amadey | e02129bdbea6e49627ffbff6f291a4c1295d15725f47c1ebdae7c85a1a7dbb59

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	d6e0508222.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	d6e0508222.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	d6e0508222.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	d6e0508222.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	d6e0508222.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	d6e0508222.exe

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3800 created 1188	3800	2a601592ba.exe	21

Enumerates VirtualBox registry keys 2 TTPs 2 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	04b2499572.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	6eb61027e4.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 11 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	c4b79547db.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	0d090bb58d.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2a601592ba.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	file.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	04b2499572.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	95916cada4.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	78efc2d1fd.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	d6e0508222.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	7e2e5ec93e.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	6eb61027e4.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1748	powershell.exe
3128	powershell.exe
564	powershell.exe
1088	powershell.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 22 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	d6e0508222.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	d6e0508222.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	7e2e5ec93e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	c4b79547db.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	7e2e5ec93e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2a601592ba.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	6eb61027e4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	95916cada4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	04b2499572.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	04b2499572.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	78efc2d1fd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	78efc2d1fd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	0d090bb58d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2a601592ba.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	c4b79547db.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	0d090bb58d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	6eb61027e4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	95916cada4.exe

Executes dropped EXE 33 IoCs

pid	Process
2684	skotes.exe
2928	8c129573bd.exe
2880	e7418ab010.exe
2388	04b2499572.exe
1340	95916cada4.exe
2040	78efc2d1fd.exe
2876	c4b79547db.exe
1992	56039dc13c.exe
1916	d6e0508222.exe
2640	8c129573bd.exe
1624	aa73a3a5d2.exe
320	7e2e5ec93e.exe
3232	nkCWteW.exe
3404	0d090bb58d.exe
3644	80c8922923.exe
3800	2a601592ba.exe
4080	af6cf77ce0.exe
2596	931589470e.exe
3832	6eb61027e4.exe
4020	7z.exe
4016	7z.exe
3092	7z.exe
3096	7z.exe
3960	7z.exe
1040	7z.exe
928	7z.exe
908	7z.exe
2848	in.exe
3156	9eff070646.exe
3208	80c8922923.exe
4160	9eff070646.exe
10728	726a586ede.exe
10876	Intel_PTT_EK_Recertification.exe

Identifies Wine through registry keys 2 TTPs 11 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	file.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	04b2499572.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	95916cada4.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	78efc2d1fd.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	0d090bb58d.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	2a601592ba.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	c4b79547db.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	d6e0508222.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	7e2e5ec93e.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	6eb61027e4.exe

Loads dropped DLL 59 IoCs

pid	Process
2740	file.exe
2684	skotes.exe
2684	skotes.exe
2684	skotes.exe
2684	skotes.exe
2684	skotes.exe
2684	skotes.exe
2684	skotes.exe
2684	skotes.exe
2684	skotes.exe
2684	skotes.exe
2684	skotes.exe
2928	8c129573bd.exe
2684	skotes.exe
2684	skotes.exe
2684	skotes.exe
2684	skotes.exe
1340	95916cada4.exe
2684	skotes.exe
2684	skotes.exe
3264	WerFault.exe
3264	WerFault.exe
3264	WerFault.exe
3264	WerFault.exe
2684	skotes.exe
2684	skotes.exe
2684	skotes.exe
2684	skotes.exe
2684	skotes.exe
2684	skotes.exe
2684	skotes.exe
2684	skotes.exe
2684	skotes.exe
2684	skotes.exe
3924	cmd.exe
4020	7z.exe
3924	cmd.exe
4016	7z.exe
3924	cmd.exe
3092	7z.exe
3924	cmd.exe
3096	7z.exe
3924	cmd.exe
3960	7z.exe
3924	cmd.exe
1040	7z.exe
3924	cmd.exe
928	7z.exe
3924	cmd.exe
908	7z.exe
3924	cmd.exe
3924	cmd.exe
2684	skotes.exe
2684	skotes.exe
3644	80c8922923.exe
3156	9eff070646.exe
2684	skotes.exe
10836	taskeng.exe
10836	taskeng.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	d6e0508222.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	d6e0508222.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\d6e0508222.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1018431001\\d6e0508222.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\78efc2d1fd.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1018428001\\78efc2d1fd.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\c4b79547db.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1018429001\\c4b79547db.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\56039dc13c.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1018430001\\56039dc13c.exe"	skotes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x00050000000195ab-159.dat	autoit_exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs

pid	Process
2740	file.exe
2684	skotes.exe
2388	04b2499572.exe
1340	95916cada4.exe
2040	78efc2d1fd.exe
2876	c4b79547db.exe
1916	d6e0508222.exe
320	7e2e5ec93e.exe
3404	0d090bb58d.exe
3800	2a601592ba.exe
3832	6eb61027e4.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2928 set thread context of 2640	2928	8c129573bd.exe	49
PID 3644 set thread context of 3208	3644	80c8922923.exe	108
PID 3156 set thread context of 4160	3156	9eff070646.exe	109
PID 10876 set thread context of 10884	10876	Intel_PTT_EK_Recertification.exe	113

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2848-758-0x000000013F2F0000-0x000000013F780000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	file.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 33 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c4b79547db.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7e2e5ec93e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2a601592ba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	af6cf77ce0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9eff070646.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e7418ab010.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8c129573bd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6eb61027e4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	56039dc13c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	80c8922923.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	931589470e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	80c8922923.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dialer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	56039dc13c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	78efc2d1fd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	95916cada4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0d090bb58d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	04b2499572.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9eff070646.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d6e0508222.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8c129573bd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	56039dc13c.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3144	powershell.exe
3368	PING.EXE
10928	powershell.exe
11012	PING.EXE

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Kills process with taskkill 5 IoCs

pid	Process
2144	taskkill.exe
1140	taskkill.exe
2956	taskkill.exe
2116	taskkill.exe
2076	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_Classes\Local Settings	firefox.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	8c129573bd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	8c129573bd.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	8c129573bd.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	8c129573bd.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
3368	PING.EXE
11012	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2872	schtasks.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
2740	file.exe
2684	skotes.exe
2880	e7418ab010.exe
1088	powershell.exe
1748	powershell.exe
2388	04b2499572.exe
2388	04b2499572.exe
2388	04b2499572.exe
2388	04b2499572.exe
2388	04b2499572.exe
2388	04b2499572.exe
1340	95916cada4.exe
2040	78efc2d1fd.exe
2876	c4b79547db.exe
1916	d6e0508222.exe
1916	d6e0508222.exe
1916	d6e0508222.exe
1992	56039dc13c.exe
320	7e2e5ec93e.exe
1992	56039dc13c.exe
3404	0d090bb58d.exe
3800	2a601592ba.exe
3800	2a601592ba.exe
3800	2a601592ba.exe
3800	2a601592ba.exe
3800	2a601592ba.exe
3800	2a601592ba.exe
3984	dialer.exe
3984	dialer.exe
3984	dialer.exe
3984	dialer.exe
4080	af6cf77ce0.exe
3128	powershell.exe
564	powershell.exe
3832	6eb61027e4.exe
3832	6eb61027e4.exe
3832	6eb61027e4.exe
3832	6eb61027e4.exe
3832	6eb61027e4.exe
3832	6eb61027e4.exe
3144	powershell.exe
3208	80c8922923.exe
3208	80c8922923.exe
10876	Intel_PTT_EK_Recertification.exe
10928	powershell.exe

Suspicious use of AdjustPrivilegeToken 51 IoCs

description	pid	Process
Token: SeDebugPrivilege	2928	8c129573bd.exe
Token: SeDebugPrivilege	2880	e7418ab010.exe
Token: SeDebugPrivilege	1088	powershell.exe
Token: SeDebugPrivilege	1748	powershell.exe
Token: SeDebugPrivilege	2144	taskkill.exe
Token: SeDebugPrivilege	1916	d6e0508222.exe
Token: SeDebugPrivilege	1140	taskkill.exe
Token: SeDebugPrivilege	2956	taskkill.exe
Token: SeDebugPrivilege	2116	taskkill.exe
Token: SeDebugPrivilege	2076	taskkill.exe
Token: SeDebugPrivilege	3040	firefox.exe
Token: SeDebugPrivilege	3040	firefox.exe
Token: SeDebugPrivilege	4080	af6cf77ce0.exe
Token: SeDebugPrivilege	3128	powershell.exe
Token: SeDebugPrivilege	564	powershell.exe
Token: SeRestorePrivilege	4020	7z.exe
Token: 35	4020	7z.exe
Token: SeSecurityPrivilege	4020	7z.exe
Token: SeSecurityPrivilege	4020	7z.exe
Token: SeRestorePrivilege	4016	7z.exe
Token: 35	4016	7z.exe
Token: SeSecurityPrivilege	4016	7z.exe
Token: SeSecurityPrivilege	4016	7z.exe
Token: SeRestorePrivilege	3092	7z.exe
Token: 35	3092	7z.exe
Token: SeSecurityPrivilege	3092	7z.exe
Token: SeSecurityPrivilege	3092	7z.exe
Token: SeRestorePrivilege	3096	7z.exe
Token: 35	3096	7z.exe
Token: SeSecurityPrivilege	3096	7z.exe
Token: SeSecurityPrivilege	3096	7z.exe
Token: SeRestorePrivilege	3960	7z.exe
Token: 35	3960	7z.exe
Token: SeSecurityPrivilege	3960	7z.exe
Token: SeSecurityPrivilege	3960	7z.exe
Token: SeRestorePrivilege	1040	7z.exe
Token: 35	1040	7z.exe
Token: SeSecurityPrivilege	1040	7z.exe
Token: SeSecurityPrivilege	1040	7z.exe
Token: SeRestorePrivilege	928	7z.exe
Token: 35	928	7z.exe
Token: SeSecurityPrivilege	928	7z.exe
Token: SeSecurityPrivilege	928	7z.exe
Token: SeRestorePrivilege	908	7z.exe
Token: 35	908	7z.exe
Token: SeSecurityPrivilege	908	7z.exe
Token: SeSecurityPrivilege	908	7z.exe
Token: SeDebugPrivilege	3144	powershell.exe
Token: SeDebugPrivilege	3208	80c8922923.exe
Token: SeDebugPrivilege	10928	powershell.exe
Token: SeLockMemoryPrivilege	10884	explorer.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
2740	file.exe
1992	56039dc13c.exe
1992	56039dc13c.exe
1992	56039dc13c.exe
1992	56039dc13c.exe
1992	56039dc13c.exe
1992	56039dc13c.exe
1992	56039dc13c.exe
1992	56039dc13c.exe
1992	56039dc13c.exe
1992	56039dc13c.exe
1992	56039dc13c.exe
1992	56039dc13c.exe
1992	56039dc13c.exe
1992	56039dc13c.exe
1992	56039dc13c.exe
1992	56039dc13c.exe
1992	56039dc13c.exe
1992	56039dc13c.exe
1992	56039dc13c.exe
1992	56039dc13c.exe
3040	firefox.exe
3040	firefox.exe
3040	firefox.exe
1992	56039dc13c.exe
3040	firefox.exe
1992	56039dc13c.exe
1992	56039dc13c.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
1992	56039dc13c.exe
1992	56039dc13c.exe
1992	56039dc13c.exe
1992	56039dc13c.exe
1992	56039dc13c.exe
1992	56039dc13c.exe
1992	56039dc13c.exe
1992	56039dc13c.exe
1992	56039dc13c.exe
1992	56039dc13c.exe
1992	56039dc13c.exe
1992	56039dc13c.exe
1992	56039dc13c.exe
1992	56039dc13c.exe
1992	56039dc13c.exe
1992	56039dc13c.exe
1992	56039dc13c.exe
1992	56039dc13c.exe
1992	56039dc13c.exe
1992	56039dc13c.exe
3040	firefox.exe
3040	firefox.exe
1992	56039dc13c.exe
3040	firefox.exe
1992	56039dc13c.exe
1992	56039dc13c.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 2684	2740	file.exe	30
PID 2740 wrote to memory of 2684	2740	file.exe	30
PID 2740 wrote to memory of 2684	2740	file.exe	30
PID 2740 wrote to memory of 2684	2740	file.exe	30
PID 2684 wrote to memory of 2928	2684	skotes.exe	32
PID 2684 wrote to memory of 2928	2684	skotes.exe	32
PID 2684 wrote to memory of 2928	2684	skotes.exe	32
PID 2684 wrote to memory of 2928	2684	skotes.exe	32
PID 2684 wrote to memory of 2928	2684	skotes.exe	32
PID 2684 wrote to memory of 2928	2684	skotes.exe	32
PID 2684 wrote to memory of 2928	2684	skotes.exe	32
PID 2684 wrote to memory of 2880	2684	skotes.exe	33
PID 2684 wrote to memory of 2880	2684	skotes.exe	33
PID 2684 wrote to memory of 2880	2684	skotes.exe	33
PID 2684 wrote to memory of 2880	2684	skotes.exe	33
PID 2880 wrote to memory of 1088	2880	e7418ab010.exe	35
PID 2880 wrote to memory of 1088	2880	e7418ab010.exe	35
PID 2880 wrote to memory of 1088	2880	e7418ab010.exe	35
PID 2880 wrote to memory of 1088	2880	e7418ab010.exe	35
PID 2880 wrote to memory of 1748	2880	e7418ab010.exe	37
PID 2880 wrote to memory of 1748	2880	e7418ab010.exe	37
PID 2880 wrote to memory of 1748	2880	e7418ab010.exe	37
PID 2880 wrote to memory of 1748	2880	e7418ab010.exe	37
PID 2684 wrote to memory of 2388	2684	skotes.exe	39
PID 2684 wrote to memory of 2388	2684	skotes.exe	39
PID 2684 wrote to memory of 2388	2684	skotes.exe	39
PID 2684 wrote to memory of 2388	2684	skotes.exe	39
PID 2684 wrote to memory of 1340	2684	skotes.exe	40
PID 2684 wrote to memory of 1340	2684	skotes.exe	40
PID 2684 wrote to memory of 1340	2684	skotes.exe	40
PID 2684 wrote to memory of 1340	2684	skotes.exe	40
PID 2684 wrote to memory of 2040	2684	skotes.exe	41
PID 2684 wrote to memory of 2040	2684	skotes.exe	41
PID 2684 wrote to memory of 2040	2684	skotes.exe	41
PID 2684 wrote to memory of 2040	2684	skotes.exe	41
PID 2684 wrote to memory of 2876	2684	skotes.exe	42
PID 2684 wrote to memory of 2876	2684	skotes.exe	42
PID 2684 wrote to memory of 2876	2684	skotes.exe	42
PID 2684 wrote to memory of 2876	2684	skotes.exe	42
PID 2684 wrote to memory of 1992	2684	skotes.exe	44
PID 2684 wrote to memory of 1992	2684	skotes.exe	44
PID 2684 wrote to memory of 1992	2684	skotes.exe	44
PID 2684 wrote to memory of 1992	2684	skotes.exe	44
PID 1992 wrote to memory of 2144	1992	56039dc13c.exe	45
PID 1992 wrote to memory of 2144	1992	56039dc13c.exe	45
PID 1992 wrote to memory of 2144	1992	56039dc13c.exe	45
PID 1992 wrote to memory of 2144	1992	56039dc13c.exe	45
PID 2684 wrote to memory of 1916	2684	skotes.exe	48
PID 2684 wrote to memory of 1916	2684	skotes.exe	48
PID 2684 wrote to memory of 1916	2684	skotes.exe	48
PID 2684 wrote to memory of 1916	2684	skotes.exe	48
PID 2928 wrote to memory of 2640	2928	8c129573bd.exe	49
PID 2928 wrote to memory of 2640	2928	8c129573bd.exe	49
PID 2928 wrote to memory of 2640	2928	8c129573bd.exe	49
PID 2928 wrote to memory of 2640	2928	8c129573bd.exe	49
PID 2928 wrote to memory of 2640	2928	8c129573bd.exe	49
PID 2928 wrote to memory of 2640	2928	8c129573bd.exe	49
PID 2928 wrote to memory of 2640	2928	8c129573bd.exe	49
PID 2928 wrote to memory of 2640	2928	8c129573bd.exe	49
PID 2928 wrote to memory of 2640	2928	8c129573bd.exe	49
PID 2928 wrote to memory of 2640	2928	8c129573bd.exe	49
PID 2928 wrote to memory of 2640	2928	8c129573bd.exe	49
PID 2928 wrote to memory of 2640	2928	8c129573bd.exe	49
PID 2928 wrote to memory of 2640	2928	8c129573bd.exe	49

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 3 IoCs

Hidden Files and Directories

T1564.001

pid	Process
3164	attrib.exe
1516	attrib.exe
2852	attrib.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1188
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
    "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2684
  - - C:\Users\Admin\AppData\Local\Temp\1018424001\8c129573bd.exe
      "C:\Users\Admin\AppData\Local\Temp\1018424001\8c129573bd.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2928
    - - C:\Users\Admin\AppData\Local\Temp\1018424001\8c129573bd.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018424001\8c129573bd.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies system certificate store
        
        PID:2640
  - - C:\Users\Admin\AppData\Local\Temp\1018425001\e7418ab010.exe
      "C:\Users\Admin\AppData\Local\Temp\1018425001\e7418ab010.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2880
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath "C:\fbhnpobg"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1088
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1748
  - - C:\Users\Admin\AppData\Local\Temp\1018426001\04b2499572.exe
      "C:\Users\Admin\AppData\Local\Temp\1018426001\04b2499572.exe"
      4⤵
      Enumerates VirtualBox registry keys
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2388
  - - C:\Users\Admin\AppData\Local\Temp\1018427001\95916cada4.exe
      "C:\Users\Admin\AppData\Local\Temp\1018427001\95916cada4.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1340
  - - C:\Users\Admin\AppData\Local\Temp\1018428001\78efc2d1fd.exe
      "C:\Users\Admin\AppData\Local\Temp\1018428001\78efc2d1fd.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2040
  - - C:\Users\Admin\AppData\Local\Temp\1018429001\c4b79547db.exe
      "C:\Users\Admin\AppData\Local\Temp\1018429001\c4b79547db.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2876
  - - C:\Users\Admin\AppData\Local\Temp\1018430001\56039dc13c.exe
      "C:\Users\Admin\AppData\Local\Temp\1018430001\56039dc13c.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:1992
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM firefox.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2144
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1140
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2956
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2116
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2076
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
        5⤵
        
        PID:868
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        6⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3040
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3040.0.1558539737\110888396" -parentBuildID 20221007134813 -prefsHandle 1264 -prefMapHandle 1244 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4895e227-4221-48b6-b2f4-1ae1a4882e2e} 3040 "\\.\pipe\gecko-crash-server-pipe.3040" 1328 fdda358 gpu
        7⤵
        
        PID:280
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3040.1.1110238584\1913704583" -parentBuildID 20221007134813 -prefsHandle 1532 -prefMapHandle 1528 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {05182d86-1911-4662-831d-9272bce94945} 3040 "\\.\pipe\gecko-crash-server-pipe.3040" 1544 eaefc58 socket
        7⤵
        
        PID:2092
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3040.2.1221384224\1990935362" -childID 1 -isForBrowser -prefsHandle 2248 -prefMapHandle 2244 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 668 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e0a38dc4-51d0-4cb4-af4c-e68f279a0bb7} 3040 "\\.\pipe\gecko-crash-server-pipe.3040" 2260 fd5a158 tab
        7⤵
        
        PID:2644
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3040.3.1716886093\2038706829" -childID 2 -isForBrowser -prefsHandle 2844 -prefMapHandle 2840 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 668 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {edc28ed8-916e-4452-a7f7-463f385c45f5} 3040 "\\.\pipe\gecko-crash-server-pipe.3040" 2856 e5d258 tab
        7⤵
        
        PID:676
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3040.4.1151478909\1127044306" -childID 3 -isForBrowser -prefsHandle 3656 -prefMapHandle 3556 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 668 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2ce0d5ef-5319-47b9-9f87-3af12e2e91d5} 3040 "\\.\pipe\gecko-crash-server-pipe.3040" 3676 1b1f8558 tab
        7⤵
        
        PID:2064
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3040.5.638095454\540928341" -childID 4 -isForBrowser -prefsHandle 3800 -prefMapHandle 3804 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 668 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1a525bdb-1569-4eb0-8d8b-cd1cf27738b1} 3040 "\\.\pipe\gecko-crash-server-pipe.3040" 3792 1b1f9458 tab
        7⤵
        
        PID:1776
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3040.6.1533145004\2042712747" -childID 5 -isForBrowser -prefsHandle 4004 -prefMapHandle 4008 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 668 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cbc1900e-c17d-480f-8e28-9d8a9385a96c} 3040 "\\.\pipe\gecko-crash-server-pipe.3040" 3996 1b1fa358 tab
        7⤵
        
        PID:1488
  - - C:\Users\Admin\AppData\Local\Temp\1018431001\d6e0508222.exe
      "C:\Users\Admin\AppData\Local\Temp\1018431001\d6e0508222.exe"
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Windows security modification
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1916
  - - C:\Users\Admin\AppData\Local\Temp\1018432001\aa73a3a5d2.exe
      "C:\Users\Admin\AppData\Local\Temp\1018432001\aa73a3a5d2.exe"
      4⤵
      Executes dropped EXE
      PID:1624
  - - C:\Users\Admin\AppData\Local\Temp\1018433001\7e2e5ec93e.exe
      "C:\Users\Admin\AppData\Local\Temp\1018433001\7e2e5ec93e.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:320
  - - C:\Users\Admin\AppData\Local\Temp\1018434001\nkCWteW.exe
      "C:\Users\Admin\AppData\Local\Temp\1018434001\nkCWteW.exe"
      4⤵
      Executes dropped EXE
      PID:3232
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 3232 -s 92
        5⤵
        Loads dropped DLL
        
        PID:3264
  - - C:\Users\Admin\AppData\Local\Temp\1018435001\0d090bb58d.exe
      "C:\Users\Admin\AppData\Local\Temp\1018435001\0d090bb58d.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3404
  - - C:\Users\Admin\AppData\Local\Temp\1018436001\80c8922923.exe
      "C:\Users\Admin\AppData\Local\Temp\1018436001\80c8922923.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:3644
    - - C:\Users\Admin\AppData\Local\Temp\1018436001\80c8922923.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018436001\80c8922923.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3208
  - - C:\Users\Admin\AppData\Local\Temp\1018437001\2a601592ba.exe
      "C:\Users\Admin\AppData\Local\Temp\1018437001\2a601592ba.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3800
  - - C:\Users\Admin\AppData\Local\Temp\1018438001\af6cf77ce0.exe
      "C:\Users\Admin\AppData\Local\Temp\1018438001\af6cf77ce0.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4080
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath "C:\rlbup"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3128
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:564
  - - C:\Users\Admin\AppData\Local\Temp\1018439001\931589470e.exe
      "C:\Users\Admin\AppData\Local\Temp\1018439001\931589470e.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2596
    - - C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
        5⤵
        Loads dropped DLL
        
        PID:3924
      - C:\Windows\system32\mode.com
        
        mode 65,10
        6⤵
        
        PID:3976
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e file.zip -p24291711423417250691697322505 -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:4020
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_7.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:4016
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_6.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:3092
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_5.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:3096
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_4.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:3960
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_3.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1040
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_2.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:928
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_1.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:908
      - C:\Windows\system32\attrib.exe
        
        attrib +H "in.exe"
        6⤵
        Views/modifies file attributes
        
        PID:1516
      - C:\Users\Admin\AppData\Local\Temp\main\in.exe
        
        "in.exe"
        6⤵
        Executes dropped EXE
        
        PID:2848
        
        C:\Windows\system32\attrib.exe
        
        attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
        7⤵
        Views/modifies file attributes
        
        PID:2852
        
        C:\Windows\system32\attrib.exe
        
        attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
        7⤵
        Views/modifies file attributes
        
        PID:3164
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2872
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell ping 127.0.0.1; del in.exe
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3144
        
        C:\Windows\system32\PING.EXE
        
        "C:\Windows\system32\PING.EXE" 127.0.0.1
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3368
  - - C:\Users\Admin\AppData\Local\Temp\1018440001\6eb61027e4.exe
      "C:\Users\Admin\AppData\Local\Temp\1018440001\6eb61027e4.exe"
      4⤵
      Enumerates VirtualBox registry keys
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3832
  - - C:\Users\Admin\AppData\Local\Temp\1018441001\9eff070646.exe
      "C:\Users\Admin\AppData\Local\Temp\1018441001\9eff070646.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:3156
    - - C:\Users\Admin\AppData\Local\Temp\1018441001\9eff070646.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018441001\9eff070646.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4160
  - - C:\Users\Admin\AppData\Local\Temp\1018442001\726a586ede.exe
      "C:\Users\Admin\AppData\Local\Temp\1018442001\726a586ede.exe"
      4⤵
      Executes dropped EXE
      PID:10728
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3984

C:\Windows\system32\taskeng.exe
taskeng.exe {3E992E08-8662-4351-BD79-B6F408A622D5} S-1-5-21-3692679935-4019334568-335155002-1000:BCXRJFKE\Admin:Interactive:[1]
1⤵
- Loads dropped DLL
PID:10836
- C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  PID:10876
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:10884
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
    3⤵
    - Drops file in System32 directory
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:10928
  - - C:\Windows\system32\PING.EXE
      "C:\Windows\system32\PING.EXE" 127.1.10.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:11012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion