amadey | c478f40cfe686bdc076d898a735f2857316a64d8e2d9dc405dde3e0ca8194b7f

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	GIDW0K8HABNA51PTVPNSH4NS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	GIDW0K8HABNA51PTVPNSH4NS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	3dbde99e3e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	3dbde99e3e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	3dbde99e3e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	3dbde99e3e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	GIDW0K8HABNA51PTVPNSH4NS.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	3dbde99e3e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	3dbde99e3e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	GIDW0K8HABNA51PTVPNSH4NS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	GIDW0K8HABNA51PTVPNSH4NS.exe

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 11572 created 1216	11572	8393a81ece.exe	21

Enumerates VirtualBox registry keys 2 TTPs 2 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	fac99f2b4c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	37a747ff44.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 12 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	7a61ef3b09.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	fac99f2b4c.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	8393a81ece.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	R88XS393KJJ9XRX4K.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	292a0b553d.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	3dbde99e3e.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	9fec5fc5b8.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	023b83ec30.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	37a747ff44.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	GIDW0K8HABNA51PTVPNSH4NS.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	file.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
11964	powershell.exe
12052	powershell.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 24 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	GIDW0K8HABNA51PTVPNSH4NS.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	9fec5fc5b8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3dbde99e3e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	fac99f2b4c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	fac99f2b4c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	GIDW0K8HABNA51PTVPNSH4NS.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	9fec5fc5b8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	8393a81ece.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	023b83ec30.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	37a747ff44.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	R88XS393KJJ9XRX4K.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	292a0b553d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	292a0b553d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3dbde99e3e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	023b83ec30.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	37a747ff44.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	7a61ef3b09.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	7a61ef3b09.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8393a81ece.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	R88XS393KJJ9XRX4K.exe

Executes dropped EXE 35 IoCs

pid	Process
2788	skotes.exe
1032	zudFSfy.exe
2636	kz8ZdyP.exe
1704	9fec5fc5b8.exe
2920	292a0b553d.exe
1688	7cb87fdc00.exe
2872	zudFSfy.exe
11212	kz8ZdyP.exe
11176	3dbde99e3e.exe
8292	3bbd3fc3ba.exe
8764	7z.exe
8904	7z.exe
9000	7z.exe
8080	7z.exe
8228	7z.exe
8372	7z.exe
8576	7z.exe
8736	7z.exe
8876	in.exe
8632	Intel_PTT_EK_Recertification.exe
1720	b9276ba876.exe
988	7a61ef3b09.exe
2940	fac99f2b4c.exe
11572	8393a81ece.exe
11876	6c6247a092.exe
12228	a985400c61.exe
12272	a985400c61.exe
12344	f66e341ead.exe
12392	f66e341ead.exe
12564	b9276ba876.exe
12696	023b83ec30.exe
13084	37a747ff44.exe
13216	Intel_PTT_EK_Recertification.exe
3824	GIDW0K8HABNA51PTVPNSH4NS.exe
3948	R88XS393KJJ9XRX4K.exe

Identifies Wine through registry keys 2 TTPs 12 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine	292a0b553d.exe
Key opened	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine	7a61ef3b09.exe
Key opened	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine	fac99f2b4c.exe
Key opened	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine	GIDW0K8HABNA51PTVPNSH4NS.exe
Key opened	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine	R88XS393KJJ9XRX4K.exe
Key opened	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine	file.exe
Key opened	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine	9fec5fc5b8.exe
Key opened	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine	37a747ff44.exe
Key opened	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine	3dbde99e3e.exe
Key opened	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine	8393a81ece.exe
Key opened	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine	023b83ec30.exe

Loads dropped DLL 57 IoCs

pid	Process
2512	file.exe
2788	skotes.exe
2788	skotes.exe
2788	skotes.exe
2788	skotes.exe
2788	skotes.exe
2788	skotes.exe
2788	skotes.exe
2788	skotes.exe
1032	zudFSfy.exe
2788	skotes.exe
2788	skotes.exe
2636	kz8ZdyP.exe
2788	skotes.exe
8520	cmd.exe
8764	7z.exe
8520	cmd.exe
8904	7z.exe
8520	cmd.exe
9000	7z.exe
8520	cmd.exe
8080	7z.exe
8520	cmd.exe
8228	7z.exe
8520	cmd.exe
8372	7z.exe
8520	cmd.exe
8576	7z.exe
8520	cmd.exe
8736	7z.exe
8520	cmd.exe
8520	cmd.exe
8508	taskeng.exe
8508	taskeng.exe
2788	skotes.exe
2788	skotes.exe
2788	skotes.exe
2788	skotes.exe
2788	skotes.exe
2788	skotes.exe
2788	skotes.exe
2788	skotes.exe
2788	skotes.exe
2788	skotes.exe
12228	a985400c61.exe
2788	skotes.exe
2788	skotes.exe
12344	f66e341ead.exe
1720	b9276ba876.exe
2788	skotes.exe
2788	skotes.exe
2788	skotes.exe
8508	taskeng.exe
1704	9fec5fc5b8.exe
1704	9fec5fc5b8.exe
1704	9fec5fc5b8.exe
1704	9fec5fc5b8.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	3dbde99e3e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	3dbde99e3e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	GIDW0K8HABNA51PTVPNSH4NS.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\9fec5fc5b8.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1017477001\\9fec5fc5b8.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\292a0b553d.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1017478001\\292a0b553d.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\7cb87fdc00.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1017479001\\7cb87fdc00.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\3dbde99e3e.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1017480001\\3dbde99e3e.exe"	skotes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x0005000000019319-107.dat	autoit_exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs

pid	Process
2512	file.exe
2788	skotes.exe
1704	9fec5fc5b8.exe
2920	292a0b553d.exe
11176	3dbde99e3e.exe
988	7a61ef3b09.exe
2940	fac99f2b4c.exe
11572	8393a81ece.exe
12696	023b83ec30.exe
13084	37a747ff44.exe
3824	GIDW0K8HABNA51PTVPNSH4NS.exe
3948	R88XS393KJJ9XRX4K.exe

Suspicious use of SetThreadContext 7 IoCs

description	pid	Process	procid_target
PID 1032 set thread context of 2872	1032	zudFSfy.exe	54
PID 2636 set thread context of 11212	2636	kz8ZdyP.exe	60
PID 8632 set thread context of 8656	8632	Intel_PTT_EK_Recertification.exe	86
PID 12228 set thread context of 12272	12228	a985400c61.exe	103
PID 12344 set thread context of 12392	12344	f66e341ead.exe	106
PID 1720 set thread context of 12564	1720	b9276ba876.exe	107
PID 13216 set thread context of 13208	13216	Intel_PTT_EK_Recertification.exe	111

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/8876-4613-0x000000013FFD0000-0x0000000140460000-memory.dmp	upx
behavioral1/memory/8876-4616-0x000000013FFD0000-0x0000000140460000-memory.dmp	upx
behavioral1/memory/8632-4632-0x000000013F150000-0x000000013F5E0000-memory.dmp	upx
behavioral1/memory/8632-4642-0x000000013F150000-0x000000013F5E0000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	file.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 35 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fac99f2b4c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GIDW0K8HABNA51PTVPNSH4NS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kz8ZdyP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dialer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7cb87fdc00.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b9276ba876.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	292a0b553d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9fec5fc5b8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zudFSfy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7a61ef3b09.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f66e341ead.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a985400c61.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	37a747ff44.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	R88XS393KJJ9XRX4K.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6c6247a092.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3bbd3fc3ba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f66e341ead.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	7cb87fdc00.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kz8ZdyP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a985400c61.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	023b83ec30.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zudFSfy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3dbde99e3e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b9276ba876.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8393a81ece.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	7cb87fdc00.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
8580	powershell.exe
9036	PING.EXE
8912	powershell.exe
2856	PING.EXE
3368	powershell.exe
3440	PING.EXE

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Kills process with taskkill 5 IoCs

pid	Process
2448	taskkill.exe
1744	taskkill.exe
2952	taskkill.exe
1592	taskkill.exe
2140	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings	firefox.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	9fec5fc5b8.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	9fec5fc5b8.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	9fec5fc5b8.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
9036	PING.EXE
2856	PING.EXE
3440	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
8392	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2512	file.exe
2788	skotes.exe
1704	9fec5fc5b8.exe
2920	292a0b553d.exe
1688	7cb87fdc00.exe
1688	7cb87fdc00.exe
1688	7cb87fdc00.exe
1688	7cb87fdc00.exe
1688	7cb87fdc00.exe
1688	7cb87fdc00.exe
1688	7cb87fdc00.exe
1688	7cb87fdc00.exe
1688	7cb87fdc00.exe
1688	7cb87fdc00.exe
1688	7cb87fdc00.exe
1688	7cb87fdc00.exe
1688	7cb87fdc00.exe
1688	7cb87fdc00.exe
1688	7cb87fdc00.exe
1688	7cb87fdc00.exe
1688	7cb87fdc00.exe
1688	7cb87fdc00.exe
1688	7cb87fdc00.exe
1688	7cb87fdc00.exe
1688	7cb87fdc00.exe
1688	7cb87fdc00.exe
11176	3dbde99e3e.exe
11176	3dbde99e3e.exe
11176	3dbde99e3e.exe
11176	3dbde99e3e.exe
11176	3dbde99e3e.exe
11176	3dbde99e3e.exe
11176	3dbde99e3e.exe
11176	3dbde99e3e.exe
11176	3dbde99e3e.exe
11176	3dbde99e3e.exe
11212	kz8ZdyP.exe
11212	kz8ZdyP.exe
11212	kz8ZdyP.exe
2872	zudFSfy.exe
2872	zudFSfy.exe
2872	zudFSfy.exe
8580	powershell.exe
8632	Intel_PTT_EK_Recertification.exe
8912	powershell.exe
988	7a61ef3b09.exe
988	7a61ef3b09.exe
2940	fac99f2b4c.exe
2940	fac99f2b4c.exe
2940	fac99f2b4c.exe
2940	fac99f2b4c.exe
2940	fac99f2b4c.exe
2940	fac99f2b4c.exe
2940	fac99f2b4c.exe
2940	fac99f2b4c.exe
2940	fac99f2b4c.exe
2940	fac99f2b4c.exe
2940	fac99f2b4c.exe
11572	8393a81ece.exe
11572	8393a81ece.exe
11572	8393a81ece.exe
11572	8393a81ece.exe
11572	8393a81ece.exe
11572	8393a81ece.exe

Suspicious use of AdjustPrivilegeToken 52 IoCs

description	pid	Process
Token: SeDebugPrivilege	2448	taskkill.exe
Token: SeDebugPrivilege	1744	taskkill.exe
Token: SeDebugPrivilege	2952	taskkill.exe
Token: SeDebugPrivilege	1592	taskkill.exe
Token: SeDebugPrivilege	2140	taskkill.exe
Token: SeDebugPrivilege	2872	zudFSfy.exe
Token: SeDebugPrivilege	1872	firefox.exe
Token: SeDebugPrivilege	1872	firefox.exe
Token: SeDebugPrivilege	11212	kz8ZdyP.exe
Token: SeDebugPrivilege	11176	3dbde99e3e.exe
Token: SeRestorePrivilege	8764	7z.exe
Token: 35	8764	7z.exe
Token: SeSecurityPrivilege	8764	7z.exe
Token: SeSecurityPrivilege	8764	7z.exe
Token: SeRestorePrivilege	8904	7z.exe
Token: 35	8904	7z.exe
Token: SeSecurityPrivilege	8904	7z.exe
Token: SeSecurityPrivilege	8904	7z.exe
Token: SeRestorePrivilege	9000	7z.exe
Token: 35	9000	7z.exe
Token: SeSecurityPrivilege	9000	7z.exe
Token: SeSecurityPrivilege	9000	7z.exe
Token: SeRestorePrivilege	8080	7z.exe
Token: 35	8080	7z.exe
Token: SeSecurityPrivilege	8080	7z.exe
Token: SeSecurityPrivilege	8080	7z.exe
Token: SeRestorePrivilege	8228	7z.exe
Token: 35	8228	7z.exe
Token: SeSecurityPrivilege	8228	7z.exe
Token: SeSecurityPrivilege	8228	7z.exe
Token: SeRestorePrivilege	8372	7z.exe
Token: 35	8372	7z.exe
Token: SeSecurityPrivilege	8372	7z.exe
Token: SeSecurityPrivilege	8372	7z.exe
Token: SeRestorePrivilege	8576	7z.exe
Token: 35	8576	7z.exe
Token: SeSecurityPrivilege	8576	7z.exe
Token: SeSecurityPrivilege	8576	7z.exe
Token: SeRestorePrivilege	8736	7z.exe
Token: 35	8736	7z.exe
Token: SeSecurityPrivilege	8736	7z.exe
Token: SeSecurityPrivilege	8736	7z.exe
Token: SeDebugPrivilege	8580	powershell.exe
Token: SeDebugPrivilege	8912	powershell.exe
Token: SeDebugPrivilege	1720	b9276ba876.exe
Token: SeLockMemoryPrivilege	8656	explorer.exe
Token: SeDebugPrivilege	11876	6c6247a092.exe
Token: SeDebugPrivilege	11964	powershell.exe
Token: SeDebugPrivilege	12052	powershell.exe
Token: SeDebugPrivilege	3368	powershell.exe
Token: SeLockMemoryPrivilege	13208	explorer.exe
Token: SeDebugPrivilege	3824	GIDW0K8HABNA51PTVPNSH4NS.exe

Suspicious use of FindShellTrayWindow 15 IoCs

pid	Process
2512	file.exe
1688	7cb87fdc00.exe
1688	7cb87fdc00.exe
1688	7cb87fdc00.exe
1688	7cb87fdc00.exe
1688	7cb87fdc00.exe
1688	7cb87fdc00.exe
1872	firefox.exe
1872	firefox.exe
1872	firefox.exe
1872	firefox.exe
1688	7cb87fdc00.exe
1688	7cb87fdc00.exe
1688	7cb87fdc00.exe
1688	7cb87fdc00.exe

Suspicious use of SendNotifyMessage 13 IoCs

pid	Process
1688	7cb87fdc00.exe
1688	7cb87fdc00.exe
1688	7cb87fdc00.exe
1688	7cb87fdc00.exe
1688	7cb87fdc00.exe
1688	7cb87fdc00.exe
1872	firefox.exe
1872	firefox.exe
1872	firefox.exe
1688	7cb87fdc00.exe
1688	7cb87fdc00.exe
1688	7cb87fdc00.exe
1688	7cb87fdc00.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2788	2512	file.exe	31
PID 2512 wrote to memory of 2788	2512	file.exe	31
PID 2512 wrote to memory of 2788	2512	file.exe	31
PID 2512 wrote to memory of 2788	2512	file.exe	31
PID 2788 wrote to memory of 1032	2788	skotes.exe	33
PID 2788 wrote to memory of 1032	2788	skotes.exe	33
PID 2788 wrote to memory of 1032	2788	skotes.exe	33
PID 2788 wrote to memory of 1032	2788	skotes.exe	33
PID 2788 wrote to memory of 2636	2788	skotes.exe	34
PID 2788 wrote to memory of 2636	2788	skotes.exe	34
PID 2788 wrote to memory of 2636	2788	skotes.exe	34
PID 2788 wrote to memory of 2636	2788	skotes.exe	34
PID 2788 wrote to memory of 1704	2788	skotes.exe	35
PID 2788 wrote to memory of 1704	2788	skotes.exe	35
PID 2788 wrote to memory of 1704	2788	skotes.exe	35
PID 2788 wrote to memory of 1704	2788	skotes.exe	35
PID 2788 wrote to memory of 2920	2788	skotes.exe	36
PID 2788 wrote to memory of 2920	2788	skotes.exe	36
PID 2788 wrote to memory of 2920	2788	skotes.exe	36
PID 2788 wrote to memory of 2920	2788	skotes.exe	36
PID 2788 wrote to memory of 1688	2788	skotes.exe	37
PID 2788 wrote to memory of 1688	2788	skotes.exe	37
PID 2788 wrote to memory of 1688	2788	skotes.exe	37
PID 2788 wrote to memory of 1688	2788	skotes.exe	37
PID 1688 wrote to memory of 2448	1688	7cb87fdc00.exe	38
PID 1688 wrote to memory of 2448	1688	7cb87fdc00.exe	38
PID 1688 wrote to memory of 2448	1688	7cb87fdc00.exe	38
PID 1688 wrote to memory of 2448	1688	7cb87fdc00.exe	38
PID 1688 wrote to memory of 1744	1688	7cb87fdc00.exe	41
PID 1688 wrote to memory of 1744	1688	7cb87fdc00.exe	41
PID 1688 wrote to memory of 1744	1688	7cb87fdc00.exe	41
PID 1688 wrote to memory of 1744	1688	7cb87fdc00.exe	41
PID 1688 wrote to memory of 2952	1688	7cb87fdc00.exe	43
PID 1688 wrote to memory of 2952	1688	7cb87fdc00.exe	43
PID 1688 wrote to memory of 2952	1688	7cb87fdc00.exe	43
PID 1688 wrote to memory of 2952	1688	7cb87fdc00.exe	43
PID 1688 wrote to memory of 1592	1688	7cb87fdc00.exe	45
PID 1688 wrote to memory of 1592	1688	7cb87fdc00.exe	45
PID 1688 wrote to memory of 1592	1688	7cb87fdc00.exe	45
PID 1688 wrote to memory of 1592	1688	7cb87fdc00.exe	45
PID 1688 wrote to memory of 2140	1688	7cb87fdc00.exe	47
PID 1688 wrote to memory of 2140	1688	7cb87fdc00.exe	47
PID 1688 wrote to memory of 2140	1688	7cb87fdc00.exe	47
PID 1688 wrote to memory of 2140	1688	7cb87fdc00.exe	47
PID 1688 wrote to memory of 2484	1688	7cb87fdc00.exe	49
PID 1688 wrote to memory of 2484	1688	7cb87fdc00.exe	49
PID 1688 wrote to memory of 2484	1688	7cb87fdc00.exe	49
PID 1688 wrote to memory of 2484	1688	7cb87fdc00.exe	49
PID 2484 wrote to memory of 1872	2484	firefox.exe	50
PID 2484 wrote to memory of 1872	2484	firefox.exe	50
PID 2484 wrote to memory of 1872	2484	firefox.exe	50
PID 2484 wrote to memory of 1872	2484	firefox.exe	50
PID 2484 wrote to memory of 1872	2484	firefox.exe	50
PID 2484 wrote to memory of 1872	2484	firefox.exe	50
PID 2484 wrote to memory of 1872	2484	firefox.exe	50
PID 2484 wrote to memory of 1872	2484	firefox.exe	50
PID 2484 wrote to memory of 1872	2484	firefox.exe	50
PID 2484 wrote to memory of 1872	2484	firefox.exe	50
PID 2484 wrote to memory of 1872	2484	firefox.exe	50
PID 2484 wrote to memory of 1872	2484	firefox.exe	50
PID 1872 wrote to memory of 2580	1872	firefox.exe	51
PID 1872 wrote to memory of 2580	1872	firefox.exe	51
PID 1872 wrote to memory of 2580	1872	firefox.exe	51
PID 1872 wrote to memory of 1668	1872	firefox.exe	52

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 3 IoCs

Hidden Files and Directories

T1564.001

pid	Process
9052	attrib.exe
9084	attrib.exe
8864	attrib.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1216
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
    "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2788
  - - C:\Users\Admin\AppData\Local\Temp\1017319001\zudFSfy.exe
      "C:\Users\Admin\AppData\Local\Temp\1017319001\zudFSfy.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:1032
    - - C:\Users\Admin\AppData\Local\Temp\1017319001\zudFSfy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1017319001\zudFSfy.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2872
  - - C:\Users\Admin\AppData\Local\Temp\1017321001\kz8ZdyP.exe
      "C:\Users\Admin\AppData\Local\Temp\1017321001\kz8ZdyP.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:2636
    - - C:\Users\Admin\AppData\Local\Temp\1017321001\kz8ZdyP.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1017321001\kz8ZdyP.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:11212
  - - C:\Users\Admin\AppData\Local\Temp\1017477001\9fec5fc5b8.exe
      "C:\Users\Admin\AppData\Local\Temp\1017477001\9fec5fc5b8.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      PID:1704
    - - C:\Users\Admin\AppData\Local\Temp\GIDW0K8HABNA51PTVPNSH4NS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GIDW0K8HABNA51PTVPNSH4NS.exe"
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Windows security modification
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3824
    - - C:\Users\Admin\AppData\Local\Temp\R88XS393KJJ9XRX4K.exe
        
        "C:\Users\Admin\AppData\Local\Temp\R88XS393KJJ9XRX4K.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:3948
  - - C:\Users\Admin\AppData\Local\Temp\1017478001\292a0b553d.exe
      "C:\Users\Admin\AppData\Local\Temp\1017478001\292a0b553d.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2920
  - - C:\Users\Admin\AppData\Local\Temp\1017479001\7cb87fdc00.exe
      "C:\Users\Admin\AppData\Local\Temp\1017479001\7cb87fdc00.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:1688
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM firefox.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2448
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1744
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2952
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1592
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2140
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2484
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        6⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1872
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1872.0.1601004369\1703917003" -parentBuildID 20221007134813 -prefsHandle 1208 -prefMapHandle 1200 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {de855307-aa11-40d3-a8fc-036e235d1941} 1872 "\\.\pipe\gecko-crash-server-pipe.1872" 1284 fed6158 gpu
        7⤵
        
        PID:2580
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1872.1.2057807689\1266026533" -parentBuildID 20221007134813 -prefsHandle 1536 -prefMapHandle 1532 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {af294b34-ea05-453c-a0d5-8fa1ebec7bfb} 1872 "\\.\pipe\gecko-crash-server-pipe.1872" 1548 ecedc58 socket
        7⤵
        
        PID:1668
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1872.2.1119339291\2101284928" -childID 1 -isForBrowser -prefsHandle 2096 -prefMapHandle 2092 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 592 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a3f4db5e-ac18-49cc-98ed-1b8ff23d2df7} 1872 "\\.\pipe\gecko-crash-server-pipe.1872" 2108 1967b358 tab
        7⤵
        
        PID:2360
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1872.3.753352860\1081790270" -childID 2 -isForBrowser -prefsHandle 2672 -prefMapHandle 2668 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 592 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6f9e9ede-6027-4deb-85b1-36e783ae2f8b} 1872 "\\.\pipe\gecko-crash-server-pipe.1872" 2684 1b19c758 tab
        7⤵
        
        PID:1952
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1872.4.108772573\508041055" -childID 3 -isForBrowser -prefsHandle 3768 -prefMapHandle 3764 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 592 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {468f9c35-74cb-4ab1-a85f-24574643d282} 1872 "\\.\pipe\gecko-crash-server-pipe.1872" 3780 1f08e958 tab
        7⤵
        
        PID:11052
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1872.5.411180249\1360217209" -childID 4 -isForBrowser -prefsHandle 3900 -prefMapHandle 3896 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 592 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5ecb7d64-0a64-4abc-a41b-57db146f7f5e} 1872 "\\.\pipe\gecko-crash-server-pipe.1872" 3884 1f08f558 tab
        7⤵
        
        PID:11068
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1872.6.633855822\612645112" -childID 5 -isForBrowser -prefsHandle 4056 -prefMapHandle 4060 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 592 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4ac70760-ad00-4819-a9d7-78a3dd392772} 1872 "\\.\pipe\gecko-crash-server-pipe.1872" 4048 1f7ab658 tab
        7⤵
        
        PID:11076
  - - C:\Users\Admin\AppData\Local\Temp\1017480001\3dbde99e3e.exe
      "C:\Users\Admin\AppData\Local\Temp\1017480001\3dbde99e3e.exe"
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Windows security modification
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:11176
  - - C:\Users\Admin\AppData\Local\Temp\1017481001\3bbd3fc3ba.exe
      "C:\Users\Admin\AppData\Local\Temp\1017481001\3bbd3fc3ba.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:8292
    - - C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
        5⤵
        Loads dropped DLL
        
        PID:8520
      - C:\Windows\system32\mode.com
        
        mode 65,10
        6⤵
        
        PID:8636
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e file.zip -p24291711423417250691697322505 -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:8764
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_7.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:8904
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_6.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:9000
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_5.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:8080
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_4.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:8228
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_3.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:8372
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_2.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:8576
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_1.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:8736
      - C:\Windows\system32\attrib.exe
        
        attrib +H "in.exe"
        6⤵
        Views/modifies file attributes
        
        PID:8864
      - C:\Users\Admin\AppData\Local\Temp\main\in.exe
        
        "in.exe"
        6⤵
        Executes dropped EXE
        
        PID:8876
        
        C:\Windows\system32\attrib.exe
        
        attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
        7⤵
        Views/modifies file attributes
        
        PID:9052
        
        C:\Windows\system32\attrib.exe
        
        attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
        7⤵
        Views/modifies file attributes
        
        PID:9084
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8392
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell ping 127.0.0.1; del in.exe
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:8580
        
        C:\Windows\system32\PING.EXE
        
        "C:\Windows\system32\PING.EXE" 127.0.0.1
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:9036
  - - C:\Users\Admin\AppData\Local\Temp\1017482001\b9276ba876.exe
      "C:\Users\Admin\AppData\Local\Temp\1017482001\b9276ba876.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1720
    - - C:\Users\Admin\AppData\Local\Temp\1017482001\b9276ba876.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1017482001\b9276ba876.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:12564
  - - C:\Users\Admin\AppData\Local\Temp\1017483001\7a61ef3b09.exe
      "C:\Users\Admin\AppData\Local\Temp\1017483001\7a61ef3b09.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:988
  - - C:\Users\Admin\AppData\Local\Temp\1017484001\fac99f2b4c.exe
      "C:\Users\Admin\AppData\Local\Temp\1017484001\fac99f2b4c.exe"
      4⤵
      Enumerates VirtualBox registry keys
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2940
  - - C:\Users\Admin\AppData\Local\Temp\1017485001\8393a81ece.exe
      "C:\Users\Admin\AppData\Local\Temp\1017485001\8393a81ece.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:11572
  - - C:\Users\Admin\AppData\Local\Temp\1017486001\6c6247a092.exe
      "C:\Users\Admin\AppData\Local\Temp\1017486001\6c6247a092.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:11876
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath "C:\mjwxwodleh"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:11964
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:12052
  - - C:\Users\Admin\AppData\Local\Temp\1017487001\a985400c61.exe
      "C:\Users\Admin\AppData\Local\Temp\1017487001\a985400c61.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:12228
    - - C:\Users\Admin\AppData\Local\Temp\1017487001\a985400c61.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1017487001\a985400c61.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:12272
  - - C:\Users\Admin\AppData\Local\Temp\1017488001\f66e341ead.exe
      "C:\Users\Admin\AppData\Local\Temp\1017488001\f66e341ead.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:12344
    - - C:\Users\Admin\AppData\Local\Temp\1017488001\f66e341ead.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1017488001\f66e341ead.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:12392
  - - C:\Users\Admin\AppData\Local\Temp\1017489001\023b83ec30.exe
      "C:\Users\Admin\AppData\Local\Temp\1017489001\023b83ec30.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      PID:12696
  - - C:\Users\Admin\AppData\Local\Temp\1017490001\37a747ff44.exe
      "C:\Users\Admin\AppData\Local\Temp\1017490001\37a747ff44.exe"
      4⤵
      Enumerates VirtualBox registry keys
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      PID:13084
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:11768

C:\Windows\system32\taskeng.exe
taskeng.exe {AA481C54-6718-483A-8232-768FD4BC57BB} S-1-5-21-1488793075-819845221-1497111674-1000:UPNECVIU\Admin:Interactive:[1]
1⤵
- Loads dropped DLL
PID:8508
- C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  PID:8632
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:8656
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
    3⤵
    - Drops file in System32 directory
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:8912
  - - C:\Windows\system32\PING.EXE
      "C:\Windows\system32\PING.EXE" 127.1.10.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2856
- C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:13216
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:13208
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
    3⤵
    - Drops file in System32 directory
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3368
  - - C:\Windows\system32\PING.EXE
      "C:\Windows\system32\PING.EXE" 127.1.10.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion