amadey | a3d6d7eea1a9270e20be65394c942207078daac5952a12a9404dd4c557fd2944

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	6c256b1d1d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	6c256b1d1d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	6c256b1d1d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	6c256b1d1d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	6c256b1d1d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	6c256b1d1d.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1712 created 1200	1712	8ca262e4c5.exe	21

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	9fa4568b00.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 11 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	f9f80a45b8.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2efb7063bc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	a3d6d7eea1a9270e20be65394c942207078daac5952a12a9404dd4c557fd2944.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	22f50fd5d2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	8ca262e4c5.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	9fa4568b00.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	6041695c2c.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	5937661f0c.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	db98352ba6.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	6c256b1d1d.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2212	powershell.exe
1604	powershell.exe
3456	powershell.exe
3864	powershell.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 22 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	a3d6d7eea1a9270e20be65394c942207078daac5952a12a9404dd4c557fd2944.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	5937661f0c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	9fa4568b00.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	6c256b1d1d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	6041695c2c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	5937661f0c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	22f50fd5d2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2efb7063bc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	22f50fd5d2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	9fa4568b00.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	db98352ba6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2efb7063bc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	6c256b1d1d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	6041695c2c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	a3d6d7eea1a9270e20be65394c942207078daac5952a12a9404dd4c557fd2944.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8ca262e4c5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	8ca262e4c5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	f9f80a45b8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	f9f80a45b8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	db98352ba6.exe

Executes dropped EXE 36 IoCs

pid	Process
2440	skotes.exe
1700	5937661f0c.exe
1956	729a346761.exe
2224	22f50fd5d2.exe
1712	8ca262e4c5.exe
2600	a87c5f0244.exe
2880	cbda4ad6f4.exe
2420	729a346761.exe
7620	9fa4568b00.exe
7656	7z.exe
7808	7z.exe
7884	7z.exe
7980	7z.exe
8032	7z.exe
8080	7z.exe
8120	7z.exe
8160	7z.exe
2484	in.exe
5012	f9f80a45b8.exe
2132	2228735e82.exe
6372	2228735e82.exe
7280	0ba558a42a.exe
3060	a8407e6ebc.exe
1016	4529d11d13.exe
3712	db98352ba6.exe
1036	2efb7063bc.exe
2432	5182454173.exe
5408	6c256b1d1d.exe
6896	Intel_PTT_EK_Recertification.exe
5464	6041695c2c.exe
5772	a8407e6ebc.exe
5788	a8407e6ebc.exe
5808	a8407e6ebc.exe
5796	a8407e6ebc.exe
5816	a8407e6ebc.exe
7500	Intel_PTT_EK_Recertification.exe

Identifies Wine through registry keys 2 TTPs 11 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	2efb7063bc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	5937661f0c.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	8ca262e4c5.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	22f50fd5d2.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	9fa4568b00.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	f9f80a45b8.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	db98352ba6.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	6c256b1d1d.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	6041695c2c.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	a3d6d7eea1a9270e20be65394c942207078daac5952a12a9404dd4c557fd2944.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	skotes.exe

Loads dropped DLL 56 IoCs

pid	Process
2368	a3d6d7eea1a9270e20be65394c942207078daac5952a12a9404dd4c557fd2944.exe
2440	skotes.exe
2440	skotes.exe
2440	skotes.exe
2440	skotes.exe
2440	skotes.exe
2440	skotes.exe
2440	skotes.exe
2440	skotes.exe
2440	skotes.exe
2440	skotes.exe
1956	729a346761.exe
2440	skotes.exe
7528	cmd.exe
7656	7z.exe
7528	cmd.exe
7808	7z.exe
7528	cmd.exe
7884	7z.exe
7528	cmd.exe
7980	7z.exe
7528	cmd.exe
8032	7z.exe
7528	cmd.exe
8080	7z.exe
7528	cmd.exe
8120	7z.exe
7528	cmd.exe
8160	7z.exe
7528	cmd.exe
7528	cmd.exe
2440	skotes.exe
2440	skotes.exe
2440	skotes.exe
2440	skotes.exe
2132	2228735e82.exe
2440	skotes.exe
2440	skotes.exe
2440	skotes.exe
2440	skotes.exe
2440	skotes.exe
2440	skotes.exe
2440	skotes.exe
2440	skotes.exe
2440	skotes.exe
2440	skotes.exe
1836	taskeng.exe
1836	taskeng.exe
2440	skotes.exe
3060	a8407e6ebc.exe
3060	a8407e6ebc.exe
3060	a8407e6ebc.exe
3060	a8407e6ebc.exe
3060	a8407e6ebc.exe
5464	6041695c2c.exe
1836	taskeng.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	6c256b1d1d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	6c256b1d1d.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\6c256b1d1d.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1018223001\\6c256b1d1d.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\db98352ba6.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1018220001\\db98352ba6.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\2efb7063bc.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1018221001\\2efb7063bc.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\5182454173.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1018222001\\5182454173.exe"	skotes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x000500000001a457-2519.dat	autoit_exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs

pid	Process
2368	a3d6d7eea1a9270e20be65394c942207078daac5952a12a9404dd4c557fd2944.exe
2440	skotes.exe
1700	5937661f0c.exe
2224	22f50fd5d2.exe
1712	8ca262e4c5.exe
7620	9fa4568b00.exe
5012	f9f80a45b8.exe
3712	db98352ba6.exe
1036	2efb7063bc.exe
5408	6c256b1d1d.exe
5464	6041695c2c.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1956 set thread context of 2420	1956	729a346761.exe	45
PID 2132 set thread context of 6372	2132	2228735e82.exe	73
PID 6896 set thread context of 7016	6896	Intel_PTT_EK_Recertification.exe	102
PID 7500 set thread context of 7512	7500	Intel_PTT_EK_Recertification.exe	119

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0005000000019fd4-2380.dat	upx
behavioral1/memory/2484-2384-0x000000013FB20000-0x000000013FFB0000-memory.dmp	upx
behavioral1/memory/2484-2424-0x000000013FB20000-0x000000013FFB0000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	a3d6d7eea1a9270e20be65394c942207078daac5952a12a9404dd4c557fd2944.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a8407e6ebc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2228735e82.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5182454173.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	5182454173.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a3d6d7eea1a9270e20be65394c942207078daac5952a12a9404dd4c557fd2944.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	db98352ba6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	729a346761.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4529d11d13.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2efb7063bc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6041695c2c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5937661f0c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9fa4568b00.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dialer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8ca262e4c5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2228735e82.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	5182454173.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a87c5f0244.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	729a346761.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cbda4ad6f4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6c256b1d1d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	22f50fd5d2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4056	powershell.exe
4716	PING.EXE
7540	powershell.exe
7856	PING.EXE
3772	powershell.exe
4320	PING.EXE

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Kills process with taskkill 5 IoCs

pid	Process
2224	taskkill.exe
4876	taskkill.exe
3580	taskkill.exe
5056	taskkill.exe
1956	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_Classes\Local Settings	firefox.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	5937661f0c.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	5937661f0c.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	5937661f0c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	2228735e82.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	2228735e82.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
4320	PING.EXE
4716	PING.EXE
7856	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
1536	schtasks.exe

Suspicious behavior: EnumeratesProcesses 57 IoCs

pid	Process
2368	a3d6d7eea1a9270e20be65394c942207078daac5952a12a9404dd4c557fd2944.exe
2440	skotes.exe
1700	5937661f0c.exe
2224	22f50fd5d2.exe
1712	8ca262e4c5.exe
1712	8ca262e4c5.exe
1712	8ca262e4c5.exe
1712	8ca262e4c5.exe
1712	8ca262e4c5.exe
3060	dialer.exe
3060	dialer.exe
3060	dialer.exe
3060	dialer.exe
2600	a87c5f0244.exe
2212	powershell.exe
1604	powershell.exe
7620	9fa4568b00.exe
2420	729a346761.exe
2420	729a346761.exe
7620	9fa4568b00.exe
7620	9fa4568b00.exe
7620	9fa4568b00.exe
7620	9fa4568b00.exe
7620	9fa4568b00.exe
3772	powershell.exe
5012	f9f80a45b8.exe
1016	4529d11d13.exe
3456	powershell.exe
3864	powershell.exe
3712	db98352ba6.exe
1036	2efb7063bc.exe
2432	5182454173.exe
5408	6c256b1d1d.exe
6896	Intel_PTT_EK_Recertification.exe
5408	6c256b1d1d.exe
5408	6c256b1d1d.exe
2432	5182454173.exe
4056	powershell.exe
5464	6041695c2c.exe
5464	6041695c2c.exe
3060	a8407e6ebc.exe
3060	a8407e6ebc.exe
3060	a8407e6ebc.exe
3060	a8407e6ebc.exe
3060	a8407e6ebc.exe
3060	a8407e6ebc.exe
3060	a8407e6ebc.exe
3060	a8407e6ebc.exe
3060	a8407e6ebc.exe
3060	a8407e6ebc.exe
3060	a8407e6ebc.exe
3060	a8407e6ebc.exe
3060	a8407e6ebc.exe
3060	a8407e6ebc.exe
3060	a8407e6ebc.exe
7500	Intel_PTT_EK_Recertification.exe
7540	powershell.exe

Suspicious use of AdjustPrivilegeToken 53 IoCs

description	pid	Process
Token: SeDebugPrivilege	2600	a87c5f0244.exe
Token: SeDebugPrivilege	2212	powershell.exe
Token: SeDebugPrivilege	1604	powershell.exe
Token: SeDebugPrivilege	2420	729a346761.exe
Token: SeRestorePrivilege	7656	7z.exe
Token: 35	7656	7z.exe
Token: SeSecurityPrivilege	7656	7z.exe
Token: SeSecurityPrivilege	7656	7z.exe
Token: SeRestorePrivilege	7808	7z.exe
Token: 35	7808	7z.exe
Token: SeSecurityPrivilege	7808	7z.exe
Token: SeSecurityPrivilege	7808	7z.exe
Token: SeRestorePrivilege	7884	7z.exe
Token: 35	7884	7z.exe
Token: SeSecurityPrivilege	7884	7z.exe
Token: SeSecurityPrivilege	7884	7z.exe
Token: SeRestorePrivilege	7980	7z.exe
Token: 35	7980	7z.exe
Token: SeSecurityPrivilege	7980	7z.exe
Token: SeSecurityPrivilege	7980	7z.exe
Token: SeRestorePrivilege	8032	7z.exe
Token: 35	8032	7z.exe
Token: SeSecurityPrivilege	8032	7z.exe
Token: SeSecurityPrivilege	8032	7z.exe
Token: SeRestorePrivilege	8080	7z.exe
Token: 35	8080	7z.exe
Token: SeSecurityPrivilege	8080	7z.exe
Token: SeSecurityPrivilege	8080	7z.exe
Token: SeRestorePrivilege	8120	7z.exe
Token: 35	8120	7z.exe
Token: SeSecurityPrivilege	8120	7z.exe
Token: SeSecurityPrivilege	8120	7z.exe
Token: SeRestorePrivilege	8160	7z.exe
Token: 35	8160	7z.exe
Token: SeSecurityPrivilege	8160	7z.exe
Token: SeSecurityPrivilege	8160	7z.exe
Token: SeDebugPrivilege	3772	powershell.exe
Token: SeDebugPrivilege	3060	a8407e6ebc.exe
Token: SeDebugPrivilege	1016	4529d11d13.exe
Token: SeDebugPrivilege	3456	powershell.exe
Token: SeDebugPrivilege	3864	powershell.exe
Token: SeDebugPrivilege	2224	taskkill.exe
Token: SeDebugPrivilege	4876	taskkill.exe
Token: SeDebugPrivilege	3580	taskkill.exe
Token: SeDebugPrivilege	5056	taskkill.exe
Token: SeDebugPrivilege	1956	taskkill.exe
Token: SeDebugPrivilege	5472	firefox.exe
Token: SeDebugPrivilege	5472	firefox.exe
Token: SeDebugPrivilege	5408	6c256b1d1d.exe
Token: SeDebugPrivilege	4056	powershell.exe
Token: SeLockMemoryPrivilege	7016	explorer.exe
Token: SeLockMemoryPrivilege	7512	explorer.exe
Token: SeDebugPrivilege	7540	powershell.exe

Suspicious use of FindShellTrayWindow 17 IoCs

pid	Process
2368	a3d6d7eea1a9270e20be65394c942207078daac5952a12a9404dd4c557fd2944.exe
2432	5182454173.exe
2432	5182454173.exe
2432	5182454173.exe
2432	5182454173.exe
2432	5182454173.exe
2432	5182454173.exe
2432	5182454173.exe
2432	5182454173.exe
2432	5182454173.exe
5472	firefox.exe
5472	firefox.exe
5472	firefox.exe
5472	firefox.exe
2432	5182454173.exe
2432	5182454173.exe
2432	5182454173.exe

Suspicious use of SendNotifyMessage 15 IoCs

pid	Process
2432	5182454173.exe
2432	5182454173.exe
2432	5182454173.exe
2432	5182454173.exe
2432	5182454173.exe
2432	5182454173.exe
2432	5182454173.exe
2432	5182454173.exe
2432	5182454173.exe
5472	firefox.exe
5472	firefox.exe
5472	firefox.exe
2432	5182454173.exe
2432	5182454173.exe
2432	5182454173.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2440	2368	a3d6d7eea1a9270e20be65394c942207078daac5952a12a9404dd4c557fd2944.exe	30
PID 2368 wrote to memory of 2440	2368	a3d6d7eea1a9270e20be65394c942207078daac5952a12a9404dd4c557fd2944.exe	30
PID 2368 wrote to memory of 2440	2368	a3d6d7eea1a9270e20be65394c942207078daac5952a12a9404dd4c557fd2944.exe	30
PID 2368 wrote to memory of 2440	2368	a3d6d7eea1a9270e20be65394c942207078daac5952a12a9404dd4c557fd2944.exe	30
PID 2440 wrote to memory of 1700	2440	skotes.exe	33
PID 2440 wrote to memory of 1700	2440	skotes.exe	33
PID 2440 wrote to memory of 1700	2440	skotes.exe	33
PID 2440 wrote to memory of 1700	2440	skotes.exe	33
PID 2440 wrote to memory of 1956	2440	skotes.exe	34
PID 2440 wrote to memory of 1956	2440	skotes.exe	34
PID 2440 wrote to memory of 1956	2440	skotes.exe	34
PID 2440 wrote to memory of 1956	2440	skotes.exe	34
PID 2440 wrote to memory of 2224	2440	skotes.exe	35
PID 2440 wrote to memory of 2224	2440	skotes.exe	35
PID 2440 wrote to memory of 2224	2440	skotes.exe	35
PID 2440 wrote to memory of 2224	2440	skotes.exe	35
PID 2440 wrote to memory of 1712	2440	skotes.exe	36
PID 2440 wrote to memory of 1712	2440	skotes.exe	36
PID 2440 wrote to memory of 1712	2440	skotes.exe	36
PID 2440 wrote to memory of 1712	2440	skotes.exe	36
PID 1712 wrote to memory of 3060	1712	8ca262e4c5.exe	37
PID 1712 wrote to memory of 3060	1712	8ca262e4c5.exe	37
PID 1712 wrote to memory of 3060	1712	8ca262e4c5.exe	37
PID 1712 wrote to memory of 3060	1712	8ca262e4c5.exe	37
PID 1712 wrote to memory of 3060	1712	8ca262e4c5.exe	37
PID 1712 wrote to memory of 3060	1712	8ca262e4c5.exe	37
PID 2440 wrote to memory of 2600	2440	skotes.exe	38
PID 2440 wrote to memory of 2600	2440	skotes.exe	38
PID 2440 wrote to memory of 2600	2440	skotes.exe	38
PID 2440 wrote to memory of 2600	2440	skotes.exe	38
PID 2600 wrote to memory of 2212	2600	a87c5f0244.exe	40
PID 2600 wrote to memory of 2212	2600	a87c5f0244.exe	40
PID 2600 wrote to memory of 2212	2600	a87c5f0244.exe	40
PID 2600 wrote to memory of 2212	2600	a87c5f0244.exe	40
PID 2600 wrote to memory of 1604	2600	a87c5f0244.exe	42
PID 2600 wrote to memory of 1604	2600	a87c5f0244.exe	42
PID 2600 wrote to memory of 1604	2600	a87c5f0244.exe	42
PID 2600 wrote to memory of 1604	2600	a87c5f0244.exe	42
PID 2440 wrote to memory of 2880	2440	skotes.exe	44
PID 2440 wrote to memory of 2880	2440	skotes.exe	44
PID 2440 wrote to memory of 2880	2440	skotes.exe	44
PID 2440 wrote to memory of 2880	2440	skotes.exe	44
PID 1956 wrote to memory of 2420	1956	729a346761.exe	45
PID 1956 wrote to memory of 2420	1956	729a346761.exe	45
PID 1956 wrote to memory of 2420	1956	729a346761.exe	45
PID 1956 wrote to memory of 2420	1956	729a346761.exe	45
PID 1956 wrote to memory of 2420	1956	729a346761.exe	45
PID 1956 wrote to memory of 2420	1956	729a346761.exe	45
PID 1956 wrote to memory of 2420	1956	729a346761.exe	45
PID 1956 wrote to memory of 2420	1956	729a346761.exe	45
PID 1956 wrote to memory of 2420	1956	729a346761.exe	45
PID 2880 wrote to memory of 7528	2880	cbda4ad6f4.exe	46
PID 2880 wrote to memory of 7528	2880	cbda4ad6f4.exe	46
PID 2880 wrote to memory of 7528	2880	cbda4ad6f4.exe	46
PID 2880 wrote to memory of 7528	2880	cbda4ad6f4.exe	46
PID 7528 wrote to memory of 7612	7528	cmd.exe	48
PID 7528 wrote to memory of 7612	7528	cmd.exe	48
PID 7528 wrote to memory of 7612	7528	cmd.exe	48
PID 2440 wrote to memory of 7620	2440	skotes.exe	49
PID 2440 wrote to memory of 7620	2440	skotes.exe	49
PID 2440 wrote to memory of 7620	2440	skotes.exe	49
PID 2440 wrote to memory of 7620	2440	skotes.exe	49
PID 7528 wrote to memory of 7656	7528	cmd.exe	50
PID 7528 wrote to memory of 7656	7528	cmd.exe	50

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 3 IoCs

Hidden Files and Directories

T1564.001

pid	Process
1620	attrib.exe
4064	attrib.exe
276	attrib.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1200
- C:\Users\Admin\AppData\Local\Temp\a3d6d7eea1a9270e20be65394c942207078daac5952a12a9404dd4c557fd2944.exe
  "C:\Users\Admin\AppData\Local\Temp\a3d6d7eea1a9270e20be65394c942207078daac5952a12a9404dd4c557fd2944.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
    "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2440
  - - C:\Users\Admin\AppData\Local\Temp\1018208001\5937661f0c.exe
      "C:\Users\Admin\AppData\Local\Temp\1018208001\5937661f0c.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      PID:1700
  - - C:\Users\Admin\AppData\Local\Temp\1018209001\729a346761.exe
      "C:\Users\Admin\AppData\Local\Temp\1018209001\729a346761.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1956
    - - C:\Users\Admin\AppData\Local\Temp\1018209001\729a346761.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018209001\729a346761.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2420
  - - C:\Users\Admin\AppData\Local\Temp\1018210001\22f50fd5d2.exe
      "C:\Users\Admin\AppData\Local\Temp\1018210001\22f50fd5d2.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2224
  - - C:\Users\Admin\AppData\Local\Temp\1018211001\8ca262e4c5.exe
      "C:\Users\Admin\AppData\Local\Temp\1018211001\8ca262e4c5.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1712
  - - C:\Users\Admin\AppData\Local\Temp\1018212001\a87c5f0244.exe
      "C:\Users\Admin\AppData\Local\Temp\1018212001\a87c5f0244.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2600
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath "C:\ippulv"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2212
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1604
  - - C:\Users\Admin\AppData\Local\Temp\1018213001\cbda4ad6f4.exe
      "C:\Users\Admin\AppData\Local\Temp\1018213001\cbda4ad6f4.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2880
    - - C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
        5⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:7528
      - C:\Windows\system32\mode.com
        
        mode 65,10
        6⤵
        
        PID:7612
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e file.zip -p24291711423417250691697322505 -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:7656
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_7.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:7808
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_6.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:7884
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_5.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:7980
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_4.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:8032
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_3.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:8080
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_2.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:8120
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_1.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:8160
      - C:\Windows\system32\attrib.exe
        
        attrib +H "in.exe"
        6⤵
        Views/modifies file attributes
        
        PID:1620
      - C:\Users\Admin\AppData\Local\Temp\main\in.exe
        
        "in.exe"
        6⤵
        Executes dropped EXE
        
        PID:2484
        
        C:\Windows\system32\attrib.exe
        
        attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
        7⤵
        Views/modifies file attributes
        
        PID:276
        
        C:\Windows\system32\attrib.exe
        
        attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
        7⤵
        Views/modifies file attributes
        
        PID:4064
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1536
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell ping 127.0.0.1; del in.exe
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3772
        
        C:\Windows\system32\PING.EXE
        
        "C:\Windows\system32\PING.EXE" 127.0.0.1
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4320
  - - C:\Users\Admin\AppData\Local\Temp\1018214001\9fa4568b00.exe
      "C:\Users\Admin\AppData\Local\Temp\1018214001\9fa4568b00.exe"
      4⤵
      Enumerates VirtualBox registry keys
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:7620
  - - C:\Users\Admin\AppData\Local\Temp\1018215001\f9f80a45b8.exe
      "C:\Users\Admin\AppData\Local\Temp\1018215001\f9f80a45b8.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      PID:5012
  - - C:\Users\Admin\AppData\Local\Temp\1018216001\2228735e82.exe
      "C:\Users\Admin\AppData\Local\Temp\1018216001\2228735e82.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:2132
    - - C:\Users\Admin\AppData\Local\Temp\1018216001\2228735e82.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018216001\2228735e82.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies system certificate store
        
        PID:6372
  - - C:\Users\Admin\AppData\Local\Temp\1018217001\0ba558a42a.exe
      "C:\Users\Admin\AppData\Local\Temp\1018217001\0ba558a42a.exe"
      4⤵
      Executes dropped EXE
      PID:7280
  - - C:\Users\Admin\AppData\Local\Temp\1018218001\a8407e6ebc.exe
      "C:\Users\Admin\AppData\Local\Temp\1018218001\a8407e6ebc.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3060
    - - C:\Users\Admin\AppData\Local\Temp\1018218001\a8407e6ebc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018218001\a8407e6ebc.exe"
        5⤵
        Executes dropped EXE
        
        PID:5772
    - - C:\Users\Admin\AppData\Local\Temp\1018218001\a8407e6ebc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018218001\a8407e6ebc.exe"
        5⤵
        Executes dropped EXE
        
        PID:5788
    - - C:\Users\Admin\AppData\Local\Temp\1018218001\a8407e6ebc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018218001\a8407e6ebc.exe"
        5⤵
        Executes dropped EXE
        
        PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\1018218001\a8407e6ebc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018218001\a8407e6ebc.exe"
        5⤵
        Executes dropped EXE
        
        PID:5808
    - - C:\Users\Admin\AppData\Local\Temp\1018218001\a8407e6ebc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018218001\a8407e6ebc.exe"
        5⤵
        Executes dropped EXE
        
        PID:5816
  - - C:\Users\Admin\AppData\Local\Temp\1018219001\4529d11d13.exe
      "C:\Users\Admin\AppData\Local\Temp\1018219001\4529d11d13.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1016
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath "C:\jjqednnbyq"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3456
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3864
  - - C:\Users\Admin\AppData\Local\Temp\1018220001\db98352ba6.exe
      "C:\Users\Admin\AppData\Local\Temp\1018220001\db98352ba6.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3712
  - - C:\Users\Admin\AppData\Local\Temp\1018221001\2efb7063bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1018221001\2efb7063bc.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1036
  - - C:\Users\Admin\AppData\Local\Temp\1018222001\5182454173.exe
      "C:\Users\Admin\AppData\Local\Temp\1018222001\5182454173.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:2432
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM firefox.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2224
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4876
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3580
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5056
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1956
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
        5⤵
        
        PID:5388
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        6⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:5472
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5472.0.293719175\1460338954" -parentBuildID 20221007134813 -prefsHandle 1272 -prefMapHandle 1264 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c93e2530-c166-4b25-98b0-c6bb643c3cad} 5472 "\\.\pipe\gecko-crash-server-pipe.5472" 1348 fb08758 gpu
        7⤵
        
        PID:6092
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5472.1.2127079405\1606579530" -parentBuildID 20221007134813 -prefsHandle 1532 -prefMapHandle 1528 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {87e7167b-cac2-4365-b4d9-49ff40608dd3} 5472 "\\.\pipe\gecko-crash-server-pipe.5472" 1544 e73658 socket
        7⤵
        
        PID:6336
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5472.2.1173703263\2146960348" -childID 1 -isForBrowser -prefsHandle 1840 -prefMapHandle 2052 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 560 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {87df6fcb-a4b5-4b0a-a29b-2b6b759c2130} 5472 "\\.\pipe\gecko-crash-server-pipe.5472" 1912 199c7e58 tab
        7⤵
        
        PID:7036
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5472.3.391653743\2073046583" -childID 2 -isForBrowser -prefsHandle 2732 -prefMapHandle 2728 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 560 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9fe56929-fc47-4d72-9bdb-0a05643ade31} 5472 "\\.\pipe\gecko-crash-server-pipe.5472" 2740 1b2cf758 tab
        7⤵
        
        PID:3532
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5472.4.2120171490\298050540" -childID 3 -isForBrowser -prefsHandle 3780 -prefMapHandle 3776 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 560 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ab034804-75ff-4a96-995a-aa94058fc3c5} 5472 "\\.\pipe\gecko-crash-server-pipe.5472" 3792 1e880358 tab
        7⤵
        
        PID:684
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5472.5.962596958\816757515" -childID 4 -isForBrowser -prefsHandle 3904 -prefMapHandle 3908 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 560 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {084854f9-a561-48f8-b55f-417f2aa1fe7f} 5472 "\\.\pipe\gecko-crash-server-pipe.5472" 3892 1e880f58 tab
        7⤵
        
        PID:648
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5472.6.1762840792\310576252" -childID 5 -isForBrowser -prefsHandle 4068 -prefMapHandle 4072 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 560 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a55d7ffc-c2f7-4bf2-874e-849a3df8dd5c} 5472 "\\.\pipe\gecko-crash-server-pipe.5472" 4056 1e881e58 tab
        7⤵
        
        PID:2944
  - - C:\Users\Admin\AppData\Local\Temp\1018223001\6c256b1d1d.exe
      "C:\Users\Admin\AppData\Local\Temp\1018223001\6c256b1d1d.exe"
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Windows security modification
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5408
  - - C:\Users\Admin\AppData\Local\Temp\1018224001\6041695c2c.exe
      "C:\Users\Admin\AppData\Local\Temp\1018224001\6041695c2c.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5464
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3060

C:\Windows\system32\taskeng.exe
taskeng.exe {CA9BF8F9-50F0-4333-AB9A-1FF87AE95047} S-1-5-21-3692679935-4019334568-335155002-1000:BCXRJFKE\Admin:Interactive:[1]
1⤵
- Loads dropped DLL
PID:1836
- C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  PID:6896
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:7016
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
    3⤵
    - Drops file in System32 directory
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4056
  - - C:\Windows\system32\PING.EXE
      "C:\Windows\system32\PING.EXE" 127.1.10.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4716
- C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  PID:7500
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:7512
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
    3⤵
    - Drops file in System32 directory
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:7540
  - - C:\Windows\system32\PING.EXE
      "C:\Windows\system32\PING.EXE" 127.1.10.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:7856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion