amadey | f3e3c4115bd289a528c02aae90a563e6b5dd6009e125d1fb142bcc7218cf068d

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	22ed1302a4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	22ed1302a4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	22ed1302a4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	22ed1302a4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	22ed1302a4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	22ed1302a4.exe

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 5040 created 1196	5040	25f6e62deb.exe	21

Enumerates VirtualBox registry keys 2 TTPs 2 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	1b12d9265c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	53c67451a6.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 11 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	25f6e62deb.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	8797d752f7.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	53c67451a6.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	f3e3c4115bd289a528c02aae90a563e6b5dd6009e125d1fb142bcc7218cf068d.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	1b12d9265c.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	4d412062f0.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	22ed1302a4.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2cf1899635.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	6d4b9dcf61.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	818f5dca0c.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5316	powershell.exe
5388	powershell.exe
1052	powershell.exe
1400	powershell.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 22 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	25f6e62deb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	8797d752f7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	53c67451a6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	f3e3c4115bd289a528c02aae90a563e6b5dd6009e125d1fb142bcc7218cf068d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	6d4b9dcf61.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1b12d9265c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4d412062f0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	22ed1302a4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	818f5dca0c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	22ed1302a4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2cf1899635.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	25f6e62deb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8797d752f7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1b12d9265c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	6d4b9dcf61.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	818f5dca0c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2cf1899635.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	53c67451a6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	f3e3c4115bd289a528c02aae90a563e6b5dd6009e125d1fb142bcc7218cf068d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4d412062f0.exe

Executes dropped EXE 37 IoCs

pid	Process
2748	skotes.exe
2832	ab4bd86dcc.exe
1940	1b12d9265c.exe
2400	b5a0016111.exe
872	b5a0016111.exe
2788	8160d7817e.exe
1700	94f0301255.exe
1596	ab4bd86dcc.exe
1356	ab4bd86dcc.exe
1632	ab4bd86dcc.exe
2740	ab4bd86dcc.exe
3428	6d4b9dcf61.exe
9180	818f5dca0c.exe
6084	4d412062f0.exe
6836	96f9225a06.exe
3312	22ed1302a4.exe
1748	119eb1062a.exe
3024	7z.exe
3096	7z.exe
4128	7z.exe
4168	7z.exe
4196	7z.exe
4228	7z.exe
4252	7z.exe
4276	7z.exe
4316	in.exe
4560	2cf1899635.exe
4892	63c55cb05c.exe
5040	25f6e62deb.exe
5252	3c62c3d17f.exe
5588	3aa5453546.exe
5636	3aa5453546.exe
5864	8797d752f7.exe
6952	53c67451a6.exe
7372	63c55cb05c.exe
7388	63c55cb05c.exe
7696	Intel_PTT_EK_Recertification.exe

Identifies Wine through registry keys 2 TTPs 11 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine	22ed1302a4.exe
Key opened	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine	2cf1899635.exe
Key opened	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine	f3e3c4115bd289a528c02aae90a563e6b5dd6009e125d1fb142bcc7218cf068d.exe
Key opened	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine	1b12d9265c.exe
Key opened	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine	6d4b9dcf61.exe
Key opened	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine	818f5dca0c.exe
Key opened	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine	4d412062f0.exe
Key opened	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine	53c67451a6.exe
Key opened	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine	25f6e62deb.exe
Key opened	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine	8797d752f7.exe

Loads dropped DLL 58 IoCs

pid	Process
2384	f3e3c4115bd289a528c02aae90a563e6b5dd6009e125d1fb142bcc7218cf068d.exe
2748	skotes.exe
2748	skotes.exe
2748	skotes.exe
2748	skotes.exe
2748	skotes.exe
2748	skotes.exe
2400	b5a0016111.exe
2748	skotes.exe
2748	skotes.exe
2832	ab4bd86dcc.exe
2832	ab4bd86dcc.exe
2832	ab4bd86dcc.exe
2832	ab4bd86dcc.exe
2748	skotes.exe
2748	skotes.exe
2748	skotes.exe
2748	skotes.exe
2748	skotes.exe
2748	skotes.exe
2748	skotes.exe
2748	skotes.exe
2748	skotes.exe
292	cmd.exe
3024	7z.exe
292	cmd.exe
3096	7z.exe
292	cmd.exe
4128	7z.exe
292	cmd.exe
4168	7z.exe
292	cmd.exe
4196	7z.exe
292	cmd.exe
4228	7z.exe
292	cmd.exe
4252	7z.exe
292	cmd.exe
4276	7z.exe
292	cmd.exe
292	cmd.exe
2748	skotes.exe
2748	skotes.exe
2748	skotes.exe
3428	6d4b9dcf61.exe
2748	skotes.exe
2748	skotes.exe
2748	skotes.exe
2748	skotes.exe
2748	skotes.exe
5588	3aa5453546.exe
2748	skotes.exe
2748	skotes.exe
2748	skotes.exe
4892	63c55cb05c.exe
4892	63c55cb05c.exe
7636	taskeng.exe
7636	taskeng.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	22ed1302a4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	22ed1302a4.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\818f5dca0c.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1018358001\\818f5dca0c.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\4d412062f0.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1018359001\\4d412062f0.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\96f9225a06.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1018360001\\96f9225a06.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\22ed1302a4.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1018361001\\22ed1302a4.exe"	skotes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x00050000000194df-2339.dat	autoit_exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs

pid	Process
2384	f3e3c4115bd289a528c02aae90a563e6b5dd6009e125d1fb142bcc7218cf068d.exe
2748	skotes.exe
1940	1b12d9265c.exe
3428	6d4b9dcf61.exe
9180	818f5dca0c.exe
6084	4d412062f0.exe
3312	22ed1302a4.exe
4560	2cf1899635.exe
5040	25f6e62deb.exe
5864	8797d752f7.exe
6952	53c67451a6.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 2400 set thread context of 872	2400	b5a0016111.exe	37
PID 2832 set thread context of 2740	2832	ab4bd86dcc.exe	46
PID 5588 set thread context of 5636	5588	3aa5453546.exe	110
PID 4892 set thread context of 7388	4892	63c55cb05c.exe	114
PID 7696 set thread context of 7708	7696	Intel_PTT_EK_Recertification.exe	117

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	f3e3c4115bd289a528c02aae90a563e6b5dd6009e125d1fb142bcc7218cf068d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 35 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3aa5453546.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	53c67451a6.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	96f9225a06.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b5a0016111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	96f9225a06.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ab4bd86dcc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	818f5dca0c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	22ed1302a4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2cf1899635.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ab4bd86dcc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4d412062f0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	94f0301255.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	25f6e62deb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c62c3d17f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f3e3c4115bd289a528c02aae90a563e6b5dd6009e125d1fb142bcc7218cf068d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	119eb1062a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b5a0016111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	96f9225a06.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	63c55cb05c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dialer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	63c55cb05c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6d4b9dcf61.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3aa5453546.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8797d752f7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1b12d9265c.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4352	powershell.exe
4488	PING.EXE
7788	powershell.exe
7928	PING.EXE

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Kills process with taskkill 5 IoCs

pid	Process
7392	taskkill.exe
7496	taskkill.exe
7632	taskkill.exe
6984	taskkill.exe
7276	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings	firefox.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	b5a0016111.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	b5a0016111.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	b5a0016111.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	818f5dca0c.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	818f5dca0c.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
7928	PING.EXE
4488	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4344	schtasks.exe

Suspicious behavior: EnumeratesProcesses 53 IoCs

pid	Process
2384	f3e3c4115bd289a528c02aae90a563e6b5dd6009e125d1fb142bcc7218cf068d.exe
2748	skotes.exe
1940	1b12d9265c.exe
1940	1b12d9265c.exe
1940	1b12d9265c.exe
1940	1b12d9265c.exe
1940	1b12d9265c.exe
1940	1b12d9265c.exe
1700	94f0301255.exe
1052	powershell.exe
2832	ab4bd86dcc.exe
2832	ab4bd86dcc.exe
2832	ab4bd86dcc.exe
2832	ab4bd86dcc.exe
2832	ab4bd86dcc.exe
2832	ab4bd86dcc.exe
1400	powershell.exe
3428	6d4b9dcf61.exe
2740	ab4bd86dcc.exe
2740	ab4bd86dcc.exe
9180	818f5dca0c.exe
6084	4d412062f0.exe
6836	96f9225a06.exe
3312	22ed1302a4.exe
6836	96f9225a06.exe
3312	22ed1302a4.exe
3312	22ed1302a4.exe
4352	powershell.exe
4560	2cf1899635.exe
4560	2cf1899635.exe
5040	25f6e62deb.exe
5040	25f6e62deb.exe
5040	25f6e62deb.exe
5040	25f6e62deb.exe
5040	25f6e62deb.exe
5152	dialer.exe
5152	dialer.exe
5152	dialer.exe
5152	dialer.exe
5252	3c62c3d17f.exe
5316	powershell.exe
5388	powershell.exe
5864	8797d752f7.exe
6952	53c67451a6.exe
6952	53c67451a6.exe
6952	53c67451a6.exe
6952	53c67451a6.exe
6952	53c67451a6.exe
6952	53c67451a6.exe
4892	63c55cb05c.exe
4892	63c55cb05c.exe
7696	Intel_PTT_EK_Recertification.exe
7788	powershell.exe

Suspicious use of AdjustPrivilegeToken 52 IoCs

description	pid	Process
Token: SeDebugPrivilege	1700	94f0301255.exe
Token: SeDebugPrivilege	1052	powershell.exe
Token: SeDebugPrivilege	2832	ab4bd86dcc.exe
Token: SeDebugPrivilege	1400	powershell.exe
Token: SeDebugPrivilege	2740	ab4bd86dcc.exe
Token: SeDebugPrivilege	6984	taskkill.exe
Token: SeDebugPrivilege	7276	taskkill.exe
Token: SeDebugPrivilege	7392	taskkill.exe
Token: SeDebugPrivilege	7496	taskkill.exe
Token: SeDebugPrivilege	7632	taskkill.exe
Token: SeDebugPrivilege	7796	firefox.exe
Token: SeDebugPrivilege	7796	firefox.exe
Token: SeDebugPrivilege	3312	22ed1302a4.exe
Token: SeRestorePrivilege	3024	7z.exe
Token: 35	3024	7z.exe
Token: SeSecurityPrivilege	3024	7z.exe
Token: SeSecurityPrivilege	3024	7z.exe
Token: SeRestorePrivilege	3096	7z.exe
Token: 35	3096	7z.exe
Token: SeSecurityPrivilege	3096	7z.exe
Token: SeSecurityPrivilege	3096	7z.exe
Token: SeRestorePrivilege	4128	7z.exe
Token: 35	4128	7z.exe
Token: SeSecurityPrivilege	4128	7z.exe
Token: SeSecurityPrivilege	4128	7z.exe
Token: SeRestorePrivilege	4168	7z.exe
Token: 35	4168	7z.exe
Token: SeSecurityPrivilege	4168	7z.exe
Token: SeSecurityPrivilege	4168	7z.exe
Token: SeRestorePrivilege	4196	7z.exe
Token: 35	4196	7z.exe
Token: SeSecurityPrivilege	4196	7z.exe
Token: SeSecurityPrivilege	4196	7z.exe
Token: SeRestorePrivilege	4228	7z.exe
Token: 35	4228	7z.exe
Token: SeSecurityPrivilege	4228	7z.exe
Token: SeSecurityPrivilege	4228	7z.exe
Token: SeRestorePrivilege	4252	7z.exe
Token: 35	4252	7z.exe
Token: SeSecurityPrivilege	4252	7z.exe
Token: SeSecurityPrivilege	4252	7z.exe
Token: SeRestorePrivilege	4276	7z.exe
Token: 35	4276	7z.exe
Token: SeSecurityPrivilege	4276	7z.exe
Token: SeSecurityPrivilege	4276	7z.exe
Token: SeDebugPrivilege	4352	powershell.exe
Token: SeDebugPrivilege	4892	63c55cb05c.exe
Token: SeDebugPrivilege	5252	3c62c3d17f.exe
Token: SeDebugPrivilege	5316	powershell.exe
Token: SeDebugPrivilege	5388	powershell.exe
Token: SeDebugPrivilege	7788	powershell.exe
Token: SeLockMemoryPrivilege	7708	explorer.exe

Suspicious use of FindShellTrayWindow 15 IoCs

pid	Process
2384	f3e3c4115bd289a528c02aae90a563e6b5dd6009e125d1fb142bcc7218cf068d.exe
6836	96f9225a06.exe
6836	96f9225a06.exe
6836	96f9225a06.exe
6836	96f9225a06.exe
6836	96f9225a06.exe
6836	96f9225a06.exe
6836	96f9225a06.exe
7796	firefox.exe
7796	firefox.exe
7796	firefox.exe
7796	firefox.exe
6836	96f9225a06.exe
6836	96f9225a06.exe
6836	96f9225a06.exe

Suspicious use of SendNotifyMessage 13 IoCs

pid	Process
6836	96f9225a06.exe
6836	96f9225a06.exe
6836	96f9225a06.exe
6836	96f9225a06.exe
6836	96f9225a06.exe
6836	96f9225a06.exe
6836	96f9225a06.exe
7796	firefox.exe
7796	firefox.exe
7796	firefox.exe
6836	96f9225a06.exe
6836	96f9225a06.exe
6836	96f9225a06.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2748	2384	f3e3c4115bd289a528c02aae90a563e6b5dd6009e125d1fb142bcc7218cf068d.exe	30
PID 2384 wrote to memory of 2748	2384	f3e3c4115bd289a528c02aae90a563e6b5dd6009e125d1fb142bcc7218cf068d.exe	30
PID 2384 wrote to memory of 2748	2384	f3e3c4115bd289a528c02aae90a563e6b5dd6009e125d1fb142bcc7218cf068d.exe	30
PID 2384 wrote to memory of 2748	2384	f3e3c4115bd289a528c02aae90a563e6b5dd6009e125d1fb142bcc7218cf068d.exe	30
PID 2748 wrote to memory of 2832	2748	skotes.exe	33
PID 2748 wrote to memory of 2832	2748	skotes.exe	33
PID 2748 wrote to memory of 2832	2748	skotes.exe	33
PID 2748 wrote to memory of 2832	2748	skotes.exe	33
PID 2748 wrote to memory of 1940	2748	skotes.exe	34
PID 2748 wrote to memory of 1940	2748	skotes.exe	34
PID 2748 wrote to memory of 1940	2748	skotes.exe	34
PID 2748 wrote to memory of 1940	2748	skotes.exe	34
PID 2748 wrote to memory of 2400	2748	skotes.exe	35
PID 2748 wrote to memory of 2400	2748	skotes.exe	35
PID 2748 wrote to memory of 2400	2748	skotes.exe	35
PID 2748 wrote to memory of 2400	2748	skotes.exe	35
PID 2400 wrote to memory of 872	2400	b5a0016111.exe	37
PID 2400 wrote to memory of 872	2400	b5a0016111.exe	37
PID 2400 wrote to memory of 872	2400	b5a0016111.exe	37
PID 2400 wrote to memory of 872	2400	b5a0016111.exe	37
PID 2400 wrote to memory of 872	2400	b5a0016111.exe	37
PID 2400 wrote to memory of 872	2400	b5a0016111.exe	37
PID 2400 wrote to memory of 872	2400	b5a0016111.exe	37
PID 2400 wrote to memory of 872	2400	b5a0016111.exe	37
PID 2400 wrote to memory of 872	2400	b5a0016111.exe	37
PID 2400 wrote to memory of 872	2400	b5a0016111.exe	37
PID 2748 wrote to memory of 2788	2748	skotes.exe	38
PID 2748 wrote to memory of 2788	2748	skotes.exe	38
PID 2748 wrote to memory of 2788	2748	skotes.exe	38
PID 2748 wrote to memory of 2788	2748	skotes.exe	38
PID 2748 wrote to memory of 2788	2748	skotes.exe	38
PID 2748 wrote to memory of 2788	2748	skotes.exe	38
PID 2748 wrote to memory of 2788	2748	skotes.exe	38
PID 2748 wrote to memory of 1700	2748	skotes.exe	39
PID 2748 wrote to memory of 1700	2748	skotes.exe	39
PID 2748 wrote to memory of 1700	2748	skotes.exe	39
PID 2748 wrote to memory of 1700	2748	skotes.exe	39
PID 1700 wrote to memory of 1052	1700	94f0301255.exe	41
PID 1700 wrote to memory of 1052	1700	94f0301255.exe	41
PID 1700 wrote to memory of 1052	1700	94f0301255.exe	41
PID 1700 wrote to memory of 1052	1700	94f0301255.exe	41
PID 2832 wrote to memory of 1596	2832	ab4bd86dcc.exe	43
PID 2832 wrote to memory of 1596	2832	ab4bd86dcc.exe	43
PID 2832 wrote to memory of 1596	2832	ab4bd86dcc.exe	43
PID 2832 wrote to memory of 1596	2832	ab4bd86dcc.exe	43
PID 2832 wrote to memory of 1356	2832	ab4bd86dcc.exe	44
PID 2832 wrote to memory of 1356	2832	ab4bd86dcc.exe	44
PID 2832 wrote to memory of 1356	2832	ab4bd86dcc.exe	44
PID 2832 wrote to memory of 1356	2832	ab4bd86dcc.exe	44
PID 2832 wrote to memory of 1632	2832	ab4bd86dcc.exe	45
PID 2832 wrote to memory of 1632	2832	ab4bd86dcc.exe	45
PID 2832 wrote to memory of 1632	2832	ab4bd86dcc.exe	45
PID 2832 wrote to memory of 1632	2832	ab4bd86dcc.exe	45
PID 2832 wrote to memory of 2740	2832	ab4bd86dcc.exe	46
PID 2832 wrote to memory of 2740	2832	ab4bd86dcc.exe	46
PID 2832 wrote to memory of 2740	2832	ab4bd86dcc.exe	46
PID 2832 wrote to memory of 2740	2832	ab4bd86dcc.exe	46
PID 2832 wrote to memory of 2740	2832	ab4bd86dcc.exe	46
PID 2832 wrote to memory of 2740	2832	ab4bd86dcc.exe	46
PID 2832 wrote to memory of 2740	2832	ab4bd86dcc.exe	46
PID 2832 wrote to memory of 2740	2832	ab4bd86dcc.exe	46
PID 2832 wrote to memory of 2740	2832	ab4bd86dcc.exe	46
PID 1700 wrote to memory of 1400	1700	94f0301255.exe	47
PID 1700 wrote to memory of 1400	1700	94f0301255.exe	47

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 3 IoCs

Hidden Files and Directories

T1564.001

pid	Process
4304	attrib.exe
4336	attrib.exe
4328	attrib.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1196
- C:\Users\Admin\AppData\Local\Temp\f3e3c4115bd289a528c02aae90a563e6b5dd6009e125d1fb142bcc7218cf068d.exe
  "C:\Users\Admin\AppData\Local\Temp\f3e3c4115bd289a528c02aae90a563e6b5dd6009e125d1fb142bcc7218cf068d.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
    "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2748
  - - C:\Users\Admin\AppData\Local\Temp\1018351001\ab4bd86dcc.exe
      "C:\Users\Admin\AppData\Local\Temp\1018351001\ab4bd86dcc.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2832
    - - C:\Users\Admin\AppData\Local\Temp\1018351001\ab4bd86dcc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018351001\ab4bd86dcc.exe"
        5⤵
        Executes dropped EXE
        
        PID:1596
    - - C:\Users\Admin\AppData\Local\Temp\1018351001\ab4bd86dcc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018351001\ab4bd86dcc.exe"
        5⤵
        Executes dropped EXE
        
        PID:1356
    - - C:\Users\Admin\AppData\Local\Temp\1018351001\ab4bd86dcc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018351001\ab4bd86dcc.exe"
        5⤵
        Executes dropped EXE
        
        PID:1632
    - - C:\Users\Admin\AppData\Local\Temp\1018351001\ab4bd86dcc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018351001\ab4bd86dcc.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2740
  - - C:\Users\Admin\AppData\Local\Temp\1018353001\1b12d9265c.exe
      "C:\Users\Admin\AppData\Local\Temp\1018353001\1b12d9265c.exe"
      4⤵
      Enumerates VirtualBox registry keys
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1940
  - - C:\Users\Admin\AppData\Local\Temp\1018354001\b5a0016111.exe
      "C:\Users\Admin\AppData\Local\Temp\1018354001\b5a0016111.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2400
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\b5a0016111.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\b5a0016111.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies system certificate store
        
        PID:872
  - - C:\Users\Admin\AppData\Local\Temp\1018355001\8160d7817e.exe
      "C:\Users\Admin\AppData\Local\Temp\1018355001\8160d7817e.exe"
      4⤵
      Executes dropped EXE
      PID:2788
  - - C:\Users\Admin\AppData\Local\Temp\1018356001\94f0301255.exe
      "C:\Users\Admin\AppData\Local\Temp\1018356001\94f0301255.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1700
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath "C:\nqrscd"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1052
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1400
  - - C:\Users\Admin\AppData\Local\Temp\1018357001\6d4b9dcf61.exe
      "C:\Users\Admin\AppData\Local\Temp\1018357001\6d4b9dcf61.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3428
  - - C:\Users\Admin\AppData\Local\Temp\1018358001\818f5dca0c.exe
      "C:\Users\Admin\AppData\Local\Temp\1018358001\818f5dca0c.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      PID:9180
  - - C:\Users\Admin\AppData\Local\Temp\1018359001\4d412062f0.exe
      "C:\Users\Admin\AppData\Local\Temp\1018359001\4d412062f0.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:6084
  - - C:\Users\Admin\AppData\Local\Temp\1018360001\96f9225a06.exe
      "C:\Users\Admin\AppData\Local\Temp\1018360001\96f9225a06.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:6836
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM firefox.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:6984
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:7276
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:7392
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:7496
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:7632
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
        5⤵
        
        PID:7776
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        6⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:7796
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7796.0.1685639253\531302897" -parentBuildID 20221007134813 -prefsHandle 1236 -prefMapHandle 1228 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {77f25fea-bec9-4be7-944f-e365ee4036f0} 7796 "\\.\pipe\gecko-crash-server-pipe.7796" 1300 121d6758 gpu
        7⤵
        
        PID:8152
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7796.1.555833866\1602816401" -parentBuildID 20221007134813 -prefsHandle 1504 -prefMapHandle 1500 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {75857f1c-7ce3-4cdb-ab51-88b371ee0b66} 7796 "\\.\pipe\gecko-crash-server-pipe.7796" 1516 e73c58 socket
        7⤵
        
        PID:8284
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7796.2.1824538288\1625373714" -childID 1 -isForBrowser -prefsHandle 2108 -prefMapHandle 2104 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 852 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d93cd95d-65e3-4e82-9cab-5ea38ecce26e} 7796 "\\.\pipe\gecko-crash-server-pipe.7796" 2120 1a0aa658 tab
        7⤵
        
        PID:8800
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7796.3.1514808556\2036080494" -childID 2 -isForBrowser -prefsHandle 2832 -prefMapHandle 2828 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 852 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8f6f8449-b60a-4ec6-87d4-57e7851f6b1c} 7796 "\\.\pipe\gecko-crash-server-pipe.7796" 2844 e5d858 tab
        7⤵
        
        PID:3772
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7796.4.711299274\1817094259" -childID 3 -isForBrowser -prefsHandle 3772 -prefMapHandle 3744 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 852 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {12d42a05-3521-4ffd-9b24-18309afe8569} 7796 "\\.\pipe\gecko-crash-server-pipe.7796" 3760 1f676658 tab
        7⤵
        
        PID:3104
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7796.5.698389674\1666187025" -childID 4 -isForBrowser -prefsHandle 3976 -prefMapHandle 3988 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 852 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {20c02cbd-69cf-45b0-8405-b5519ba528af} 7796 "\\.\pipe\gecko-crash-server-pipe.7796" 3964 21b25d58 tab
        7⤵
        
        PID:8100
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7796.6.340571144\706438751" -childID 5 -isForBrowser -prefsHandle 4020 -prefMapHandle 4016 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 852 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bf8aba2b-5fb3-4a17-919d-b35237a7c9e8} 7796 "\\.\pipe\gecko-crash-server-pipe.7796" 4032 21b27e58 tab
        7⤵
        
        PID:8424
  - - C:\Users\Admin\AppData\Local\Temp\1018361001\22ed1302a4.exe
      "C:\Users\Admin\AppData\Local\Temp\1018361001\22ed1302a4.exe"
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Windows security modification
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3312
  - - C:\Users\Admin\AppData\Local\Temp\1018362001\119eb1062a.exe
      "C:\Users\Admin\AppData\Local\Temp\1018362001\119eb1062a.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1748
    - - C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
        5⤵
        Loads dropped DLL
        
        PID:292
      - C:\Windows\system32\mode.com
        
        mode 65,10
        6⤵
        
        PID:372
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e file.zip -p24291711423417250691697322505 -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:3024
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_7.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:3096
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_6.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:4128
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_5.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:4168
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_4.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:4196
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_3.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:4228
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_2.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:4252
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_1.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:4276
      - C:\Windows\system32\attrib.exe
        
        attrib +H "in.exe"
        6⤵
        Views/modifies file attributes
        
        PID:4304
      - C:\Users\Admin\AppData\Local\Temp\main\in.exe
        
        "in.exe"
        6⤵
        Executes dropped EXE
        
        PID:4316
        
        C:\Windows\system32\attrib.exe
        
        attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
        7⤵
        Views/modifies file attributes
        
        PID:4328
        
        C:\Windows\system32\attrib.exe
        
        attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
        7⤵
        Views/modifies file attributes
        
        PID:4336
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4344
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell ping 127.0.0.1; del in.exe
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4352
        
        C:\Windows\system32\PING.EXE
        
        "C:\Windows\system32\PING.EXE" 127.0.0.1
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4488
  - - C:\Users\Admin\AppData\Local\Temp\1018363001\2cf1899635.exe
      "C:\Users\Admin\AppData\Local\Temp\1018363001\2cf1899635.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4560
  - - C:\Users\Admin\AppData\Local\Temp\1018364001\63c55cb05c.exe
      "C:\Users\Admin\AppData\Local\Temp\1018364001\63c55cb05c.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4892
    - - C:\Users\Admin\AppData\Local\Temp\1018364001\63c55cb05c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018364001\63c55cb05c.exe"
        5⤵
        Executes dropped EXE
        
        PID:7372
    - - C:\Users\Admin\AppData\Local\Temp\1018364001\63c55cb05c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018364001\63c55cb05c.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:7388
  - - C:\Users\Admin\AppData\Local\Temp\1018365001\25f6e62deb.exe
      "C:\Users\Admin\AppData\Local\Temp\1018365001\25f6e62deb.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5040
  - - C:\Users\Admin\AppData\Local\Temp\1018366001\3c62c3d17f.exe
      "C:\Users\Admin\AppData\Local\Temp\1018366001\3c62c3d17f.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5252
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath "C:\zhcgd"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5316
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5388
  - - C:\Users\Admin\AppData\Local\Temp\1018367001\3aa5453546.exe
      "C:\Users\Admin\AppData\Local\Temp\1018367001\3aa5453546.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:5588
    - - C:\Users\Admin\AppData\Local\Temp\1018367001\3aa5453546.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018367001\3aa5453546.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5636
  - - C:\Users\Admin\AppData\Local\Temp\1018368001\8797d752f7.exe
      "C:\Users\Admin\AppData\Local\Temp\1018368001\8797d752f7.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5864
  - - C:\Users\Admin\AppData\Local\Temp\1018369001\53c67451a6.exe
      "C:\Users\Admin\AppData\Local\Temp\1018369001\53c67451a6.exe"
      4⤵
      Enumerates VirtualBox registry keys
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:6952
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5152

C:\Windows\system32\taskeng.exe
taskeng.exe {C99510D1-1D39-462E-9E97-FC7AE4B52297} S-1-5-21-1488793075-819845221-1497111674-1000:UPNECVIU\Admin:Interactive:[1]
1⤵
- Loads dropped DLL
PID:7636
- C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  PID:7696
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:7708
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
    3⤵
    - Drops file in System32 directory
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:7788
  - - C:\Windows\system32\PING.EXE
      "C:\Windows\system32\PING.EXE" 127.1.10.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:7928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion