buildd.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:3720 -
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]"4⤵
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\system32\chcp.comchcp 650015⤵PID:3276
-
-
C:\Windows\system32\netsh.exenetsh wlan show profiles5⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:5072
-
-
C:\Windows\system32\findstr.exefindstr /R /C:"[ ]:[ ]"5⤵PID:3272
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid | findstr "SSID BSSID Signal"4⤵
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\system32\chcp.comchcp 650015⤵PID:2724
-
-
C:\Windows\system32\netsh.exenetsh wlan show networks mode=bssid5⤵
- Event Triggered Execution: Netsh Helper DLL
PID:2692
-
-
C:\Windows\system32\findstr.exefindstr "SSID BSSID Signal"5⤵PID:3184
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C chcp 65001 && timeout /t 3 > NUL && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\1004506001\buildd.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Windows\system32\chcp.comchcp 650015⤵PID:1188
-
-
C:\Windows\system32\timeout.exetimeout /t 35⤵
- Delays execution with timeout.exe
PID:3136
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1004507001\65f9d4e8e0.exe"C:\Users\Admin\AppData\Local\Temp\1004507001\65f9d4e8e0.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:348 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 14724⤵
- Program crash
PID:4060
-
-
-
C:\Users\Admin\AppData\Local\Temp\1004508001\a472c331d4.exe"C:\Users\Admin\AppData\Local\Temp\1004508001\a472c331d4.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3276
-
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"3⤵PID:1708
-
-
C:\Users\Admin\AppData\Local\Temp\1004510001\72d5f8e468.exe"C:\Users\Admin\AppData\Local\Temp\1004510001\72d5f8e468.exe"3⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2168
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 348 -ip 3481⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2496
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2252
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:456
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Registry
3Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
1Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
154KB
MD5c426f46f2c074eda8c903f9868be046d
SHA1d0352482370beff107eb2b2f13e2de275fbc91c7
SHA2567cba781d569196e89a86f10cee7d69918fe05df1461d1f0ed3426ccb2046002e
SHA51297eed1bad31bd2e558d2cf6ff3c3026d828f561e2d1439f0daca420f53a3c6b1d59442f043357be9a33761a8e99ac935d08239d2e50811d47909cec8caad7c05
-
Filesize
3.0MB
MD58cf8b11e1553e2381b0c2376d013e951
SHA133d8bc52fe1fc709ee086a5a84d39024b6e2db92
SHA256d3ea3d360b4e4c6bc1da5adbd8c8bbe689b0541166e2a77dac821517be81de98
SHA512a876d770734998f8397efea36c94bf7b61d14aa317f4b9e62b95333171068b626ebe2336c6fefc3a0f02f16b454df5c852b9fe4cbb3af59fe1d11ae2f77303a4
-
Filesize
2.0MB
MD55c656fca21313b706060727ffe93f6bb
SHA1481b192814532355b6e2045091ee300f307349e8
SHA256bfcf6c46d64eb87be63df45a15ff9c2a89bd66af62942756ec4dbd45cdfe6ebd
SHA512a7035a9bfb230ed1621dfabcfa43ee07b62e95b82858f2cac1bdaba16c5654574f5af0f445082d5ba6695bc5734a8e0d99d05a810ba27344ec0fe709e20cd589
-
Filesize
2.7MB
MD56ae0b7949bfe36ae9e0f6fefa371c05c
SHA17094338f84ab379fb1b1312835d57580247f3d60
SHA2569cfb562cc0ed667b52264085f6b78f39fd1bc5c0336806070b63af19d52d80f3
SHA512c10026e4502e918735acc80905075864d36ebc0edaecfef95a5081b4d2d2808c1c18176656503263a17506be02997b05390f71c825097bc79ec9f7de26fd91b2
-
Filesize
3.1MB
MD5bcbe71a530c6211a1bd93c7b3226876c
SHA1cfe3d8fd44282ccdd7c67d96c03380df4013a49d
SHA25644468177822195c3b86c797d050d3752a158218f91f236a8ee8ed027a48ad236
SHA512bd0f421538e71443b4d0165ab432d7056114dcfdb61aea9b2ee191910a88ed7e22adaf54e748814cdd5604c5dcf59e70bd849beace2b913488cf5aa95e48e537