amadey | eadbad94a4ef1b106f1309fdde748c49d606fc04589fc079853292b0c4ee136f

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	600966828e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	600966828e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	600966828e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	600966828e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	600966828e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	600966828e.exe

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc
Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	79290f4310.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	600966828e.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	file.exe

XMRig Miner payload 16 IoCs

miner

resource	yara_rule
behavioral1/memory/2780-160-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral1/memory/2780-161-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral1/memory/2780-162-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral1/memory/2780-163-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral1/memory/2780-164-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral1/memory/2780-165-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral1/memory/2780-166-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral1/memory/2780-190-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral1/memory/2780-192-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral1/memory/2780-196-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral1/memory/4092-495-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral1/memory/4092-497-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral1/memory/4092-501-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral1/memory/3492-539-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral1/memory/3492-541-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral1/memory/3492-543-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	79290f4310.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	79290f4310.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	600966828e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	600966828e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe

Executes dropped EXE 17 IoCs

pid	Process
2796	skotes.exe
1656	3cba16e1a2.exe
2912	7z.exe
2936	7z.exe
1184	7z.exe
2172	7z.exe
2576	7z.exe
1396	7z.exe
2772	7z.exe
1224	7z.exe
2268	5d1149c872.exe
1712	in.exe
1168	Intel_PTT_EK_Recertification.exe
2696	79290f4310.exe
2220	600966828e.exe
4068	Intel_PTT_EK_Recertification.exe
3480	Intel_PTT_EK_Recertification.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine	file.exe
Key opened	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine	79290f4310.exe
Key opened	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine	600966828e.exe

Loads dropped DLL 28 IoCs

pid	Process
3008	file.exe
2796	skotes.exe
300	cmd.exe
2912	7z.exe
300	cmd.exe
2936	7z.exe
300	cmd.exe
1184	7z.exe
300	cmd.exe
2172	7z.exe
300	cmd.exe
2576	7z.exe
300	cmd.exe
1396	7z.exe
300	cmd.exe
2772	7z.exe
300	cmd.exe
1224	7z.exe
2796	skotes.exe
300	cmd.exe
300	cmd.exe
2532	taskeng.exe
2532	taskeng.exe
2796	skotes.exe
2796	skotes.exe
2796	skotes.exe
2532	taskeng.exe
2532	taskeng.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	600966828e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	600966828e.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\5d1149c872.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1014918001\\5d1149c872.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\79290f4310.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1014919001\\79290f4310.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\600966828e.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1014920001\\600966828e.exe"	skotes.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x00050000000191d2-123.dat	autoit_exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
3008	file.exe
2796	skotes.exe
2696	79290f4310.exe
2220	600966828e.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1168 set thread context of 2780	1168	Intel_PTT_EK_Recertification.exe	62
PID 4068 set thread context of 4092	4068	Intel_PTT_EK_Recertification.exe	86
PID 3480 set thread context of 3492	3480	Intel_PTT_EK_Recertification.exe	91

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0005000000019377-129.dat	upx
behavioral1/memory/1712-142-0x000000013FD60000-0x00000001401F0000-memory.dmp	upx
behavioral1/memory/1712-145-0x000000013FD60000-0x00000001401F0000-memory.dmp	upx
behavioral1/memory/1168-158-0x000000013FBD0000-0x0000000140060000-memory.dmp	upx
behavioral1/memory/1168-177-0x000000013FBD0000-0x0000000140060000-memory.dmp	upx
behavioral1/memory/4068-485-0x000000013F550000-0x000000013F9E0000-memory.dmp	upx
behavioral1/memory/4068-499-0x000000013F550000-0x000000013F9E0000-memory.dmp	upx
behavioral1/memory/3480-529-0x000000013F170000-0x000000013F600000-memory.dmp	upx
behavioral1/memory/3480-542-0x000000013F170000-0x000000013F600000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	file.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3cba16e1a2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	600966828e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5d1149c872.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	5d1149c872.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	5d1149c872.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	79290f4310.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 8 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
872	PING.EXE
2748	powershell.exe
2904	PING.EXE
760	powershell.exe
1688	PING.EXE
3532	powershell.exe
3660	PING.EXE
1776	powershell.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Kills process with taskkill 5 IoCs

pid	Process
336	taskkill.exe
2536	taskkill.exe
2836	taskkill.exe
1908	taskkill.exe
1988	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings	firefox.exe

Runs ping.exe 1 TTPs 4 IoCs

Remote System Discovery

T1018

pid	Process
872	PING.EXE
2904	PING.EXE
1688	PING.EXE
3660	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
684	schtasks.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
3008	file.exe
2796	skotes.exe
1776	powershell.exe
1168	Intel_PTT_EK_Recertification.exe
2268	5d1149c872.exe
2748	powershell.exe
2696	79290f4310.exe
2220	600966828e.exe
2220	600966828e.exe
2268	5d1149c872.exe
2268	5d1149c872.exe
2220	600966828e.exe
2220	600966828e.exe
4068	Intel_PTT_EK_Recertification.exe
760	powershell.exe
3480	Intel_PTT_EK_Recertification.exe
3532	powershell.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeRestorePrivilege	2912	7z.exe
Token: 35	2912	7z.exe
Token: SeSecurityPrivilege	2912	7z.exe
Token: SeSecurityPrivilege	2912	7z.exe
Token: SeRestorePrivilege	2936	7z.exe
Token: 35	2936	7z.exe
Token: SeSecurityPrivilege	2936	7z.exe
Token: SeSecurityPrivilege	2936	7z.exe
Token: SeRestorePrivilege	1184	7z.exe
Token: 35	1184	7z.exe
Token: SeSecurityPrivilege	1184	7z.exe
Token: SeSecurityPrivilege	1184	7z.exe
Token: SeRestorePrivilege	2172	7z.exe
Token: 35	2172	7z.exe
Token: SeSecurityPrivilege	2172	7z.exe
Token: SeSecurityPrivilege	2172	7z.exe
Token: SeRestorePrivilege	2576	7z.exe
Token: 35	2576	7z.exe
Token: SeSecurityPrivilege	2576	7z.exe
Token: SeSecurityPrivilege	2576	7z.exe
Token: SeRestorePrivilege	1396	7z.exe
Token: 35	1396	7z.exe
Token: SeSecurityPrivilege	1396	7z.exe
Token: SeSecurityPrivilege	1396	7z.exe
Token: SeRestorePrivilege	2772	7z.exe
Token: 35	2772	7z.exe
Token: SeSecurityPrivilege	2772	7z.exe
Token: SeSecurityPrivilege	2772	7z.exe
Token: SeRestorePrivilege	1224	7z.exe
Token: 35	1224	7z.exe
Token: SeSecurityPrivilege	1224	7z.exe
Token: SeSecurityPrivilege	1224	7z.exe
Token: SeDebugPrivilege	336	taskkill.exe
Token: SeDebugPrivilege	1776	powershell.exe
Token: SeDebugPrivilege	2536	taskkill.exe
Token: SeDebugPrivilege	2748	powershell.exe
Token: SeLockMemoryPrivilege	2780	explorer.exe
Token: SeDebugPrivilege	2836	taskkill.exe
Token: SeDebugPrivilege	1908	taskkill.exe
Token: SeDebugPrivilege	1988	taskkill.exe
Token: SeDebugPrivilege	2156	firefox.exe
Token: SeDebugPrivilege	2156	firefox.exe
Token: SeDebugPrivilege	2220	600966828e.exe
Token: SeLockMemoryPrivilege	4092	explorer.exe
Token: SeDebugPrivilege	760	powershell.exe
Token: SeLockMemoryPrivilege	3492	explorer.exe
Token: SeDebugPrivilege	3532	powershell.exe

Suspicious use of FindShellTrayWindow 19 IoCs

pid	Process
3008	file.exe
2268	5d1149c872.exe
2268	5d1149c872.exe
2268	5d1149c872.exe
2268	5d1149c872.exe
2268	5d1149c872.exe
2268	5d1149c872.exe
2268	5d1149c872.exe
2268	5d1149c872.exe
2268	5d1149c872.exe
2268	5d1149c872.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2268	5d1149c872.exe
2268	5d1149c872.exe
2268	5d1149c872.exe
2268	5d1149c872.exe

Suspicious use of SendNotifyMessage 17 IoCs

pid	Process
2268	5d1149c872.exe
2268	5d1149c872.exe
2268	5d1149c872.exe
2268	5d1149c872.exe
2268	5d1149c872.exe
2268	5d1149c872.exe
2268	5d1149c872.exe
2268	5d1149c872.exe
2268	5d1149c872.exe
2268	5d1149c872.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2268	5d1149c872.exe
2268	5d1149c872.exe
2268	5d1149c872.exe
2268	5d1149c872.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2796	3008	file.exe	30
PID 3008 wrote to memory of 2796	3008	file.exe	30
PID 3008 wrote to memory of 2796	3008	file.exe	30
PID 3008 wrote to memory of 2796	3008	file.exe	30
PID 2796 wrote to memory of 1656	2796	skotes.exe	33
PID 2796 wrote to memory of 1656	2796	skotes.exe	33
PID 2796 wrote to memory of 1656	2796	skotes.exe	33
PID 2796 wrote to memory of 1656	2796	skotes.exe	33
PID 1656 wrote to memory of 300	1656	3cba16e1a2.exe	34
PID 1656 wrote to memory of 300	1656	3cba16e1a2.exe	34
PID 1656 wrote to memory of 300	1656	3cba16e1a2.exe	34
PID 1656 wrote to memory of 300	1656	3cba16e1a2.exe	34
PID 300 wrote to memory of 1908	300	cmd.exe	36
PID 300 wrote to memory of 1908	300	cmd.exe	36
PID 300 wrote to memory of 1908	300	cmd.exe	36
PID 300 wrote to memory of 2912	300	cmd.exe	37
PID 300 wrote to memory of 2912	300	cmd.exe	37
PID 300 wrote to memory of 2912	300	cmd.exe	37
PID 300 wrote to memory of 2936	300	cmd.exe	38
PID 300 wrote to memory of 2936	300	cmd.exe	38
PID 300 wrote to memory of 2936	300	cmd.exe	38
PID 300 wrote to memory of 1184	300	cmd.exe	39
PID 300 wrote to memory of 1184	300	cmd.exe	39
PID 300 wrote to memory of 1184	300	cmd.exe	39
PID 300 wrote to memory of 2172	300	cmd.exe	40
PID 300 wrote to memory of 2172	300	cmd.exe	40
PID 300 wrote to memory of 2172	300	cmd.exe	40
PID 300 wrote to memory of 2576	300	cmd.exe	41
PID 300 wrote to memory of 2576	300	cmd.exe	41
PID 300 wrote to memory of 2576	300	cmd.exe	41
PID 300 wrote to memory of 1396	300	cmd.exe	42
PID 300 wrote to memory of 1396	300	cmd.exe	42
PID 300 wrote to memory of 1396	300	cmd.exe	42
PID 300 wrote to memory of 2772	300	cmd.exe	43
PID 300 wrote to memory of 2772	300	cmd.exe	43
PID 300 wrote to memory of 2772	300	cmd.exe	43
PID 300 wrote to memory of 1224	300	cmd.exe	44
PID 300 wrote to memory of 1224	300	cmd.exe	44
PID 300 wrote to memory of 1224	300	cmd.exe	44
PID 300 wrote to memory of 1296	300	cmd.exe	45
PID 300 wrote to memory of 1296	300	cmd.exe	45
PID 300 wrote to memory of 1296	300	cmd.exe	45
PID 2796 wrote to memory of 2268	2796	skotes.exe	46
PID 2796 wrote to memory of 2268	2796	skotes.exe	46
PID 2796 wrote to memory of 2268	2796	skotes.exe	46
PID 2796 wrote to memory of 2268	2796	skotes.exe	46
PID 300 wrote to memory of 1712	300	cmd.exe	47
PID 300 wrote to memory of 1712	300	cmd.exe	47
PID 300 wrote to memory of 1712	300	cmd.exe	47
PID 1712 wrote to memory of 1672	1712	in.exe	48
PID 1712 wrote to memory of 1672	1712	in.exe	48
PID 1712 wrote to memory of 1672	1712	in.exe	48
PID 1712 wrote to memory of 896	1712	in.exe	49
PID 1712 wrote to memory of 896	1712	in.exe	49
PID 1712 wrote to memory of 896	1712	in.exe	49
PID 1712 wrote to memory of 684	1712	in.exe	50
PID 1712 wrote to memory of 684	1712	in.exe	50
PID 1712 wrote to memory of 684	1712	in.exe	50
PID 1712 wrote to memory of 1776	1712	in.exe	51
PID 1712 wrote to memory of 1776	1712	in.exe	51
PID 1712 wrote to memory of 1776	1712	in.exe	51
PID 2268 wrote to memory of 336	2268	5d1149c872.exe	56
PID 2268 wrote to memory of 336	2268	5d1149c872.exe	56
PID 2268 wrote to memory of 336	2268	5d1149c872.exe	56

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 3 IoCs

Hidden Files and Directories

T1564.001

pid	Process
1296	attrib.exe
1672	attrib.exe
896	attrib.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
  "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Users\Admin\AppData\Local\Temp\1014917001\3cba16e1a2.exe
    "C:\Users\Admin\AppData\Local\Temp\1014917001\3cba16e1a2.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1656
  - - C:\Windows\system32\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:300
    - - C:\Windows\system32\mode.com
        
        mode 65,10
        5⤵
        
        PID:1908
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e file.zip -p24291711423417250691697322505 -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_7.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2936
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_6.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1184
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_5.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2172
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_4.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2576
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_3.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1396
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_2.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2772
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_1.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1224
    - - C:\Windows\system32\attrib.exe
        
        attrib +H "in.exe"
        5⤵
        Views/modifies file attributes
        
        PID:1296
    - - C:\Users\Admin\AppData\Local\Temp\main\in.exe
        
        "in.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1712
      - C:\Windows\system32\attrib.exe
        
        attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
        6⤵
        Views/modifies file attributes
        
        PID:1672
      - C:\Windows\system32\attrib.exe
        
        attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
        6⤵
        Views/modifies file attributes
        
        PID:896
      - C:\Windows\system32\schtasks.exe
        
        schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:684
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell ping 127.0.0.1; del in.exe
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1776
        
        C:\Windows\system32\PING.EXE
        
        "C:\Windows\system32\PING.EXE" 127.0.0.1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:872
- - C:\Users\Admin\AppData\Local\Temp\1014918001\5d1149c872.exe
    "C:\Users\Admin\AppData\Local\Temp\1014918001\5d1149c872.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2268
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM firefox.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:336
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM chrome.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2536
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM msedge.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2836
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM opera.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1908
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM brave.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1988
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
      4⤵
      PID:1184
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2156
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2156.0.1545073808\1125425602" -parentBuildID 20221007134813 -prefsHandle 1184 -prefMapHandle 1104 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {90f3b707-4911-41f7-8c9e-883154308fb4} 2156 "\\.\pipe\gecko-crash-server-pipe.2156" 1304 ffeee58 gpu
        6⤵
        
        PID:956
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2156.1.997316740\1734954038" -parentBuildID 20221007134813 -prefsHandle 1484 -prefMapHandle 1480 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {51863ffb-4a68-47a6-832f-a0bcdf776f60} 2156 "\\.\pipe\gecko-crash-server-pipe.2156" 1512 ecea258 socket
        6⤵
        
        PID:2556
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2156.2.1087781806\829274584" -childID 1 -isForBrowser -prefsHandle 1880 -prefMapHandle 1896 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 604 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f69bf61a-1732-4936-aafe-80613e53f111} 2156 "\\.\pipe\gecko-crash-server-pipe.2156" 1872 ff62358 tab
        6⤵
        
        PID:2436
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2156.3.791674704\498502988" -childID 2 -isForBrowser -prefsHandle 2932 -prefMapHandle 2928 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 604 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f795b204-6bca-4283-9c18-d0865448421a} 2156 "\\.\pipe\gecko-crash-server-pipe.2156" 2944 e5d258 tab
        6⤵
        
        PID:1348
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2156.4.1450485487\1155167722" -childID 3 -isForBrowser -prefsHandle 3852 -prefMapHandle 3788 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 604 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cd4dfafd-d532-4299-a2ab-17ba253a02ad} 2156 "\\.\pipe\gecko-crash-server-pipe.2156" 3864 20a80f58 tab
        6⤵
        
        PID:1020
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2156.5.622096604\147624088" -childID 4 -isForBrowser -prefsHandle 3992 -prefMapHandle 3996 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 604 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3969768f-d275-45ba-a410-036c78226c67} 2156 "\\.\pipe\gecko-crash-server-pipe.2156" 3980 20b4d558 tab
        6⤵
        
        PID:1584
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2156.6.2143169816\1706444669" -childID 5 -isForBrowser -prefsHandle 4160 -prefMapHandle 4164 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 604 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {06374d1a-e79e-4bb3-ad03-a0540d219273} 2156 "\\.\pipe\gecko-crash-server-pipe.2156" 4148 20b4de58 tab
        6⤵
        
        PID:2736
- - C:\Users\Admin\AppData\Local\Temp\1014919001\79290f4310.exe
    "C:\Users\Admin\AppData\Local\Temp\1014919001\79290f4310.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2696
- - C:\Users\Admin\AppData\Local\Temp\1014920001\600966828e.exe
    "C:\Users\Admin\AppData\Local\Temp\1014920001\600966828e.exe"
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Windows security modification
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2220

C:\Windows\system32\taskeng.exe
taskeng.exe {65374CE3-999E-49BE-B42E-3D5B310D2B2B} S-1-5-21-1488793075-819845221-1497111674-1000:UPNECVIU\Admin:Interactive:[1]
1⤵
- Loads dropped DLL
PID:2532
- C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  PID:1168
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2780
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
    3⤵
    - Drops file in System32 directory
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2748
  - - C:\Windows\system32\PING.EXE
      "C:\Windows\system32\PING.EXE" 127.1.10.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2904
- C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  PID:4068
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4092
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
    3⤵
    - Drops file in System32 directory
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:760
  - - C:\Windows\system32\PING.EXE
      "C:\Windows\system32\PING.EXE" 127.1.10.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1688
- C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  PID:3480
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3492
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
    3⤵
    - Drops file in System32 directory
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3532
  - - C:\Windows\system32\PING.EXE
      "C:\Windows\system32\PING.EXE" 127.1.10.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion