amadey | f638d07d2ed9ca3c918bbeef9d93b67b6409e8a174f516afa184019d7c94de58

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	f638d07d2ed9ca3c918bbeef9d93b67b6409e8a174f516afa184019d7c94de58.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe

XMRig Miner payload 13 IoCs

miner

resource	yara_rule
behavioral2/memory/2732-138-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral2/memory/2732-139-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral2/memory/2732-140-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral2/memory/2732-141-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral2/memory/2732-142-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral2/memory/2732-143-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral2/memory/2732-144-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral2/memory/2732-148-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral2/memory/2732-146-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral2/memory/2732-161-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral2/memory/1740-183-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral2/memory/1740-185-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral2/memory/1740-187-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	f638d07d2ed9ca3c918bbeef9d93b67b6409e8a174f516afa184019d7c94de58.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	f638d07d2ed9ca3c918bbeef9d93b67b6409e8a174f516afa184019d7c94de58.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	skotes.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	f12f7830a7.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	f638d07d2ed9ca3c918bbeef9d93b67b6409e8a174f516afa184019d7c94de58.exe

Executes dropped EXE 15 IoCs

pid	Process
2180	skotes.exe
2728	f12f7830a7.exe
3184	7z.exe
4612	7z.exe
2184	7z.exe
716	7z.exe
1820	7z.exe
1704	7z.exe
808	7z.exe
532	7z.exe
4196	in.exe
428	skotes.exe
3280	Intel_PTT_EK_Recertification.exe
4816	skotes.exe
4248	Intel_PTT_EK_Recertification.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	f638d07d2ed9ca3c918bbeef9d93b67b6409e8a174f516afa184019d7c94de58.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	skotes.exe

Loads dropped DLL 8 IoCs

pid	Process
3184	7z.exe
4612	7z.exe
2184	7z.exe
716	7z.exe
1820	7z.exe
1704	7z.exe
808	7z.exe
532	7z.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
5036	f638d07d2ed9ca3c918bbeef9d93b67b6409e8a174f516afa184019d7c94de58.exe
2180	skotes.exe
428	skotes.exe
4816	skotes.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3280 set thread context of 2732	3280	Intel_PTT_EK_Recertification.exe	126
PID 4248 set thread context of 1740	4248	Intel_PTT_EK_Recertification.exe	132

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0008000000023bc7-109.dat	upx
behavioral2/memory/4196-112-0x00007FF736AA0000-0x00007FF736F30000-memory.dmp	upx
behavioral2/memory/4196-115-0x00007FF736AA0000-0x00007FF736F30000-memory.dmp	upx
behavioral2/memory/3280-136-0x00007FF62A6D0000-0x00007FF62AB60000-memory.dmp	upx
behavioral2/memory/3280-149-0x00007FF62A6D0000-0x00007FF62AB60000-memory.dmp	upx
behavioral2/memory/4248-186-0x00007FF62A6D0000-0x00007FF62AB60000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	f638d07d2ed9ca3c918bbeef9d93b67b6409e8a174f516afa184019d7c94de58.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f12f7830a7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f638d07d2ed9ca3c918bbeef9d93b67b6409e8a174f516afa184019d7c94de58.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3076	PING.EXE
3152	powershell.exe
3032	PING.EXE
4600	powershell.exe
3564	PING.EXE
4952	powershell.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
3032	PING.EXE
3564	PING.EXE
3076	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2112	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
5036	f638d07d2ed9ca3c918bbeef9d93b67b6409e8a174f516afa184019d7c94de58.exe
5036	f638d07d2ed9ca3c918bbeef9d93b67b6409e8a174f516afa184019d7c94de58.exe
2180	skotes.exe
2180	skotes.exe
3152	powershell.exe
3152	powershell.exe
428	skotes.exe
428	skotes.exe
3280	Intel_PTT_EK_Recertification.exe
4600	powershell.exe
4600	powershell.exe
4816	skotes.exe
4816	skotes.exe
4248	Intel_PTT_EK_Recertification.exe
4952	powershell.exe
4952	powershell.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeRestorePrivilege	3184	7z.exe
Token: 35	3184	7z.exe
Token: SeSecurityPrivilege	3184	7z.exe
Token: SeSecurityPrivilege	3184	7z.exe
Token: SeRestorePrivilege	4612	7z.exe
Token: 35	4612	7z.exe
Token: SeSecurityPrivilege	4612	7z.exe
Token: SeSecurityPrivilege	4612	7z.exe
Token: SeRestorePrivilege	2184	7z.exe
Token: 35	2184	7z.exe
Token: SeSecurityPrivilege	2184	7z.exe
Token: SeSecurityPrivilege	2184	7z.exe
Token: SeRestorePrivilege	716	7z.exe
Token: 35	716	7z.exe
Token: SeSecurityPrivilege	716	7z.exe
Token: SeSecurityPrivilege	716	7z.exe
Token: SeRestorePrivilege	1820	7z.exe
Token: 35	1820	7z.exe
Token: SeSecurityPrivilege	1820	7z.exe
Token: SeSecurityPrivilege	1820	7z.exe
Token: SeRestorePrivilege	1704	7z.exe
Token: 35	1704	7z.exe
Token: SeSecurityPrivilege	1704	7z.exe
Token: SeSecurityPrivilege	1704	7z.exe
Token: SeRestorePrivilege	808	7z.exe
Token: 35	808	7z.exe
Token: SeSecurityPrivilege	808	7z.exe
Token: SeSecurityPrivilege	808	7z.exe
Token: SeRestorePrivilege	532	7z.exe
Token: 35	532	7z.exe
Token: SeSecurityPrivilege	532	7z.exe
Token: SeSecurityPrivilege	532	7z.exe
Token: SeDebugPrivilege	3152	powershell.exe
Token: SeDebugPrivilege	4600	powershell.exe
Token: SeLockMemoryPrivilege	2732	explorer.exe
Token: SeLockMemoryPrivilege	1740	explorer.exe
Token: SeDebugPrivilege	4952	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5036	f638d07d2ed9ca3c918bbeef9d93b67b6409e8a174f516afa184019d7c94de58.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 2180	5036	f638d07d2ed9ca3c918bbeef9d93b67b6409e8a174f516afa184019d7c94de58.exe	83
PID 5036 wrote to memory of 2180	5036	f638d07d2ed9ca3c918bbeef9d93b67b6409e8a174f516afa184019d7c94de58.exe	83
PID 5036 wrote to memory of 2180	5036	f638d07d2ed9ca3c918bbeef9d93b67b6409e8a174f516afa184019d7c94de58.exe	83
PID 2180 wrote to memory of 2728	2180	skotes.exe	85
PID 2180 wrote to memory of 2728	2180	skotes.exe	85
PID 2180 wrote to memory of 2728	2180	skotes.exe	85
PID 2728 wrote to memory of 4852	2728	f12f7830a7.exe	86
PID 2728 wrote to memory of 4852	2728	f12f7830a7.exe	86
PID 4852 wrote to memory of 4296	4852	cmd.exe	88
PID 4852 wrote to memory of 4296	4852	cmd.exe	88
PID 4852 wrote to memory of 3184	4852	cmd.exe	89
PID 4852 wrote to memory of 3184	4852	cmd.exe	89
PID 4852 wrote to memory of 4612	4852	cmd.exe	90
PID 4852 wrote to memory of 4612	4852	cmd.exe	90
PID 4852 wrote to memory of 2184	4852	cmd.exe	91
PID 4852 wrote to memory of 2184	4852	cmd.exe	91
PID 4852 wrote to memory of 716	4852	cmd.exe	92
PID 4852 wrote to memory of 716	4852	cmd.exe	92
PID 4852 wrote to memory of 1820	4852	cmd.exe	93
PID 4852 wrote to memory of 1820	4852	cmd.exe	93
PID 4852 wrote to memory of 1704	4852	cmd.exe	94
PID 4852 wrote to memory of 1704	4852	cmd.exe	94
PID 4852 wrote to memory of 808	4852	cmd.exe	95
PID 4852 wrote to memory of 808	4852	cmd.exe	95
PID 4852 wrote to memory of 532	4852	cmd.exe	96
PID 4852 wrote to memory of 532	4852	cmd.exe	96
PID 4852 wrote to memory of 2528	4852	cmd.exe	97
PID 4852 wrote to memory of 2528	4852	cmd.exe	97
PID 4852 wrote to memory of 4196	4852	cmd.exe	98
PID 4852 wrote to memory of 4196	4852	cmd.exe	98
PID 4196 wrote to memory of 1036	4196	in.exe	99
PID 4196 wrote to memory of 1036	4196	in.exe	99
PID 4196 wrote to memory of 2560	4196	in.exe	100
PID 4196 wrote to memory of 2560	4196	in.exe	100
PID 4196 wrote to memory of 2112	4196	in.exe	102
PID 4196 wrote to memory of 2112	4196	in.exe	102
PID 4196 wrote to memory of 3152	4196	in.exe	104
PID 4196 wrote to memory of 3152	4196	in.exe	104
PID 3152 wrote to memory of 3032	3152	powershell.exe	107
PID 3152 wrote to memory of 3032	3152	powershell.exe	107
PID 3280 wrote to memory of 2732	3280	Intel_PTT_EK_Recertification.exe	126
PID 3280 wrote to memory of 2732	3280	Intel_PTT_EK_Recertification.exe	126
PID 3280 wrote to memory of 2732	3280	Intel_PTT_EK_Recertification.exe	126
PID 3280 wrote to memory of 2732	3280	Intel_PTT_EK_Recertification.exe	126
PID 3280 wrote to memory of 2732	3280	Intel_PTT_EK_Recertification.exe	126
PID 3280 wrote to memory of 2732	3280	Intel_PTT_EK_Recertification.exe	126
PID 3280 wrote to memory of 2732	3280	Intel_PTT_EK_Recertification.exe	126
PID 3280 wrote to memory of 2732	3280	Intel_PTT_EK_Recertification.exe	126
PID 3280 wrote to memory of 2732	3280	Intel_PTT_EK_Recertification.exe	126
PID 3280 wrote to memory of 2732	3280	Intel_PTT_EK_Recertification.exe	126
PID 3280 wrote to memory of 2732	3280	Intel_PTT_EK_Recertification.exe	126
PID 3280 wrote to memory of 4600	3280	Intel_PTT_EK_Recertification.exe	127
PID 3280 wrote to memory of 4600	3280	Intel_PTT_EK_Recertification.exe	127
PID 4600 wrote to memory of 3564	4600	powershell.exe	129
PID 4600 wrote to memory of 3564	4600	powershell.exe	129
PID 4248 wrote to memory of 1740	4248	Intel_PTT_EK_Recertification.exe	132
PID 4248 wrote to memory of 1740	4248	Intel_PTT_EK_Recertification.exe	132
PID 4248 wrote to memory of 1740	4248	Intel_PTT_EK_Recertification.exe	132
PID 4248 wrote to memory of 1740	4248	Intel_PTT_EK_Recertification.exe	132
PID 4248 wrote to memory of 1740	4248	Intel_PTT_EK_Recertification.exe	132
PID 4248 wrote to memory of 1740	4248	Intel_PTT_EK_Recertification.exe	132
PID 4248 wrote to memory of 1740	4248	Intel_PTT_EK_Recertification.exe	132
PID 4248 wrote to memory of 1740	4248	Intel_PTT_EK_Recertification.exe	132
PID 4248 wrote to memory of 1740	4248	Intel_PTT_EK_Recertification.exe	132

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1036	attrib.exe
2560	attrib.exe
2528	attrib.exe

C:\Users\Admin\AppData\Local\Temp\f638d07d2ed9ca3c918bbeef9d93b67b6409e8a174f516afa184019d7c94de58.exe
"C:\Users\Admin\AppData\Local\Temp\f638d07d2ed9ca3c918bbeef9d93b67b6409e8a174f516afa184019d7c94de58.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
  "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2180
- - C:\Users\Admin\AppData\Local\Temp\1015452001\f12f7830a7.exe
    "C:\Users\Admin\AppData\Local\Temp\1015452001\f12f7830a7.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2728
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4852
    - - C:\Windows\system32\mode.com
        
        mode 65,10
        5⤵
        
        PID:4296
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e file.zip -p24291711423417250691697322505 -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:3184
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_7.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:4612
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_6.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2184
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_5.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:716
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_4.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1820
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_3.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1704
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_2.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:808
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_1.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:532
    - - C:\Windows\system32\attrib.exe
        
        attrib +H "in.exe"
        5⤵
        Views/modifies file attributes
        
        PID:2528
    - - C:\Users\Admin\AppData\Local\Temp\main\in.exe
        
        "in.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4196
      - C:\Windows\SYSTEM32\attrib.exe
        
        attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
        6⤵
        Views/modifies file attributes
        
        PID:1036
      - C:\Windows\SYSTEM32\attrib.exe
        
        attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
        6⤵
        Views/modifies file attributes
        
        PID:2560
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2112
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell ping 127.0.0.1; del in.exe
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3152
        
        C:\Windows\system32\PING.EXE
        
        "C:\Windows\system32\PING.EXE" 127.0.0.1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3032

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:428

C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3280
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Windows\system32\PING.EXE
    "C:\Windows\system32\PING.EXE" 127.1.10.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3564

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4816

C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4952
- - C:\Windows\system32\PING.EXE
    "C:\Windows\system32\PING.EXE" 127.1.10.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion