amadey | 172e1e49642648745fefdbebd4c76c41049a4f0edd14eeb7904b709f0add5cbc

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	134c278d06.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	134c278d06.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	134c278d06.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	134c278d06.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	134c278d06.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	134c278d06.exe

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs

Query Registry

Virtualization/Sandbox Evasion

credential_access stealer

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	78275a6623.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	172e1e49642648745fefdbebd4c76c41049a4f0edd14eeb7904b709f0add5cbc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	c4f5c24689.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	134c278d06.exe

Renames multiple (1944) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Downloads MZ/PE file

Uses browser remote debugging 2 TTPs 4 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

Steal Web Session Cookie

T1539

Modify Authentication Process

pid	Process
2692	chrome.exe
2884	chrome.exe
2668	chrome.exe
2532	chrome.exe

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	134c278d06.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	172e1e49642648745fefdbebd4c76c41049a4f0edd14eeb7904b709f0add5cbc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	172e1e49642648745fefdbebd4c76c41049a4f0edd14eeb7904b709f0add5cbc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	c4f5c24689.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	c4f5c24689.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	78275a6623.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	134c278d06.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	78275a6623.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aswin.vbs	BlueMail.exe

Executes dropped EXE 20 IoCs

pid	Process
2836	skotes.exe
908	4ZD5C3i.exe
2548	BlueMail.exe
5200	2018e41cd7.exe
5296	a1956eb5d4.exe
5508	4cc3773929.exe
5620	7z.exe
5664	7z.exe
5768	7z.exe
5868	7z.exe
4428	7z.exe
1388	7z.exe
1736	c4f5c24689.exe
3148	7z.exe
4424	7z.exe
5468	in.exe
4724	134c278d06.exe
5028	78676fc50e.exe
736	78275a6623.exe
4940	9044d27067.exe

Identifies Wine through registry keys 2 TTPs 5 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	172e1e49642648745fefdbebd4c76c41049a4f0edd14eeb7904b709f0add5cbc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	c4f5c24689.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	134c278d06.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	78275a6623.exe

Loads dropped DLL 41 IoCs

pid	Process
2796	172e1e49642648745fefdbebd4c76c41049a4f0edd14eeb7904b709f0add5cbc.exe
2836	skotes.exe
2836	skotes.exe
2836	skotes.exe
2836	skotes.exe
2836	skotes.exe
2836	skotes.exe
2836	skotes.exe
5564	cmd.exe
5620	7z.exe
5564	cmd.exe
5664	7z.exe
5564	cmd.exe
5768	7z.exe
5564	cmd.exe
5868	7z.exe
5564	cmd.exe
4428	7z.exe
5564	cmd.exe
1388	7z.exe
2836	skotes.exe
5564	cmd.exe
3148	7z.exe
5564	cmd.exe
4424	7z.exe
5564	cmd.exe
5564	cmd.exe
2836	skotes.exe
2836	skotes.exe
2836	skotes.exe
2836	skotes.exe
2836	skotes.exe
2836	skotes.exe
3480	WerFault.exe
3480	WerFault.exe
3480	WerFault.exe
3480	WerFault.exe
3480	WerFault.exe
2836	skotes.exe
1736	c4f5c24689.exe
1736	c4f5c24689.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	134c278d06.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	134c278d06.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\4cc3773929.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1014868001\\4cc3773929.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\c4f5c24689.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1014869001\\c4f5c24689.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\134c278d06.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1014870001\\134c278d06.exe"	skotes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\F:	4ZD5C3i.exe
File opened (read-only)	\??\Z:	4ZD5C3i.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x0002000000010309-1306.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
2796	172e1e49642648745fefdbebd4c76c41049a4f0edd14eeb7904b709f0add5cbc.exe
2836	skotes.exe
1736	c4f5c24689.exe
4724	134c278d06.exe
736	78275a6623.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0004000000020485-3119.dat	upx
behavioral1/memory/5468-3320-0x000000013F400000-0x000000013F890000-memory.dmp	upx
behavioral1/memory/5388-7002-0x000000013F4C0000-0x000000013F950000-memory.dmp	upx
behavioral1/memory/5388-7612-0x000000013F4C0000-0x000000013F950000-memory.dmp	upx
behavioral1/memory/3764-19235-0x000000013F930000-0x000000013FDC0000-memory.dmp	upx
behavioral1/memory/3764-19246-0x000000013F930000-0x000000013FDC0000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\STSUPLD.DLL	4ZD5C3i.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\WhiteDot.png	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0304933.WMF	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\POWERPNT.DEV_COL.HXT	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\POWERPNT.DEV_K_COL.HXK	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\Microsoft.Office.InfoPath.xml	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00170_.GIF	4ZD5C3i.exe
File created	C:\Program Files (x86)\README.TXT	4ZD5C3i.exe
File opened for modification	C:\Program Files\7-Zip\README.TXT	4ZD5C3i.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	4ZD5C3i.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_Buttongraphic.png	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0302953.JPG	4ZD5C3i.exe
File created	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\README.TXT	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.Office.BusinessData.xml	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\mscss7wre_fr.dub	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\IPDSINTL.DLL	4ZD5C3i.exe
File opened for modification	C:\Program Files\Java\jre7\lib\plugin.jar	4ZD5C3i.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_babypink_Thumbnail.bmp	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Opulent.xml	4ZD5C3i.exe
File created	C:\Program Files\Java\jre7\lib\amd64\README.TXT	4ZD5C3i.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\reader\README.TXT	4ZD5C3i.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\README.TXT	4ZD5C3i.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\README.TXT	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\ACCVDTUI.DLL	4ZD5C3i.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\mlib_image.dll	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN03500_.WMF	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00045_.WMF	4ZD5C3i.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	4ZD5C3i.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\1033\README.TXT	4ZD5C3i.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\README.TXT	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\OIS_COL.HXT	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\MSACCESS.DEV_F_COL.HXK	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSSP7EN.dub	4ZD5C3i.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\en-US\README.TXT	4ZD5C3i.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\README.TXT	4ZD5C3i.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Biscay\README.TXT	4ZD5C3i.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jsdt.dll	4ZD5C3i.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Basic\README.TXT	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\XLSLICER.DLL.IDX_DLL	4ZD5C3i.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\EST	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Urban.eftx	4ZD5C3i.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\README.TXT	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Median.xml	4ZD5C3i.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jawt.dll	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0240719.WMF	4ZD5C3i.exe
File created	C:\Program Files\Microsoft Games\More Games\en-US\README.TXT	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OART.DLL	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEIRM.XML	4ZD5C3i.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\Chkr.dll	4ZD5C3i.exe
File opened for modification	C:\Program Files\Java\jre7\lib\ext\jaccess.jar	4ZD5C3i.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\README.TXT	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OFFRHD.DLL	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\SLERROR.XML	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\WORDIRMV.XML	4ZD5C3i.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\Mahjong.dll	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSSP7FR.LEX	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0287005.WMF	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0299125.WMF	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\MSACCESS.DEV_K_COL.HXK	4ZD5C3i.exe
File opened for modification	C:\Program Files\Java\jre7\lib\ext\zipfs.jar	4ZD5C3i.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\README.TXT	4ZD5C3i.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\EntityPicker.dll	4ZD5C3i.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ru.jar	4ZD5C3i.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	172e1e49642648745fefdbebd4c76c41049a4f0edd14eeb7904b709f0add5cbc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3480	2548	WerFault.exe	36

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	4cc3773929.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	134c278d06.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2018e41cd7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4cc3773929.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	4cc3773929.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BlueMail.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	78676fc50e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4ZD5C3i.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c4f5c24689.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	172e1e49642648745fefdbebd4c76c41049a4f0edd14eeb7904b709f0add5cbc.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
832	PING.EXE
3596	powershell.exe
5824	powershell.exe
4444	PING.EXE
2236	powershell.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	c4f5c24689.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	c4f5c24689.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Delays execution with timeout.exe 1 IoCs

pid	Process
2604	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 30 IoCs

pid	Process
2840	taskkill.exe
3624	taskkill.exe
3476	taskkill.exe
5060	taskkill.exe
3144	taskkill.exe
4896	taskkill.exe
3924	taskkill.exe
2724	taskkill.exe
4436	taskkill.exe
4048	taskkill.exe
3504	taskkill.exe
340	taskkill.exe
3480	taskkill.exe
3108	taskkill.exe
4924	taskkill.exe
5128	taskkill.exe
5628	taskkill.exe
3036	taskkill.exe
4996	taskkill.exe
5384	taskkill.exe
3732	taskkill.exe
2968	taskkill.exe
4752	taskkill.exe
5404	taskkill.exe
4656	taskkill.exe
2964	taskkill.exe
3504	taskkill.exe
5692	taskkill.exe
3548	taskkill.exe
3020	taskkill.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
4444	PING.EXE
832	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
5772	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2796	172e1e49642648745fefdbebd4c76c41049a4f0edd14eeb7904b709f0add5cbc.exe
2836	skotes.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
5508	4cc3773929.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe
908	4ZD5C3i.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	908	4ZD5C3i.exe
Token: SeBackupPrivilege	2160	vssvc.exe
Token: SeRestorePrivilege	2160	vssvc.exe
Token: SeAuditPrivilege	2160	vssvc.exe
Token: SeDebugPrivilege	2548	BlueMail.exe
Token: SeRestorePrivilege	5620	7z.exe
Token: 35	5620	7z.exe
Token: SeSecurityPrivilege	5620	7z.exe
Token: SeSecurityPrivilege	5620	7z.exe
Token: SeRestorePrivilege	5664	7z.exe
Token: 35	5664	7z.exe
Token: SeSecurityPrivilege	5664	7z.exe
Token: SeSecurityPrivilege	5664	7z.exe
Token: SeDebugPrivilege	5692	taskkill.exe
Token: SeRestorePrivilege	5768	7z.exe
Token: 35	5768	7z.exe
Token: SeSecurityPrivilege	5768	7z.exe
Token: SeSecurityPrivilege	5768	7z.exe
Token: SeRestorePrivilege	5868	7z.exe
Token: 35	5868	7z.exe
Token: SeSecurityPrivilege	5868	7z.exe
Token: SeSecurityPrivilege	5868	7z.exe
Token: SeRestorePrivilege	4428	7z.exe
Token: 35	4428	7z.exe
Token: SeSecurityPrivilege	4428	7z.exe
Token: SeSecurityPrivilege	4428	7z.exe
Token: SeRestorePrivilege	1388	7z.exe
Token: 35	1388	7z.exe
Token: SeSecurityPrivilege	1388	7z.exe
Token: SeSecurityPrivilege	1388	7z.exe
Token: SeRestorePrivilege	3148	7z.exe
Token: 35	3148	7z.exe
Token: SeSecurityPrivilege	3148	7z.exe
Token: SeSecurityPrivilege	3148	7z.exe
Token: SeRestorePrivilege	4424	7z.exe
Token: 35	4424	7z.exe
Token: SeSecurityPrivilege	4424	7z.exe
Token: SeSecurityPrivilege	4424	7z.exe
Token: SeDebugPrivilege	3548	taskkill.exe
Token: SeDebugPrivilege	5384	taskkill.exe
Token: SeDebugPrivilege	5824	powershell.exe
Token: SeDebugPrivilege	2724	taskkill.exe
Token: SeDebugPrivilege	3504	taskkill.exe
Token: SeDebugPrivilege	2548	BlueMail.exe
Token: SeDebugPrivilege	4724	134c278d06.exe
Token: SeDebugPrivilege	4436	taskkill.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe
Token: SeShutdownPrivilege	2532	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2796	172e1e49642648745fefdbebd4c76c41049a4f0edd14eeb7904b709f0add5cbc.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
2532	chrome.exe
4968	firefox.exe
4968	firefox.exe

Suspicious use of SendNotifyMessage 63 IoCs

pid	Process
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
5508	4cc3773929.exe
4968	firefox.exe
4968	firefox.exe
5508	4cc3773929.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 2836	2796	172e1e49642648745fefdbebd4c76c41049a4f0edd14eeb7904b709f0add5cbc.exe	30
PID 2796 wrote to memory of 2836	2796	172e1e49642648745fefdbebd4c76c41049a4f0edd14eeb7904b709f0add5cbc.exe	30
PID 2796 wrote to memory of 2836	2796	172e1e49642648745fefdbebd4c76c41049a4f0edd14eeb7904b709f0add5cbc.exe	30
PID 2796 wrote to memory of 2836	2796	172e1e49642648745fefdbebd4c76c41049a4f0edd14eeb7904b709f0add5cbc.exe	30
PID 2836 wrote to memory of 908	2836	skotes.exe	32
PID 2836 wrote to memory of 908	2836	skotes.exe	32
PID 2836 wrote to memory of 908	2836	skotes.exe	32
PID 2836 wrote to memory of 908	2836	skotes.exe	32
PID 2836 wrote to memory of 2548	2836	skotes.exe	36
PID 2836 wrote to memory of 2548	2836	skotes.exe	36
PID 2836 wrote to memory of 2548	2836	skotes.exe	36
PID 2836 wrote to memory of 2548	2836	skotes.exe	36
PID 2836 wrote to memory of 5200	2836	skotes.exe	37
PID 2836 wrote to memory of 5200	2836	skotes.exe	37
PID 2836 wrote to memory of 5200	2836	skotes.exe	37
PID 2836 wrote to memory of 5200	2836	skotes.exe	37
PID 2836 wrote to memory of 5296	2836	skotes.exe	38
PID 2836 wrote to memory of 5296	2836	skotes.exe	38
PID 2836 wrote to memory of 5296	2836	skotes.exe	38
PID 2836 wrote to memory of 5296	2836	skotes.exe	38
PID 2836 wrote to memory of 5508	2836	skotes.exe	40
PID 2836 wrote to memory of 5508	2836	skotes.exe	40
PID 2836 wrote to memory of 5508	2836	skotes.exe	40
PID 2836 wrote to memory of 5508	2836	skotes.exe	40
PID 5200 wrote to memory of 5564	5200	2018e41cd7.exe	41
PID 5200 wrote to memory of 5564	5200	2018e41cd7.exe	41
PID 5200 wrote to memory of 5564	5200	2018e41cd7.exe	41
PID 5200 wrote to memory of 5564	5200	2018e41cd7.exe	41
PID 5564 wrote to memory of 5596	5564	cmd.exe	43
PID 5564 wrote to memory of 5596	5564	cmd.exe	43
PID 5564 wrote to memory of 5596	5564	cmd.exe	43
PID 5564 wrote to memory of 5620	5564	cmd.exe	44
PID 5564 wrote to memory of 5620	5564	cmd.exe	44
PID 5564 wrote to memory of 5620	5564	cmd.exe	44
PID 5564 wrote to memory of 5664	5564	cmd.exe	45
PID 5564 wrote to memory of 5664	5564	cmd.exe	45
PID 5564 wrote to memory of 5664	5564	cmd.exe	45
PID 5508 wrote to memory of 5692	5508	4cc3773929.exe	46
PID 5508 wrote to memory of 5692	5508	4cc3773929.exe	46
PID 5508 wrote to memory of 5692	5508	4cc3773929.exe	46
PID 5508 wrote to memory of 5692	5508	4cc3773929.exe	46
PID 5564 wrote to memory of 5768	5564	cmd.exe	48
PID 5564 wrote to memory of 5768	5564	cmd.exe	48
PID 5564 wrote to memory of 5768	5564	cmd.exe	48
PID 5564 wrote to memory of 5868	5564	cmd.exe	49
PID 5564 wrote to memory of 5868	5564	cmd.exe	49
PID 5564 wrote to memory of 5868	5564	cmd.exe	49
PID 5564 wrote to memory of 4428	5564	cmd.exe	50
PID 5564 wrote to memory of 4428	5564	cmd.exe	50
PID 5564 wrote to memory of 4428	5564	cmd.exe	50
PID 5508 wrote to memory of 3548	5508	4cc3773929.exe	51
PID 5508 wrote to memory of 3548	5508	4cc3773929.exe	51
PID 5508 wrote to memory of 3548	5508	4cc3773929.exe	51
PID 5508 wrote to memory of 3548	5508	4cc3773929.exe	51
PID 5564 wrote to memory of 1388	5564	cmd.exe	54
PID 5564 wrote to memory of 1388	5564	cmd.exe	54
PID 5564 wrote to memory of 1388	5564	cmd.exe	54
PID 2836 wrote to memory of 1736	2836	skotes.exe	55
PID 2836 wrote to memory of 1736	2836	skotes.exe	55
PID 2836 wrote to memory of 1736	2836	skotes.exe	55
PID 2836 wrote to memory of 1736	2836	skotes.exe	55
PID 5564 wrote to memory of 3148	5564	cmd.exe	56
PID 5564 wrote to memory of 3148	5564	cmd.exe	56
PID 5564 wrote to memory of 3148	5564	cmd.exe	56

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 3 IoCs

Hidden Files and Directories

T1564.001

pid	Process
2588	attrib.exe
5816	attrib.exe
5720	attrib.exe

C:\Users\Admin\AppData\Local\Temp\172e1e49642648745fefdbebd4c76c41049a4f0edd14eeb7904b709f0add5cbc.exe
"C:\Users\Admin\AppData\Local\Temp\172e1e49642648745fefdbebd4c76c41049a4f0edd14eeb7904b709f0add5cbc.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
  "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Users\Admin\AppData\Local\Temp\1014798001\4ZD5C3i.exe
    "C:\Users\Admin\AppData\Local\Temp\1014798001\4ZD5C3i.exe"
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:908
- - C:\Users\Admin\AppData\Local\Temp\1014844001\BlueMail.exe
    "C:\Users\Admin\AppData\Local\Temp\1014844001\BlueMail.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2548
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 648
      4⤵
      Loads dropped DLL
      Program crash
      PID:3480
- - C:\Users\Admin\AppData\Local\Temp\1014866001\2018e41cd7.exe
    "C:\Users\Admin\AppData\Local\Temp\1014866001\2018e41cd7.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5200
  - - C:\Windows\system32\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:5564
    - - C:\Windows\system32\mode.com
        
        mode 65,10
        5⤵
        
        PID:5596
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e file.zip -p24291711423417250691697322505 -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_7.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:5664
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_6.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:5768
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_5.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:5868
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_4.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:4428
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_3.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1388
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_2.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:3148
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_1.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:4424
    - - C:\Windows\system32\attrib.exe
        
        attrib +H "in.exe"
        5⤵
        Views/modifies file attributes
        
        PID:2588
    - - C:\Users\Admin\AppData\Local\Temp\main\in.exe
        
        "in.exe"
        5⤵
        Executes dropped EXE
        
        PID:5468
      - C:\Windows\system32\attrib.exe
        
        attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
        6⤵
        Views/modifies file attributes
        
        PID:5720
      - C:\Windows\system32\attrib.exe
        
        attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
        6⤵
        Views/modifies file attributes
        
        PID:5816
      - C:\Windows\system32\schtasks.exe
        
        schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5772
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell ping 127.0.0.1; del in.exe
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5824
        
        C:\Windows\system32\PING.EXE
        
        "C:\Windows\system32\PING.EXE" 127.0.0.1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4444
- - C:\Users\Admin\AppData\Local\Temp\1014867001\a1956eb5d4.exe
    "C:\Users\Admin\AppData\Local\Temp\1014867001\a1956eb5d4.exe"
    3⤵
    - Executes dropped EXE
    PID:5296
- - C:\Users\Admin\AppData\Local\Temp\1014868001\4cc3773929.exe
    "C:\Users\Admin\AppData\Local\Temp\1014868001\4cc3773929.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:5508
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM firefox.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5692
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM chrome.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3548
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM msedge.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5384
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM opera.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2724
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM brave.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3504
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
      4⤵
      PID:4948
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        5⤵
        Checks processor information in registry
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4968
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4968.0.1827170741\873624169" -parentBuildID 20221007134813 -prefsHandle 1220 -prefMapHandle 1212 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {df57060c-96e3-4abe-a299-a242ee47cd8a} 4968 "\\.\pipe\gecko-crash-server-pipe.4968" 1296 6af7458 gpu
        6⤵
        
        PID:3516
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4968.1.929862181\1352770439" -parentBuildID 20221007134813 -prefsHandle 1564 -prefMapHandle 1560 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b8596046-4626-4364-a7ab-b481c151f4e1} 4968 "\\.\pipe\gecko-crash-server-pipe.4968" 1576 ee5458 socket
        6⤵
        
        PID:2868
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4968.2.190489334\1678946483" -childID 1 -isForBrowser -prefsHandle 2148 -prefMapHandle 2144 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dd57f56f-2172-4c78-b8dc-ca6aa340acb8} 4968 "\\.\pipe\gecko-crash-server-pipe.4968" 2160 1a39fc58 tab
        6⤵
        
        PID:5432
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM firefox.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4436
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM chrome.exe /T
      4⤵
      Kills process with taskkill
      PID:3476
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM msedge.exe /T
      4⤵
      Kills process with taskkill
      PID:5060
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM opera.exe /T
      4⤵
      Kills process with taskkill
      PID:3020
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM brave.exe /T
      4⤵
      Kills process with taskkill
      PID:3108
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
      4⤵
      PID:2816
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        5⤵
        
        PID:3092
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3092.0.1454607305\1117519221" -parentBuildID 20221007134813 -prefsHandle 1204 -prefMapHandle 1184 -prefsLen 20847 -prefMapSize 233496 -appDir "C:\Program Files\Mozilla Firefox\browser" - {52c9a697-9859-4a23-a660-a2c935ee641e} 3092 "\\.\pipe\gecko-crash-server-pipe.3092" 1292 45f8a58 gpu
        6⤵
        
        PID:2696
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3092.1.1285296361\452755522" -parentBuildID 20221007134813 -prefsHandle 1464 -prefMapHandle 1460 -prefsLen 21708 -prefMapSize 233496 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bc7adb6e-1a84-42a5-bae6-f1c3c3c52ade} 3092 "\\.\pipe\gecko-crash-server-pipe.3092" 1476 45fa558 socket
        6⤵
        
        PID:5440
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3092.2.1806598542\341333111" -childID 1 -isForBrowser -prefsHandle 684 -prefMapHandle 1860 -prefsLen 21746 -prefMapSize 233496 -jsInitHandle 668 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {319ea8e0-7aa8-4ddf-9a2b-57651f856424} 3092 "\\.\pipe\gecko-crash-server-pipe.3092" 1780 193b2358 tab
        6⤵
        
        PID:5716
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM firefox.exe /T
      4⤵
      Kills process with taskkill
      PID:3732
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM chrome.exe /T
      4⤵
      Kills process with taskkill
      PID:4752
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM msedge.exe /T
      4⤵
      Kills process with taskkill
      PID:5628
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM opera.exe /T
      4⤵
      Kills process with taskkill
      PID:2968
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM brave.exe /T
      4⤵
      Kills process with taskkill
      PID:4896
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
      4⤵
      PID:5380
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        5⤵
        
        PID:4360
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4360.0.1066974991\907689665" -parentBuildID 20221007134813 -prefsHandle 1192 -prefMapHandle 1184 -prefsLen 20847 -prefMapSize 233496 -appDir "C:\Program Files\Mozilla Firefox\browser" - {48b9ded2-569e-424d-8baa-2f4fb25a4592} 4360 "\\.\pipe\gecko-crash-server-pipe.4360" 1312 4247558 gpu
        6⤵
        
        PID:3132
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4360.1.1519758892\27899341" -parentBuildID 20221007134813 -prefsHandle 1492 -prefMapHandle 1488 -prefsLen 21708 -prefMapSize 233496 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e507cc7d-e34f-4049-af08-4ff8862cbecd} 4360 "\\.\pipe\gecko-crash-server-pipe.4360" 1504 e71858 socket
        6⤵
        
        PID:5100
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4360.2.1939380650\656626031" -childID 1 -isForBrowser -prefsHandle 1928 -prefMapHandle 1836 -prefsLen 21746 -prefMapSize 233496 -jsInitHandle 552 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f955138b-b66b-470c-a4ff-a52c945e9efd} 4360 "\\.\pipe\gecko-crash-server-pipe.4360" 1860 19916c58 tab
        6⤵
        
        PID:1976
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4360.3.438775046\362666361" -childID 2 -isForBrowser -prefsHandle 2896 -prefMapHandle 2892 -prefsLen 26216 -prefMapSize 233496 -jsInitHandle 552 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {885eac7d-2090-4798-a99f-33f1c450e871} 4360 "\\.\pipe\gecko-crash-server-pipe.4360" 2908 1e19cb58 tab
        6⤵
        
        PID:1860
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM firefox.exe /T
      4⤵
      Kills process with taskkill
      PID:5404
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM chrome.exe /T
      4⤵
      Kills process with taskkill
      PID:340
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM msedge.exe /T
      4⤵
      Kills process with taskkill
      PID:4656
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM opera.exe /T
      4⤵
      Kills process with taskkill
      PID:4924
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM brave.exe /T
      4⤵
      Kills process with taskkill
      PID:2964
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
      4⤵
      PID:5852
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        5⤵
        
        PID:5728
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5728.0.1525834202\7016718" -parentBuildID 20221007134813 -prefsHandle 1172 -prefMapHandle 1044 -prefsLen 20847 -prefMapSize 233496 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3eedf060-1acd-4b15-98ca-2d1f0c6dd0b8} 5728 "\\.\pipe\gecko-crash-server-pipe.5728" 1288 12ac6758 gpu
        6⤵
        
        PID:3224
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5728.1.83820273\1725187077" -parentBuildID 20221007134813 -prefsHandle 1484 -prefMapHandle 1480 -prefsLen 21708 -prefMapSize 233496 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fee131a8-6c9a-4c3b-9fb2-280656cc192e} 5728 "\\.\pipe\gecko-crash-server-pipe.5728" 1496 41da258 socket
        6⤵
        
        PID:3084
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5728.2.1340748061\777633316" -childID 1 -isForBrowser -prefsHandle 1820 -prefMapHandle 1660 -prefsLen 21746 -prefMapSize 233496 -jsInitHandle 572 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c98c3ade-5c3f-405a-abb9-4af8dfd3030a} 5728 "\\.\pipe\gecko-crash-server-pipe.5728" 1832 1a48a858 tab
        6⤵
        
        PID:5908
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM firefox.exe /T
      4⤵
      Kills process with taskkill
      PID:3144
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM chrome.exe /T
      4⤵
      Kills process with taskkill
      PID:3924
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM msedge.exe /T
      4⤵
      Kills process with taskkill
      PID:3504
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM opera.exe /T
      4⤵
      Kills process with taskkill
      PID:3480
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM brave.exe /T
      4⤵
      Kills process with taskkill
      PID:3036
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
      4⤵
      PID:3852
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        5⤵
        
        PID:1884
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1884.0.1078925436\452274008" -parentBuildID 20221007134813 -prefsHandle 1036 -prefMapHandle 1004 -prefsLen 20847 -prefMapSize 233496 -appDir "C:\Program Files\Mozilla Firefox\browser" - {89390ca6-c77a-4c85-8942-458bf4a5f13a} 1884 "\\.\pipe\gecko-crash-server-pipe.1884" 1112 f1db758 gpu
        6⤵
        
        PID:3808
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        6⤵
        
        PID:1372
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        7⤵
        
        PID:4084
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM firefox.exe /T
      4⤵
      Kills process with taskkill
      PID:2840
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM chrome.exe /T
      4⤵
      Kills process with taskkill
      PID:4996
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM msedge.exe /T
      4⤵
      Kills process with taskkill
      PID:4048
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM opera.exe /T
      4⤵
      Kills process with taskkill
      PID:3624
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM brave.exe /T
      4⤵
      Kills process with taskkill
      PID:5128
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
      4⤵
      PID:3408
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        5⤵
        
        PID:516
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="516.0.1434179757\117111952" -parentBuildID 20221007134813 -prefsHandle 1036 -prefMapHandle 1028 -prefsLen 20847 -prefMapSize 233496 -appDir "C:\Program Files\Mozilla Firefox\browser" - {32bf026b-33b5-4f88-9542-c5df61612bae} 516 "\\.\pipe\gecko-crash-server-pipe.516" 1120 f3de758 gpu
        6⤵
        
        PID:4748
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        6⤵
        
        PID:3492
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        7⤵
        
        PID:4956
- - C:\Users\Admin\AppData\Local\Temp\1014869001\c4f5c24689.exe
    "C:\Users\Admin\AppData\Local\Temp\1014869001\c4f5c24689.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    PID:1736
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:2532
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7329758,0x7fef7329768,0x7fef7329778
        5⤵
        
        PID:4684
    - - C:\Windows\system32\ctfmon.exe
        
        ctfmon.exe
        5⤵
        
        PID:628
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1184 --field-trial-handle=1320,i,6027930974630167265,330453567373107978,131072 /prefetch:2
        5⤵
        
        PID:2800
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1548 --field-trial-handle=1320,i,6027930974630167265,330453567373107978,131072 /prefetch:8
        5⤵
        
        PID:1752
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1616 --field-trial-handle=1320,i,6027930974630167265,330453567373107978,131072 /prefetch:8
        5⤵
        
        PID:4804
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2176 --field-trial-handle=1320,i,6027930974630167265,330453567373107978,131072 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2692
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2676 --field-trial-handle=1320,i,6027930974630167265,330453567373107978,131072 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2668
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2692 --field-trial-handle=1320,i,6027930974630167265,330453567373107978,131072 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2884
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1332 --field-trial-handle=1320,i,6027930974630167265,330453567373107978,131072 /prefetch:2
        5⤵
        
        PID:3796
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2540 --field-trial-handle=1320,i,6027930974630167265,330453567373107978,131072 /prefetch:8
        5⤵
        
        PID:4760
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\Documents\EHJJKFCBGI.exe"
      4⤵
      PID:5188
    - - C:\Users\Admin\Documents\EHJJKFCBGI.exe
        
        "C:\Users\Admin\Documents\EHJJKFCBGI.exe"
        5⤵
        
        PID:3112
- - C:\Users\Admin\AppData\Local\Temp\1014870001\134c278d06.exe
    "C:\Users\Admin\AppData\Local\Temp\1014870001\134c278d06.exe"
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Windows security modification
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4724
- - C:\Users\Admin\AppData\Local\Temp\1014871001\78676fc50e.exe
    "C:\Users\Admin\AppData\Local\Temp\1014871001\78676fc50e.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5028
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1014871001\78676fc50e.exe" & rd /s /q "C:\ProgramData\P89R1VSJEKFU" & exit
      4⤵
      PID:2352
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        5⤵
        Delays execution with timeout.exe
        
        PID:2604
- - C:\Users\Admin\AppData\Local\Temp\1014872001\78275a6623.exe
    "C:\Users\Admin\AppData\Local\Temp\1014872001\78275a6623.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:736
- - C:\Users\Admin\AppData\Local\Temp\1014873001\9044d27067.exe
    "C:\Users\Admin\AppData\Local\Temp\1014873001\9044d27067.exe"
    3⤵
    - Executes dropped EXE
    PID:4940

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2160

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3504

C:\Windows\system32\taskeng.exe
taskeng.exe {793D50B1-1975-45F4-B6C2-7E49F0CE56A2} S-1-5-21-3692679935-4019334568-335155002-1000:BCXRJFKE\Admin:Interactive:[1]
1⤵
PID:4228
- C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  2⤵
  PID:5388
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:5148
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:2236
  - - C:\Windows\system32\PING.EXE
      "C:\Windows\system32\PING.EXE" 127.1.10.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:832
- C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  2⤵
  PID:3764
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:4852
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Modify Authentication Process

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Authentication Process

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion