Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 02:14
Static task
static1
Behavioral task
behavioral1
Sample
d4417b23f8728ae97d162dcb9916ad36aac089a2dd684936884f013bd50f49edN.exe
Resource
win7-20241010-en
General
-
Target
d4417b23f8728ae97d162dcb9916ad36aac089a2dd684936884f013bd50f49edN.exe
-
Size
1.8MB
-
MD5
4264eccf5968410db0afcf14351fc8e0
-
SHA1
b0dcc6ccd68005534f9a7172c5d9e1d510d42de3
-
SHA256
d4417b23f8728ae97d162dcb9916ad36aac089a2dd684936884f013bd50f49ed
-
SHA512
2aa4dae701bd619e7d2befe3365faf671dfd1c458510603e5742baccc21ebb600f67d71e3181f76333401b5c581150b1420e9a7c9ead54ad8ad8f0e2fded7b0c
-
SSDEEP
49152:BOvzK7kxWcm+/SOsV1z5ujABwJmPZmWQMaROW8ywP:By+7cW6+kABwTXOd
Malware Config
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
stealc
tale
http://185.215.113.206
-
url_path
/6c4adf523b719729.php
Extracted
lumma
https://navygenerayk.store/api
Signatures
-
Amadey family
-
Lumma family
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection 3c8f27b17e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 3c8f27b17e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 3c8f27b17e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 3c8f27b17e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 3c8f27b17e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 3c8f27b17e.exe -
Stealc family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ c1d6557416.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 7e53c65cea.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 3c8f27b17e.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ d4417b23f8728ae97d162dcb9916ad36aac089a2dd684936884f013bd50f49edN.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2580 powershell.exe 2676 powershell.exe -
Creates new service(s) 2 TTPs
-
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 20 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion c1d6557416.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 7e53c65cea.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rfopgxavqojn.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion d4417b23f8728ae97d162dcb9916ad36aac089a2dd684936884f013bd50f49edN.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion d4417b23f8728ae97d162dcb9916ad36aac089a2dd684936884f013bd50f49edN.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 7e53c65cea.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rfopgxavqojn.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion chrone.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion chrone.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion c1d6557416.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 3c8f27b17e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 3c8f27b17e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation d4417b23f8728ae97d162dcb9916ad36aac089a2dd684936884f013bd50f49edN.exe Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation skotes.exe -
Executes dropped EXE 14 IoCs
pid Process 1772 skotes.exe 4488 crypted.exe 824 crypted.exe 1328 crypted.exe 2040 crypted.exe 1672 crypted.exe 2792 skotes.exe 3108 chrone.exe 3100 skotes.exe 3668 c1d6557416.exe 1596 7e53c65cea.exe 4620 skotes.exe 3420 3c8f27b17e.exe 3948 rfopgxavqojn.exe -
Identifies Wine through registry keys 2 TTPs 8 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine 3c8f27b17e.exe Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine d4417b23f8728ae97d162dcb9916ad36aac089a2dd684936884f013bd50f49edN.exe Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine c1d6557416.exe Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine 7e53c65cea.exe Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine skotes.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 3c8f27b17e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 3c8f27b17e.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c1d6557416.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1004972001\\c1d6557416.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\7e53c65cea.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1004973001\\7e53c65cea.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3c8f27b17e.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1004975001\\3c8f27b17e.exe" skotes.exe -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 2276 powercfg.exe 632 powercfg.exe 2008 powercfg.exe 3196 powercfg.exe 3272 powercfg.exe 560 powercfg.exe 4172 powercfg.exe 4560 powercfg.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe rfopgxavqojn.exe File opened for modification C:\Windows\system32\MRT.exe chrone.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
pid Process 2740 d4417b23f8728ae97d162dcb9916ad36aac089a2dd684936884f013bd50f49edN.exe 1772 skotes.exe 2792 skotes.exe 3100 skotes.exe 3668 c1d6557416.exe 1596 7e53c65cea.exe 4620 skotes.exe 3420 3c8f27b17e.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 4488 set thread context of 1672 4488 crypted.exe 97 PID 1772 set thread context of 4620 1772 skotes.exe 111 PID 3948 set thread context of 1220 3948 rfopgxavqojn.exe 167 PID 3948 set thread context of 1560 3948 rfopgxavqojn.exe 169 -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job d4417b23f8728ae97d162dcb9916ad36aac089a2dd684936884f013bd50f49edN.exe -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2008 sc.exe 4100 sc.exe 460 sc.exe 2492 sc.exe 1040 sc.exe 3692 sc.exe 4548 sc.exe 2592 sc.exe 2844 sc.exe 3620 sc.exe 1160 sc.exe 2760 sc.exe 1500 sc.exe 2348 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2124 4488 WerFault.exe 92 -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c8f27b17e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d4417b23f8728ae97d162dcb9916ad36aac089a2dd684936884f013bd50f49edN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language crypted.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language crypted.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c1d6557416.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7e53c65cea.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe -
Modifies data under HKEY_USERS 50 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs notepad.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs notepad.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT notepad.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates notepad.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2740 d4417b23f8728ae97d162dcb9916ad36aac089a2dd684936884f013bd50f49edN.exe 2740 d4417b23f8728ae97d162dcb9916ad36aac089a2dd684936884f013bd50f49edN.exe 1772 skotes.exe 1772 skotes.exe 2792 skotes.exe 2792 skotes.exe 3100 skotes.exe 3100 skotes.exe 3668 c1d6557416.exe 3668 c1d6557416.exe 1596 7e53c65cea.exe 1596 7e53c65cea.exe 4620 skotes.exe 4620 skotes.exe 3108 chrone.exe 3420 3c8f27b17e.exe 3420 3c8f27b17e.exe 2580 powershell.exe 2580 powershell.exe 3108 chrone.exe 3108 chrone.exe 3108 chrone.exe 3108 chrone.exe 3108 chrone.exe 3108 chrone.exe 3108 chrone.exe 3108 chrone.exe 3108 chrone.exe 3108 chrone.exe 3108 chrone.exe 3108 chrone.exe 3108 chrone.exe 3108 chrone.exe 3948 rfopgxavqojn.exe 2676 powershell.exe 2676 powershell.exe 3948 rfopgxavqojn.exe 3948 rfopgxavqojn.exe 3948 rfopgxavqojn.exe 3948 rfopgxavqojn.exe 3948 rfopgxavqojn.exe 3948 rfopgxavqojn.exe 3948 rfopgxavqojn.exe 3948 rfopgxavqojn.exe 3948 rfopgxavqojn.exe 3948 rfopgxavqojn.exe 3948 rfopgxavqojn.exe 3948 rfopgxavqojn.exe 3420 3c8f27b17e.exe 3420 3c8f27b17e.exe 1560 notepad.exe 1560 notepad.exe 1560 notepad.exe 1560 notepad.exe 1560 notepad.exe 1560 notepad.exe 1560 notepad.exe 1560 notepad.exe 1560 notepad.exe 1560 notepad.exe 1560 notepad.exe 1560 notepad.exe 1560 notepad.exe 1560 notepad.exe -
Suspicious use of AdjustPrivilegeToken 22 IoCs
description pid Process Token: SeDebugPrivilege 2580 powershell.exe Token: SeDebugPrivilege 3108 chrone.exe Token: SeShutdownPrivilege 560 powercfg.exe Token: SeCreatePagefilePrivilege 560 powercfg.exe Token: SeShutdownPrivilege 4560 powercfg.exe Token: SeCreatePagefilePrivilege 4560 powercfg.exe Token: SeShutdownPrivilege 3272 powercfg.exe Token: SeCreatePagefilePrivilege 3272 powercfg.exe Token: SeShutdownPrivilege 4172 powercfg.exe Token: SeCreatePagefilePrivilege 4172 powercfg.exe Token: SeDebugPrivilege 2676 powershell.exe Token: SeDebugPrivilege 3948 rfopgxavqojn.exe Token: SeShutdownPrivilege 2008 powercfg.exe Token: SeCreatePagefilePrivilege 2008 powercfg.exe Token: SeDebugPrivilege 3420 3c8f27b17e.exe Token: SeShutdownPrivilege 2276 powercfg.exe Token: SeCreatePagefilePrivilege 2276 powercfg.exe Token: SeShutdownPrivilege 3196 powercfg.exe Token: SeCreatePagefilePrivilege 3196 powercfg.exe Token: SeShutdownPrivilege 632 powercfg.exe Token: SeCreatePagefilePrivilege 632 powercfg.exe Token: SeLockMemoryPrivilege 1560 notepad.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2740 d4417b23f8728ae97d162dcb9916ad36aac089a2dd684936884f013bd50f49edN.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2740 wrote to memory of 1772 2740 d4417b23f8728ae97d162dcb9916ad36aac089a2dd684936884f013bd50f49edN.exe 86 PID 2740 wrote to memory of 1772 2740 d4417b23f8728ae97d162dcb9916ad36aac089a2dd684936884f013bd50f49edN.exe 86 PID 2740 wrote to memory of 1772 2740 d4417b23f8728ae97d162dcb9916ad36aac089a2dd684936884f013bd50f49edN.exe 86 PID 1772 wrote to memory of 4488 1772 skotes.exe 92 PID 1772 wrote to memory of 4488 1772 skotes.exe 92 PID 1772 wrote to memory of 4488 1772 skotes.exe 92 PID 4488 wrote to memory of 824 4488 crypted.exe 94 PID 4488 wrote to memory of 824 4488 crypted.exe 94 PID 4488 wrote to memory of 824 4488 crypted.exe 94 PID 4488 wrote to memory of 1328 4488 crypted.exe 95 PID 4488 wrote to memory of 1328 4488 crypted.exe 95 PID 4488 wrote to memory of 1328 4488 crypted.exe 95 PID 4488 wrote to memory of 2040 4488 crypted.exe 96 PID 4488 wrote to memory of 2040 4488 crypted.exe 96 PID 4488 wrote to memory of 2040 4488 crypted.exe 96 PID 4488 wrote to memory of 1672 4488 crypted.exe 97 PID 4488 wrote to memory of 1672 4488 crypted.exe 97 PID 4488 wrote to memory of 1672 4488 crypted.exe 97 PID 4488 wrote to memory of 1672 4488 crypted.exe 97 PID 4488 wrote to memory of 1672 4488 crypted.exe 97 PID 4488 wrote to memory of 1672 4488 crypted.exe 97 PID 4488 wrote to memory of 1672 4488 crypted.exe 97 PID 4488 wrote to memory of 1672 4488 crypted.exe 97 PID 4488 wrote to memory of 1672 4488 crypted.exe 97 PID 1772 wrote to memory of 3108 1772 skotes.exe 107 PID 1772 wrote to memory of 3108 1772 skotes.exe 107 PID 1772 wrote to memory of 3668 1772 skotes.exe 109 PID 1772 wrote to memory of 3668 1772 skotes.exe 109 PID 1772 wrote to memory of 3668 1772 skotes.exe 109 PID 1772 wrote to memory of 1596 1772 skotes.exe 110 PID 1772 wrote to memory of 1596 1772 skotes.exe 110 PID 1772 wrote to memory of 1596 1772 skotes.exe 110 PID 1772 wrote to memory of 4620 1772 skotes.exe 111 PID 1772 wrote to memory of 4620 1772 skotes.exe 111 PID 1772 wrote to memory of 4620 1772 skotes.exe 111 PID 1772 wrote to memory of 4620 1772 skotes.exe 111 PID 1772 wrote to memory of 4620 1772 skotes.exe 111 PID 1772 wrote to memory of 4620 1772 skotes.exe 111 PID 1772 wrote to memory of 4620 1772 skotes.exe 111 PID 1772 wrote to memory of 4620 1772 skotes.exe 111 PID 1772 wrote to memory of 4620 1772 skotes.exe 111 PID 1772 wrote to memory of 4620 1772 skotes.exe 111 PID 1772 wrote to memory of 4620 1772 skotes.exe 111 PID 1772 wrote to memory of 4620 1772 skotes.exe 111 PID 1772 wrote to memory of 3420 1772 skotes.exe 112 PID 1772 wrote to memory of 3420 1772 skotes.exe 112 PID 1772 wrote to memory of 3420 1772 skotes.exe 112 PID 1220 wrote to memory of 2124 1220 cmd.exe 120 PID 1220 wrote to memory of 2124 1220 cmd.exe 120 PID 3612 wrote to memory of 2652 3612 cmd.exe 151 PID 3612 wrote to memory of 2652 3612 cmd.exe 151 PID 3948 wrote to memory of 1220 3948 rfopgxavqojn.exe 167 PID 3948 wrote to memory of 1220 3948 rfopgxavqojn.exe 167 PID 3948 wrote to memory of 1220 3948 rfopgxavqojn.exe 167 PID 3948 wrote to memory of 1220 3948 rfopgxavqojn.exe 167 PID 3948 wrote to memory of 1220 3948 rfopgxavqojn.exe 167 PID 3948 wrote to memory of 1220 3948 rfopgxavqojn.exe 167 PID 3948 wrote to memory of 1220 3948 rfopgxavqojn.exe 167 PID 3948 wrote to memory of 1220 3948 rfopgxavqojn.exe 167 PID 3948 wrote to memory of 1220 3948 rfopgxavqojn.exe 167 PID 3948 wrote to memory of 1560 3948 rfopgxavqojn.exe 169 PID 3948 wrote to memory of 1560 3948 rfopgxavqojn.exe 169 PID 3948 wrote to memory of 1560 3948 rfopgxavqojn.exe 169 PID 3948 wrote to memory of 1560 3948 rfopgxavqojn.exe 169
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4417b23f8728ae97d162dcb9916ad36aac089a2dd684936884f013bd50f49edN.exe"C:\Users\Admin\AppData\Local\Temp\d4417b23f8728ae97d162dcb9916ad36aac089a2dd684936884f013bd50f49edN.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\1004884001\crypted.exe"C:\Users\Admin\AppData\Local\Temp\1004884001\crypted.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\1004884001\crypted.exe"C:\Users\Admin\AppData\Local\Temp\1004884001\crypted.exe"4⤵
- Executes dropped EXE
PID:824
-
-
C:\Users\Admin\AppData\Local\Temp\1004884001\crypted.exe"C:\Users\Admin\AppData\Local\Temp\1004884001\crypted.exe"4⤵
- Executes dropped EXE
PID:1328
-
-
C:\Users\Admin\AppData\Local\Temp\1004884001\crypted.exe"C:\Users\Admin\AppData\Local\Temp\1004884001\crypted.exe"4⤵
- Executes dropped EXE
PID:2040
-
-
C:\Users\Admin\AppData\Local\Temp\1004884001\crypted.exe"C:\Users\Admin\AppData\Local\Temp\1004884001\crypted.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1672
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 3444⤵
- Program crash
PID:2124
-
-
-
C:\Users\Admin\AppData\Local\Temp\1004943001\chrone.exe"C:\Users\Admin\AppData\Local\Temp\1004943001\chrone.exe"3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3108 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2580
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart4⤵
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart5⤵PID:2124
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc4⤵
- Launches sc.exe
PID:1160
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc4⤵
- Launches sc.exe
PID:2008
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv4⤵
- Launches sc.exe
PID:2592
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits4⤵
- Launches sc.exe
PID:4548
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc4⤵
- Launches sc.exe
PID:2844
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 04⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4560
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 04⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4172
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 04⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:560
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 04⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3272
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "GDRQRNRG"4⤵
- Launches sc.exe
PID:1500
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "GDRQRNRG" binpath= "C:\ProgramData\xrvqzpvhzdcy\rfopgxavqojn.exe" start= "auto"4⤵
- Launches sc.exe
PID:2348
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog4⤵
- Launches sc.exe
PID:460
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "GDRQRNRG"4⤵
- Launches sc.exe
PID:3620
-
-
-
C:\Users\Admin\AppData\Local\Temp\1004972001\c1d6557416.exe"C:\Users\Admin\AppData\Local\Temp\1004972001\c1d6557416.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3668
-
-
C:\Users\Admin\AppData\Local\Temp\1004973001\7e53c65cea.exe"C:\Users\Admin\AppData\Local\Temp\1004973001\7e53c65cea.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1596
-
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4620
-
-
C:\Users\Admin\AppData\Local\Temp\1004975001\3c8f27b17e.exe"C:\Users\Admin\AppData\Local\Temp\1004975001\3c8f27b17e.exe"3⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3420
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4488 -ip 44881⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2792
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3100
-
C:\ProgramData\xrvqzpvhzdcy\rfopgxavqojn.exeC:\ProgramData\xrvqzpvhzdcy\rfopgxavqojn.exe1⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2676
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:2652
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:3692
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:2492
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:4100
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:1040
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:2760
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3196
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2008
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:632
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2276
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:1220
-
-
C:\Windows\system32\notepad.exenotepad.exe2⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1560
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Power Settings
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Defense Evasion
Impair Defenses
3Disable or Modify Tools
2Modify Registry
3Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5e1d09be68de1be491cdb2870bfc90854
SHA16db8265a53f1a9e9d0c4aa8f98ade1db4eea9109
SHA2566b2c384e64992914ec049762e153d4592c7dc2511b8cc079843c4d8195210c23
SHA51210e609c166adfe9aebb5c62f57896fc194d5272f5b82c2cd8f3719444074bd0064e7969a559633b4d7b000b5196812ea38c913bf970cfd4c33567116d8295692
-
Filesize
6.9MB
MD5ce3a6f4d1ebe823841187d30e9f143ab
SHA17316c51c0539724130226dd5cdc968b67415e225
SHA25698d0e67d779ed43bcac753a9af22326e0024390d703c7c4e6601917ce6ff96bc
SHA512cfdddc6575138fb500d8e7e4ca379091d96864e4bf60fbcc357a0275b68f67210757204b86c983465959dd115e1b3944d22f410fec3f7232f2b6bda187df171a
-
Filesize
3.0MB
MD5bb610f3b68a61a23e8d71c8fad693f38
SHA1b077edd1521904673b7dd7f01d45e7aa3cbce4fb
SHA2561ad85e7a7ae029b5d4003420b6912a51fcefc95f6b7f64fabc2783e10286857a
SHA5129353f34e693fc2bbcf7da5ce3f9d3382262786ccaf763a00b3a874949f6e17beca912a61f144dc0fb6e7a2794e53721d3631c84b5a4afccfd679cb0974d9c914
-
Filesize
2.1MB
MD5f058a72e4dbe19f8b8ffb8785c2820d2
SHA1440c44260ad8564a776ec1292adc4577906009fe
SHA2566a443c0ac67ec4aff6acb6319cfc04d68bf0f861ac0424dec70a6bb8a27975cb
SHA512bb2068d16c5f8a02aa2df1d51b491fb48de7a47cf74bb69e1ea20feb5b33f529d8e2d0b36844fa6ce961aa3c6337c057af7533153209cf26b4db6b7cd30d23ea
-
Filesize
2.7MB
MD58f83afca9c2c5f691e0d72198fc243eb
SHA1fb78a4d64c193fdf5a8da774bc217b0d53f4e567
SHA256eca345932d6d86344eeff06cb9b3d60131d23f48f59a5dd73fec57734bba3e01
SHA51215c690eedd848bf377b0c2a2dddaea5f90e1fae50ab20ed4d2fd61c7d57d1b070df5f1d5b6258f89aabbda2fd0661e2861bff273474c9aa4fa68fcc08a7203bc
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1.8MB
MD54264eccf5968410db0afcf14351fc8e0
SHA1b0dcc6ccd68005534f9a7172c5d9e1d510d42de3
SHA256d4417b23f8728ae97d162dcb9916ad36aac089a2dd684936884f013bd50f49ed
SHA5122aa4dae701bd619e7d2befe3365faf671dfd1c458510603e5742baccc21ebb600f67d71e3181f76333401b5c581150b1420e9a7c9ead54ad8ad8f0e2fded7b0c