amadey | 91b19fc66774a862fab4409242ddc106aa1b8b03e63d661d540899e16e687f7c

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	5a41db7786.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	5a41db7786.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	5a41db7786.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	5a41db7786.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	5a41db7786.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	5a41db7786.exe

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4796 created 3568	4796	CuKxXX0.exe	56

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	7930f0cde9.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	48645698b3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	5a41db7786.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	91b19fc66774a862fab4409242ddc106aa1b8b03e63d661d540899e16e687f7c.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 14 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	5a41db7786.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	91b19fc66774a862fab4409242ddc106aa1b8b03e63d661d540899e16e687f7c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	7930f0cde9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	5a41db7786.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	91b19fc66774a862fab4409242ddc106aa1b8b03e63d661d540899e16e687f7c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	7930f0cde9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	48645698b3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	48645698b3.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	70865bd535.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	d9cd65d215.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	91b19fc66774a862fab4409242ddc106aa1b8b03e63d661d540899e16e687f7c.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	skotes.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	CuKxXX0.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindosCPUsystem.vbs	CuKxXX0.exe

Executes dropped EXE 22 IoCs

pid	Process
1944	skotes.exe
4796	CuKxXX0.exe
2908	skotes.exe
220	7930f0cde9.exe
3892	70865bd535.exe
4860	8a122d7949.exe
312	8a122d7949.exe
5012	7z.exe
4512	7z.exe
4952	7z.exe
2684	7z.exe
1688	7z.exe
4460	7z.exe
3644	997dbea747.exe
1788	7z.exe
972	7z.exe
1004	in.exe
1416	48645698b3.exe
5564	5a41db7786.exe
3644	d9cd65d215.exe
4468	skotes.exe
6592	Intel_PTT_EK_Recertification.exe

Identifies Wine through registry keys 2 TTPs 7 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine	91b19fc66774a862fab4409242ddc106aa1b8b03e63d661d540899e16e687f7c.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine	7930f0cde9.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine	48645698b3.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine	5a41db7786.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine	skotes.exe

Loads dropped DLL 8 IoCs

pid	Process
5012	7z.exe
4512	7z.exe
4952	7z.exe
2684	7z.exe
1688	7z.exe
4460	7z.exe
1788	7z.exe
972	7z.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	5a41db7786.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	5a41db7786.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5a41db7786.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1014555001\\5a41db7786.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\997dbea747.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1014553001\\997dbea747.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\48645698b3.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1014554001\\48645698b3.exe"	skotes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0007000000023c99-1340.dat	autoit_exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Start PowerShell.

execution

PowerShell

T1059.001

pid	Process
5828	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

pid	Process
2544	91b19fc66774a862fab4409242ddc106aa1b8b03e63d661d540899e16e687f7c.exe
1944	skotes.exe
2908	skotes.exe
220	7930f0cde9.exe
1416	48645698b3.exe
5564	5a41db7786.exe
4468	skotes.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4860 set thread context of 312	4860	8a122d7949.exe	111
PID 4796 set thread context of 5980	4796	CuKxXX0.exe	162
PID 5980 set thread context of 4352	5980	MSBuild.exe	198

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023ca8-1381.dat	upx
behavioral2/memory/1004-1384-0x00007FF6CDF40000-0x00007FF6CE3D0000-memory.dmp	upx
behavioral2/memory/1004-1387-0x00007FF6CDF40000-0x00007FF6CE3D0000-memory.dmp	upx
behavioral2/memory/6592-3604-0x00007FF7D6C00000-0x00007FF7D7090000-memory.dmp	upx
behavioral2/memory/6592-4881-0x00007FF7D6C00000-0x00007FF7D7090000-memory.dmp	upx
behavioral2/memory/6056-4929-0x00007FF7D6C00000-0x00007FF7D7090000-memory.dmp	upx
behavioral2/memory/6056-4946-0x00007FF7D6C00000-0x00007FF7D7090000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	91b19fc66774a862fab4409242ddc106aa1b8b03e63d661d540899e16e687f7c.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
7140	3644	WerFault.exe	178
5424	220	WerFault.exe	99

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	997dbea747.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8a122d7949.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	997dbea747.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	997dbea747.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7930f0cde9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8a122d7949.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	48645698b3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	91b19fc66774a862fab4409242ddc106aa1b8b03e63d661d540899e16e687f7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5a41db7786.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d9cd65d215.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	70865bd535.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4408	powershell.exe
1496	PING.EXE
5388	powershell.exe
6224	PING.EXE
3720	powershell.exe
5512	PING.EXE

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	d9cd65d215.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	d9cd65d215.exe

Delays execution with timeout.exe 1 IoCs

pid	Process
7088	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

T1059

pid	Process
3816	ipconfig.exe
3944	ipconfig.exe

Kills process with taskkill 5 IoCs

pid	Process
5072	taskkill.exe
1716	taskkill.exe
1164	taskkill.exe
4976	taskkill.exe
3876	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	firefox.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
1496	PING.EXE
6224	PING.EXE
5512	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
640	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2544	91b19fc66774a862fab4409242ddc106aa1b8b03e63d661d540899e16e687f7c.exe
2544	91b19fc66774a862fab4409242ddc106aa1b8b03e63d661d540899e16e687f7c.exe
1944	skotes.exe
1944	skotes.exe
2908	skotes.exe
2908	skotes.exe
220	7930f0cde9.exe
220	7930f0cde9.exe
4796	CuKxXX0.exe
4796	CuKxXX0.exe
4796	CuKxXX0.exe
4408	powershell.exe
4408	powershell.exe
4408	powershell.exe
3644	997dbea747.exe
3644	997dbea747.exe
1416	48645698b3.exe
1416	48645698b3.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
3644	997dbea747.exe
3644	997dbea747.exe
5564	5a41db7786.exe
5564	5a41db7786.exe
4796	CuKxXX0.exe
4796	CuKxXX0.exe
5828	powershell.exe
5828	powershell.exe
5828	powershell.exe
4796	CuKxXX0.exe
5412	msedge.exe
5412	msedge.exe
264	msedge.exe
264	msedge.exe
5564	5a41db7786.exe
5564	5a41db7786.exe
5564	5a41db7786.exe
3644	d9cd65d215.exe
3644	d9cd65d215.exe
6664	identity_helper.exe
6664	identity_helper.exe
5980	MSBuild.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeDebugPrivilege	4796	CuKxXX0.exe
Token: SeRestorePrivilege	5012	7z.exe
Token: 35	5012	7z.exe
Token: SeSecurityPrivilege	5012	7z.exe
Token: SeSecurityPrivilege	5012	7z.exe
Token: SeRestorePrivilege	4512	7z.exe
Token: 35	4512	7z.exe
Token: SeSecurityPrivilege	4512	7z.exe
Token: SeSecurityPrivilege	4512	7z.exe
Token: SeRestorePrivilege	4952	7z.exe
Token: 35	4952	7z.exe
Token: SeSecurityPrivilege	4952	7z.exe
Token: SeSecurityPrivilege	4952	7z.exe
Token: SeRestorePrivilege	2684	7z.exe
Token: 35	2684	7z.exe
Token: SeSecurityPrivilege	2684	7z.exe
Token: SeSecurityPrivilege	2684	7z.exe
Token: SeRestorePrivilege	1688	7z.exe
Token: 35	1688	7z.exe
Token: SeSecurityPrivilege	1688	7z.exe
Token: SeSecurityPrivilege	1688	7z.exe
Token: SeRestorePrivilege	4460	7z.exe
Token: 35	4460	7z.exe
Token: SeSecurityPrivilege	4460	7z.exe
Token: SeSecurityPrivilege	4460	7z.exe
Token: SeRestorePrivilege	1788	7z.exe
Token: 35	1788	7z.exe
Token: SeSecurityPrivilege	1788	7z.exe
Token: SeSecurityPrivilege	1788	7z.exe
Token: SeRestorePrivilege	972	7z.exe
Token: 35	972	7z.exe
Token: SeSecurityPrivilege	972	7z.exe
Token: SeSecurityPrivilege	972	7z.exe
Token: SeDebugPrivilege	4408	powershell.exe
Token: SeDebugPrivilege	5072	taskkill.exe
Token: SeDebugPrivilege	1716	taskkill.exe
Token: SeDebugPrivilege	1876	powershell.exe
Token: SeDebugPrivilege	1164	taskkill.exe
Token: SeDebugPrivilege	4976	taskkill.exe
Token: SeDebugPrivilege	3876	taskkill.exe
Token: SeDebugPrivilege	4580	firefox.exe
Token: SeDebugPrivilege	4580	firefox.exe
Token: SeDebugPrivilege	4796	CuKxXX0.exe
Token: SeDebugPrivilege	5828	powershell.exe
Token: SeDebugPrivilege	5564	5a41db7786.exe
Token: SeLockMemoryPrivilege	4352	explorer.exe
Token: SeLockMemoryPrivilege	4352	explorer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2544	91b19fc66774a862fab4409242ddc106aa1b8b03e63d661d540899e16e687f7c.exe
3644	997dbea747.exe
3644	997dbea747.exe
3644	997dbea747.exe
3644	997dbea747.exe
3644	997dbea747.exe
3644	997dbea747.exe
3644	997dbea747.exe
3644	997dbea747.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
3644	997dbea747.exe
3644	997dbea747.exe
3644	997dbea747.exe
3644	997dbea747.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3644	997dbea747.exe
3644	997dbea747.exe
3644	997dbea747.exe
3644	997dbea747.exe
3644	997dbea747.exe
3644	997dbea747.exe
3644	997dbea747.exe
3644	997dbea747.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
3644	997dbea747.exe
3644	997dbea747.exe
3644	997dbea747.exe
3644	997dbea747.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4580	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 1944	2544	91b19fc66774a862fab4409242ddc106aa1b8b03e63d661d540899e16e687f7c.exe	83
PID 2544 wrote to memory of 1944	2544	91b19fc66774a862fab4409242ddc106aa1b8b03e63d661d540899e16e687f7c.exe	83
PID 2544 wrote to memory of 1944	2544	91b19fc66774a862fab4409242ddc106aa1b8b03e63d661d540899e16e687f7c.exe	83
PID 1944 wrote to memory of 4796	1944	skotes.exe	93
PID 1944 wrote to memory of 4796	1944	skotes.exe	93
PID 1944 wrote to memory of 220	1944	skotes.exe	99
PID 1944 wrote to memory of 220	1944	skotes.exe	99
PID 1944 wrote to memory of 220	1944	skotes.exe	99
PID 1944 wrote to memory of 3892	1944	skotes.exe	100
PID 1944 wrote to memory of 3892	1944	skotes.exe	100
PID 1944 wrote to memory of 3892	1944	skotes.exe	100
PID 1944 wrote to memory of 4860	1944	skotes.exe	102
PID 1944 wrote to memory of 4860	1944	skotes.exe	102
PID 1944 wrote to memory of 4860	1944	skotes.exe	102
PID 4796 wrote to memory of 1744	4796	CuKxXX0.exe	105
PID 4796 wrote to memory of 1744	4796	CuKxXX0.exe	105
PID 3892 wrote to memory of 3304	3892	70865bd535.exe	107
PID 3892 wrote to memory of 3304	3892	70865bd535.exe	107
PID 1744 wrote to memory of 3944	1744	cmd.exe	109
PID 1744 wrote to memory of 3944	1744	cmd.exe	109
PID 3304 wrote to memory of 4336	3304	cmd.exe	110
PID 3304 wrote to memory of 4336	3304	cmd.exe	110
PID 4860 wrote to memory of 312	4860	8a122d7949.exe	111
PID 4860 wrote to memory of 312	4860	8a122d7949.exe	111
PID 4860 wrote to memory of 312	4860	8a122d7949.exe	111
PID 4860 wrote to memory of 312	4860	8a122d7949.exe	111
PID 4860 wrote to memory of 312	4860	8a122d7949.exe	111
PID 4860 wrote to memory of 312	4860	8a122d7949.exe	111
PID 4860 wrote to memory of 312	4860	8a122d7949.exe	111
PID 4860 wrote to memory of 312	4860	8a122d7949.exe	111
PID 4860 wrote to memory of 312	4860	8a122d7949.exe	111
PID 4860 wrote to memory of 312	4860	8a122d7949.exe	111
PID 3304 wrote to memory of 5012	3304	cmd.exe	112
PID 3304 wrote to memory of 5012	3304	cmd.exe	112
PID 3304 wrote to memory of 4512	3304	cmd.exe	114
PID 3304 wrote to memory of 4512	3304	cmd.exe	114
PID 3304 wrote to memory of 4952	3304	cmd.exe	115
PID 3304 wrote to memory of 4952	3304	cmd.exe	115
PID 3304 wrote to memory of 2684	3304	cmd.exe	116
PID 3304 wrote to memory of 2684	3304	cmd.exe	116
PID 3304 wrote to memory of 1688	3304	cmd.exe	117
PID 3304 wrote to memory of 1688	3304	cmd.exe	117
PID 3304 wrote to memory of 4460	3304	cmd.exe	118
PID 3304 wrote to memory of 4460	3304	cmd.exe	118
PID 1944 wrote to memory of 3644	1944	skotes.exe	119
PID 1944 wrote to memory of 3644	1944	skotes.exe	119
PID 1944 wrote to memory of 3644	1944	skotes.exe	119
PID 3304 wrote to memory of 1788	3304	cmd.exe	120
PID 3304 wrote to memory of 1788	3304	cmd.exe	120
PID 3304 wrote to memory of 972	3304	cmd.exe	121
PID 3304 wrote to memory of 972	3304	cmd.exe	121
PID 3304 wrote to memory of 1552	3304	cmd.exe	122
PID 3304 wrote to memory of 1552	3304	cmd.exe	122
PID 3304 wrote to memory of 1004	3304	cmd.exe	123
PID 3304 wrote to memory of 1004	3304	cmd.exe	123
PID 1004 wrote to memory of 3140	1004	in.exe	124
PID 1004 wrote to memory of 3140	1004	in.exe	124
PID 1004 wrote to memory of 2420	1004	in.exe	125
PID 1004 wrote to memory of 2420	1004	in.exe	125
PID 1004 wrote to memory of 640	1004	in.exe	126
PID 1004 wrote to memory of 640	1004	in.exe	126
PID 1004 wrote to memory of 4408	1004	in.exe	127
PID 1004 wrote to memory of 4408	1004	in.exe	127
PID 3644 wrote to memory of 5072	3644	997dbea747.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 3 IoCs

Hidden Files and Directories

T1564.001

pid	Process
1552	attrib.exe
2420	attrib.exe
3140	attrib.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3568
- C:\Users\Admin\AppData\Local\Temp\91b19fc66774a862fab4409242ddc106aa1b8b03e63d661d540899e16e687f7c.exe
  "C:\Users\Admin\AppData\Local\Temp\91b19fc66774a862fab4409242ddc106aa1b8b03e63d661d540899e16e687f7c.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
    "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Adds Run key to start application
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1944
  - - C:\Users\Admin\AppData\Local\Temp\1014535001\CuKxXX0.exe
      "C:\Users\Admin\AppData\Local\Temp\1014535001\CuKxXX0.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4796
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c ipconfig /release
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1744
      - C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        6⤵
        Gathers network information
        
        PID:3944
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMQAwADEANAA1ADMANQAwADAAMQBcAEMAdQBLAHgAWABYADAALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMQAwADEANAA1ADMANQAwADAAMQBcAEMAdQBLAHgAWABYADAALgBlAHgAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAFcAaQBuAGQAbwBzAEMAUABVAHMAeQBzAHQAZQBtAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAFcAaQBuAGQAbwBzAEMAUABVAHMAeQBzAHQAZQBtAC4AZQB4AGUA
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1876
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process "https://google.com"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5828
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.com/
        6⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:264
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffd81a46f8,0x7fffd81a4708,0x7fffd81a4718
        7⤵
        
        PID:700
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,15923141267740427002,14389877113587984077,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
        7⤵
        
        PID:5404
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,15923141267740427002,14389877113587984077,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5412
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,15923141267740427002,14389877113587984077,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
        7⤵
        
        PID:5444
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15923141267740427002,14389877113587984077,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
        7⤵
        
        PID:5840
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15923141267740427002,14389877113587984077,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
        7⤵
        
        PID:5820
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15923141267740427002,14389877113587984077,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
        7⤵
        
        PID:5920
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,15923141267740427002,14389877113587984077,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 /prefetch:8
        7⤵
        
        PID:6492
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,15923141267740427002,14389877113587984077,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 /prefetch:8
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6664
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15923141267740427002,14389877113587984077,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
        7⤵
        
        PID:6764
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15923141267740427002,14389877113587984077,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
        7⤵
        
        PID:6772
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15923141267740427002,14389877113587984077,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
        7⤵
        
        PID:3816
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15923141267740427002,14389877113587984077,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
        7⤵
        
        PID:6188
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c ipconfig /renew
        5⤵
        
        PID:6116
      - C:\Windows\system32\ipconfig.exe
        
        ipconfig /renew
        6⤵
        Gathers network information
        
        PID:3816
  - - C:\Users\Admin\AppData\Local\Temp\1014550001\7930f0cde9.exe
      "C:\Users\Admin\AppData\Local\Temp\1014550001\7930f0cde9.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:220
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 464
        5⤵
        Program crash
        
        PID:5424
  - - C:\Users\Admin\AppData\Local\Temp\1014551001\70865bd535.exe
      "C:\Users\Admin\AppData\Local\Temp\1014551001\70865bd535.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3892
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3304
      - C:\Windows\system32\mode.com
        
        mode 65,10
        6⤵
        
        PID:4336
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e file.zip -p24291711423417250691697322505 -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_7.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:4512
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_6.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:4952
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_5.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2684
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_4.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1688
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_3.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_2.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1788
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_1.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:972
      - C:\Windows\system32\attrib.exe
        
        attrib +H "in.exe"
        6⤵
        Views/modifies file attributes
        
        PID:1552
      - C:\Users\Admin\AppData\Local\Temp\main\in.exe
        
        "in.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1004
        
        C:\Windows\SYSTEM32\attrib.exe
        
        attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
        7⤵
        Views/modifies file attributes
        
        PID:3140
        
        C:\Windows\SYSTEM32\attrib.exe
        
        attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
        7⤵
        Views/modifies file attributes
        
        PID:2420
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:640
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell ping 127.0.0.1; del in.exe
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4408
        
        C:\Windows\system32\PING.EXE
        
        "C:\Windows\system32\PING.EXE" 127.0.0.1
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1496
  - - C:\Users\Admin\AppData\Local\Temp\1014552001\8a122d7949.exe
      "C:\Users\Admin\AppData\Local\Temp\1014552001\8a122d7949.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4860
    - - C:\Users\Admin\AppData\Local\Temp\1014552001\8a122d7949.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014552001\8a122d7949.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:312
  - - C:\Users\Admin\AppData\Local\Temp\1014553001\997dbea747.exe
      "C:\Users\Admin\AppData\Local\Temp\1014553001\997dbea747.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3644
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM firefox.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5072
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1716
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1164
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4976
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3876
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
        5⤵
        
        PID:2744
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        6⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:4580
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2032 -parentBuildID 20240401114208 -prefsHandle 1948 -prefMapHandle 1940 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bc497c2f-0b10-491c-9a09-85e2592bdcd0} 4580 "\\.\pipe\gecko-crash-server-pipe.4580" gpu
        7⤵
        
        PID:4300
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2468 -parentBuildID 20240401114208 -prefsHandle 2460 -prefMapHandle 2448 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7b524739-c8a5-4ade-889f-285acc33981a} 4580 "\\.\pipe\gecko-crash-server-pipe.4580" socket
        7⤵
        
        PID:3936
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3184 -childID 1 -isForBrowser -prefsHandle 3176 -prefMapHandle 3196 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 952 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {300100f7-85ea-4547-a55f-6963f9c7b9a4} 4580 "\\.\pipe\gecko-crash-server-pipe.4580" tab
        7⤵
        
        PID:2092
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3628 -childID 2 -isForBrowser -prefsHandle 3684 -prefMapHandle 3680 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 952 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d5e4fc54-7d8d-4edf-8dee-3184dc657cdc} 4580 "\\.\pipe\gecko-crash-server-pipe.4580" tab
        7⤵
        
        PID:4236
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4600 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4640 -prefMapHandle 4704 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e861f7cd-81e4-41df-8b9d-d0c38a1f72c0} 4580 "\\.\pipe\gecko-crash-server-pipe.4580" utility
        7⤵
        Checks processor information in registry
        
        PID:5136
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5260 -childID 3 -isForBrowser -prefsHandle 4844 -prefMapHandle 3672 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 952 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d4686d9-84e8-47fd-bab4-d622182813c5} 4580 "\\.\pipe\gecko-crash-server-pipe.4580" tab
        7⤵
        
        PID:1460
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5404 -childID 4 -isForBrowser -prefsHandle 5356 -prefMapHandle 5224 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 952 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9730b3a4-f7a0-4ff0-a7ef-6f0120ca1fb6} 4580 "\\.\pipe\gecko-crash-server-pipe.4580" tab
        7⤵
        
        PID:4728
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5580 -childID 5 -isForBrowser -prefsHandle 5588 -prefMapHandle 5592 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 952 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {80fa8ba4-1184-4868-95d3-9fea9aa9e789} 4580 "\\.\pipe\gecko-crash-server-pipe.4580" tab
        7⤵
        
        PID:2548
  - - C:\Users\Admin\AppData\Local\Temp\1014554001\48645698b3.exe
      "C:\Users\Admin\AppData\Local\Temp\1014554001\48645698b3.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1416
  - - C:\Users\Admin\AppData\Local\Temp\1014555001\5a41db7786.exe
      "C:\Users\Admin\AppData\Local\Temp\1014555001\5a41db7786.exe"
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Windows security modification
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5564
  - - C:\Users\Admin\AppData\Local\Temp\1014556001\d9cd65d215.exe
      "C:\Users\Admin\AppData\Local\Temp\1014556001\d9cd65d215.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      PID:3644
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1014556001\d9cd65d215.exe" & rd /s /q "C:\ProgramData\1NYU3OHDJMYU" & exit
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6972
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        6⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:7088
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 2020
        5⤵
        Program crash
        
        PID:7140
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  PID:5980
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:4352

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5424

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3644 -ip 3644
1⤵
PID:7052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 220 -ip 220
1⤵
PID:6752

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4468

C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
1⤵
- Executes dropped EXE
PID:6592
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  PID:3352
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5388
- - C:\Windows\system32\PING.EXE
    "C:\Windows\system32\PING.EXE" 127.1.10.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:6224

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
PID:5752

C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
1⤵
PID:6056
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  PID:6428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3720
- - C:\Windows\system32\PING.EXE
    "C:\Windows\system32\PING.EXE" 127.1.10.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

Remote System Discovery

T1018

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion