amadey | a53ae2e450d4e2bc6cb584ffe41a01b48cd0ebe65d8f73753f336601a376b994

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	4T017N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	4T017N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	30b8fbdbf5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	30b8fbdbf5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	4T017N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	4T017N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	4T017N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	4T017N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	30b8fbdbf5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	30b8fbdbf5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	30b8fbdbf5.exe

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	4f4052120b.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 11 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2v3732.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	3b922ff295.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	30b8fbdbf5.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	1V47o9.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	4f4052120b.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	3R58n.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	b7054c4e51.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	4T017N.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 22 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4T017N.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4T017N.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1V47o9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3b922ff295.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3b922ff295.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3R58n.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1V47o9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	30b8fbdbf5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	30b8fbdbf5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4f4052120b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4f4052120b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3R58n.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	b7054c4e51.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	b7054c4e51.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2v3732.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2v3732.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	1V47o9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	skotes.exe

Executes dropped EXE 14 IoCs

pid	Process
3592	B5H30.exe
4268	b9s26.exe
392	1V47o9.exe
680	skotes.exe
4524	2v3732.exe
1696	4f4052120b.exe
2104	3b922ff295.exe
5116	3R58n.exe
2468	b7054c4e51.exe
2604	4T017N.exe
2932	bbfa09a58d.exe
2724	30b8fbdbf5.exe
6168	skotes.exe
6424	skotes.exe

Identifies Wine through registry keys 2 TTPs 11 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	4f4052120b.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	b7054c4e51.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	30b8fbdbf5.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	1V47o9.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	2v3732.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	3b922ff295.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	3R58n.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	4T017N.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	skotes.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	4T017N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	4T017N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	30b8fbdbf5.exe

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b7054c4e51.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1012746001\\b7054c4e51.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bbfa09a58d.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1012747001\\bbfa09a58d.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\30b8fbdbf5.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1012748001\\30b8fbdbf5.exe"	skotes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a53ae2e450d4e2bc6cb584ffe41a01b48cd0ebe65d8f73753f336601a376b994.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	B5H30.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	b9s26.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3b922ff295.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1012745001\\3b922ff295.exe"	skotes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x000c000000023b87-110.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs

pid	Process
392	1V47o9.exe
680	skotes.exe
4524	2v3732.exe
1696	4f4052120b.exe
2104	3b922ff295.exe
5116	3R58n.exe
2468	b7054c4e51.exe
2604	4T017N.exe
2724	30b8fbdbf5.exe
6168	skotes.exe
6424	skotes.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	1V47o9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4512	4524	WerFault.exe	87
3528	4524	WerFault.exe	87
5752	2104	WerFault.exe	96

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	30b8fbdbf5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B5H30.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bbfa09a58d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	bbfa09a58d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a53ae2e450d4e2bc6cb584ffe41a01b48cd0ebe65d8f73753f336601a376b994.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4f4052120b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3b922ff295.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b7054c4e51.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4T017N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1V47o9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2v3732.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3R58n.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	bbfa09a58d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b9s26.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Kills process with taskkill 5 IoCs

pid	Process
4176	taskkill.exe
4640	taskkill.exe
4380	taskkill.exe
2656	taskkill.exe
4816	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
392	1V47o9.exe
392	1V47o9.exe
680	skotes.exe
680	skotes.exe
4524	2v3732.exe
4524	2v3732.exe
1696	4f4052120b.exe
1696	4f4052120b.exe
1696	4f4052120b.exe
1696	4f4052120b.exe
1696	4f4052120b.exe
1696	4f4052120b.exe
1696	4f4052120b.exe
1696	4f4052120b.exe
1696	4f4052120b.exe
1696	4f4052120b.exe
2104	3b922ff295.exe
2104	3b922ff295.exe
5116	3R58n.exe
5116	3R58n.exe
2468	b7054c4e51.exe
2468	b7054c4e51.exe
2604	4T017N.exe
2604	4T017N.exe
2604	4T017N.exe
2604	4T017N.exe
2604	4T017N.exe
2932	bbfa09a58d.exe
2932	bbfa09a58d.exe
2724	30b8fbdbf5.exe
2724	30b8fbdbf5.exe
2724	30b8fbdbf5.exe
2724	30b8fbdbf5.exe
2724	30b8fbdbf5.exe
2932	bbfa09a58d.exe
2932	bbfa09a58d.exe
6168	skotes.exe
6168	skotes.exe
6424	skotes.exe
6424	skotes.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	4380	taskkill.exe
Token: SeDebugPrivilege	2604	4T017N.exe
Token: SeDebugPrivilege	2656	taskkill.exe
Token: SeDebugPrivilege	4816	taskkill.exe
Token: SeDebugPrivilege	4176	taskkill.exe
Token: SeDebugPrivilege	4640	taskkill.exe
Token: SeDebugPrivilege	2724	30b8fbdbf5.exe
Token: SeDebugPrivilege	4004	firefox.exe
Token: SeDebugPrivilege	4004	firefox.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
392	1V47o9.exe
2932	bbfa09a58d.exe
2932	bbfa09a58d.exe
2932	bbfa09a58d.exe
2932	bbfa09a58d.exe
2932	bbfa09a58d.exe
2932	bbfa09a58d.exe
2932	bbfa09a58d.exe
2932	bbfa09a58d.exe
2932	bbfa09a58d.exe
2932	bbfa09a58d.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
2932	bbfa09a58d.exe
2932	bbfa09a58d.exe
2932	bbfa09a58d.exe

Suspicious use of SendNotifyMessage 33 IoCs

pid	Process
2932	bbfa09a58d.exe
2932	bbfa09a58d.exe
2932	bbfa09a58d.exe
2932	bbfa09a58d.exe
2932	bbfa09a58d.exe
2932	bbfa09a58d.exe
2932	bbfa09a58d.exe
2932	bbfa09a58d.exe
2932	bbfa09a58d.exe
2932	bbfa09a58d.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
2932	bbfa09a58d.exe
2932	bbfa09a58d.exe
2932	bbfa09a58d.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4004	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 3592	116	a53ae2e450d4e2bc6cb584ffe41a01b48cd0ebe65d8f73753f336601a376b994.exe	83
PID 116 wrote to memory of 3592	116	a53ae2e450d4e2bc6cb584ffe41a01b48cd0ebe65d8f73753f336601a376b994.exe	83
PID 116 wrote to memory of 3592	116	a53ae2e450d4e2bc6cb584ffe41a01b48cd0ebe65d8f73753f336601a376b994.exe	83
PID 3592 wrote to memory of 4268	3592	B5H30.exe	84
PID 3592 wrote to memory of 4268	3592	B5H30.exe	84
PID 3592 wrote to memory of 4268	3592	B5H30.exe	84
PID 4268 wrote to memory of 392	4268	b9s26.exe	85
PID 4268 wrote to memory of 392	4268	b9s26.exe	85
PID 4268 wrote to memory of 392	4268	b9s26.exe	85
PID 392 wrote to memory of 680	392	1V47o9.exe	86
PID 392 wrote to memory of 680	392	1V47o9.exe	86
PID 392 wrote to memory of 680	392	1V47o9.exe	86
PID 4268 wrote to memory of 4524	4268	b9s26.exe	87
PID 4268 wrote to memory of 4524	4268	b9s26.exe	87
PID 4268 wrote to memory of 4524	4268	b9s26.exe	87
PID 680 wrote to memory of 1696	680	skotes.exe	88
PID 680 wrote to memory of 1696	680	skotes.exe	88
PID 680 wrote to memory of 1696	680	skotes.exe	88
PID 680 wrote to memory of 2104	680	skotes.exe	96
PID 680 wrote to memory of 2104	680	skotes.exe	96
PID 680 wrote to memory of 2104	680	skotes.exe	96
PID 3592 wrote to memory of 5116	3592	B5H30.exe	106
PID 3592 wrote to memory of 5116	3592	B5H30.exe	106
PID 3592 wrote to memory of 5116	3592	B5H30.exe	106
PID 680 wrote to memory of 2468	680	skotes.exe	108
PID 680 wrote to memory of 2468	680	skotes.exe	108
PID 680 wrote to memory of 2468	680	skotes.exe	108
PID 116 wrote to memory of 2604	116	a53ae2e450d4e2bc6cb584ffe41a01b48cd0ebe65d8f73753f336601a376b994.exe	111
PID 116 wrote to memory of 2604	116	a53ae2e450d4e2bc6cb584ffe41a01b48cd0ebe65d8f73753f336601a376b994.exe	111
PID 116 wrote to memory of 2604	116	a53ae2e450d4e2bc6cb584ffe41a01b48cd0ebe65d8f73753f336601a376b994.exe	111
PID 680 wrote to memory of 2932	680	skotes.exe	112
PID 680 wrote to memory of 2932	680	skotes.exe	112
PID 680 wrote to memory of 2932	680	skotes.exe	112
PID 2932 wrote to memory of 4380	2932	bbfa09a58d.exe	114
PID 2932 wrote to memory of 4380	2932	bbfa09a58d.exe	114
PID 2932 wrote to memory of 4380	2932	bbfa09a58d.exe	114
PID 2932 wrote to memory of 2656	2932	bbfa09a58d.exe	116
PID 2932 wrote to memory of 2656	2932	bbfa09a58d.exe	116
PID 2932 wrote to memory of 2656	2932	bbfa09a58d.exe	116
PID 680 wrote to memory of 2724	680	skotes.exe	118
PID 680 wrote to memory of 2724	680	skotes.exe	118
PID 680 wrote to memory of 2724	680	skotes.exe	118
PID 2932 wrote to memory of 4816	2932	bbfa09a58d.exe	119
PID 2932 wrote to memory of 4816	2932	bbfa09a58d.exe	119
PID 2932 wrote to memory of 4816	2932	bbfa09a58d.exe	119
PID 2932 wrote to memory of 4176	2932	bbfa09a58d.exe	122
PID 2932 wrote to memory of 4176	2932	bbfa09a58d.exe	122
PID 2932 wrote to memory of 4176	2932	bbfa09a58d.exe	122
PID 2932 wrote to memory of 4640	2932	bbfa09a58d.exe	124
PID 2932 wrote to memory of 4640	2932	bbfa09a58d.exe	124
PID 2932 wrote to memory of 4640	2932	bbfa09a58d.exe	124
PID 2932 wrote to memory of 1920	2932	bbfa09a58d.exe	127
PID 2932 wrote to memory of 1920	2932	bbfa09a58d.exe	127
PID 1920 wrote to memory of 4004	1920	firefox.exe	128
PID 1920 wrote to memory of 4004	1920	firefox.exe	128
PID 1920 wrote to memory of 4004	1920	firefox.exe	128
PID 1920 wrote to memory of 4004	1920	firefox.exe	128
PID 1920 wrote to memory of 4004	1920	firefox.exe	128
PID 1920 wrote to memory of 4004	1920	firefox.exe	128
PID 1920 wrote to memory of 4004	1920	firefox.exe	128
PID 1920 wrote to memory of 4004	1920	firefox.exe	128
PID 1920 wrote to memory of 4004	1920	firefox.exe	128
PID 1920 wrote to memory of 4004	1920	firefox.exe	128
PID 1920 wrote to memory of 4004	1920	firefox.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\a53ae2e450d4e2bc6cb584ffe41a01b48cd0ebe65d8f73753f336601a376b994.exe
"C:\Users\Admin\AppData\Local\Temp\a53ae2e450d4e2bc6cb584ffe41a01b48cd0ebe65d8f73753f336601a376b994.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:116
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\B5H30.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\B5H30.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3592
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b9s26.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b9s26.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4268
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1V47o9.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1V47o9.exe
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Checks computer location settings
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:392
    - - C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        
        "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Checks computer location settings
        Executes dropped EXE
        Identifies Wine through registry keys
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:680
      - C:\Users\Admin\AppData\Local\Temp\1012744001\4f4052120b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1012744001\4f4052120b.exe"
        6⤵
        Enumerates VirtualBox registry keys
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1696
      - C:\Users\Admin\AppData\Local\Temp\1012745001\3b922ff295.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1012745001\3b922ff295.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2104
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 1628
        7⤵
        Program crash
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\1012746001\b7054c4e51.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1012746001\b7054c4e51.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2468
      - C:\Users\Admin\AppData\Local\Temp\1012747001\bbfa09a58d.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1012747001\bbfa09a58d.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2932
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM firefox.exe /T
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4380
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2656
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4816
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4176
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4640
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1920
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        8⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:4004
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2040 -parentBuildID 20240401114208 -prefsHandle 1968 -prefMapHandle 1960 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d41b1f31-67a1-4e97-bc63-3a4136e62a6c} 4004 "\\.\pipe\gecko-crash-server-pipe.4004" gpu
        9⤵
        
        PID:1304
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2476 -parentBuildID 20240401114208 -prefsHandle 2468 -prefMapHandle 2464 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {509d81cb-58a7-4f68-b6c1-c5d8f5341e87} 4004 "\\.\pipe\gecko-crash-server-pipe.4004" socket
        9⤵
        
        PID:4768
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3172 -childID 1 -isForBrowser -prefsHandle 3184 -prefMapHandle 3028 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b36f1f3-5029-4a3e-bfc9-91ff5fb71be6} 4004 "\\.\pipe\gecko-crash-server-pipe.4004" tab
        9⤵
        
        PID:1624
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4216 -childID 2 -isForBrowser -prefsHandle 4208 -prefMapHandle 4204 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {207a3caf-80be-4ffd-a185-ddbe7f054851} 4004 "\\.\pipe\gecko-crash-server-pipe.4004" tab
        9⤵
        
        PID:2012
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4892 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4884 -prefMapHandle 4888 -prefsLen 29197 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {865cb5df-bc54-4439-9842-4c057d78ab9f} 4004 "\\.\pipe\gecko-crash-server-pipe.4004" utility
        9⤵
        Checks processor information in registry
        
        PID:6896
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5412 -childID 3 -isForBrowser -prefsHandle 5420 -prefMapHandle 4152 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1e929bff-c0cf-4300-ad14-661f7c630384} 4004 "\\.\pipe\gecko-crash-server-pipe.4004" tab
        9⤵
        
        PID:5408
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5536 -childID 4 -isForBrowser -prefsHandle 5544 -prefMapHandle 5548 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bc3f9277-d54e-4112-ac43-0c434d38feee} 4004 "\\.\pipe\gecko-crash-server-pipe.4004" tab
        9⤵
        
        PID:5444
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5408 -childID 5 -isForBrowser -prefsHandle 5840 -prefMapHandle 5836 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7087b875-385f-4c71-a1fd-1a2c3d05d348} 4004 "\\.\pipe\gecko-crash-server-pipe.4004" tab
        9⤵
        
        PID:5464
      - C:\Users\Admin\AppData\Local\Temp\1012748001\30b8fbdbf5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1012748001\30b8fbdbf5.exe"
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Windows security modification
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2724
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2v3732.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2v3732.exe
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4524
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 1596
        5⤵
        Program crash
        
        PID:4512
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 1624
        5⤵
        Program crash
        
        PID:3528
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3R58n.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3R58n.exe
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5116
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4T017N.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4T017N.exe
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Windows security modification
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4524 -ip 4524
1⤵
PID:3876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4524 -ip 4524
1⤵
PID:2436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2104 -ip 2104
1⤵
PID:5228

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:6168

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:6424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion