amadey | d4d873be4406e74df951d8ec2781150c426663904bf44e504fafa7d70b0e7099

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	758d312349.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	758d312349.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	758d312349.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	758d312349.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	758d312349.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	758d312349.exe

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Enumerates VirtualBox registry keys 2 TTPs 2 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	088882ec9e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	ddb580e8ca.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	3cb57239ec.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	758d312349.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	088882ec9e.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	9984bf5154.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	bce03ac5c1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ddb580e8ca.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	e3aff30fc4.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	d4d873be4406e74df951d8ec2781150c426663904bf44e504fafa7d70b0e7099.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4992	powershell.exe
5176	powershell.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 18 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ddb580e8ca.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	d4d873be4406e74df951d8ec2781150c426663904bf44e504fafa7d70b0e7099.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3cb57239ec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	9984bf5154.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	bce03ac5c1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ddb580e8ca.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	e3aff30fc4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3cb57239ec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	088882ec9e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	bce03ac5c1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	9984bf5154.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	088882ec9e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	758d312349.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	758d312349.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	e3aff30fc4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	d4d873be4406e74df951d8ec2781150c426663904bf44e504fafa7d70b0e7099.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe

Executes dropped EXE 29 IoCs

pid	Process
2912	skotes.exe
1380	ab866f55be.exe
1220	3cb57239ec.exe
2364	9984bf5154.exe
2012	ceb9b1ec8f.exe
1768	758d312349.exe
3220	ab866f55be.exe
11464	37bc592bbe.exe
11612	0977c7d44d.exe
11868	7z.exe
11916	7z.exe
11964	7z.exe
12004	7z.exe
12044	7z.exe
12084	7z.exe
12124	7z.exe
12164	7z.exe
12208	in.exe
6836	Dry.com
3732	088882ec9e.exe
3896	1b0d6a38eb.exe
4036	bce03ac5c1.exe
1380	02f53e2278.exe
4196	02f53e2278.exe
4492	e030ab590b.exe
4768	Intel_PTT_EK_Recertification.exe
5412	ddb580e8ca.exe
5636	e3aff30fc4.exe
6632	Intel_PTT_EK_Recertification.exe

Identifies Wine through registry keys 2 TTPs 9 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Wine	3cb57239ec.exe
Key opened	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Wine	9984bf5154.exe
Key opened	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Wine	088882ec9e.exe
Key opened	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Wine	bce03ac5c1.exe
Key opened	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Wine	e3aff30fc4.exe
Key opened	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Wine	d4d873be4406e74df951d8ec2781150c426663904bf44e504fafa7d70b0e7099.exe
Key opened	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Wine	758d312349.exe
Key opened	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Wine	ddb580e8ca.exe

Loads dropped DLL 48 IoCs

pid	Process
2620	d4d873be4406e74df951d8ec2781150c426663904bf44e504fafa7d70b0e7099.exe
2912	skotes.exe
2912	skotes.exe
2912	skotes.exe
2912	skotes.exe
2912	skotes.exe
2912	skotes.exe
2912	skotes.exe
2912	skotes.exe
2912	skotes.exe
1380	ab866f55be.exe
2912	skotes.exe
2912	skotes.exe
11612	0977c7d44d.exe
11792	cmd.exe
11868	7z.exe
11792	cmd.exe
11916	7z.exe
11792	cmd.exe
11964	7z.exe
11792	cmd.exe
12004	7z.exe
11792	cmd.exe
12044	7z.exe
11792	cmd.exe
12084	7z.exe
11792	cmd.exe
12124	7z.exe
11792	cmd.exe
12164	7z.exe
11792	cmd.exe
11792	cmd.exe
11840	cmd.exe
2912	skotes.exe
2912	skotes.exe
2912	skotes.exe
2912	skotes.exe
2912	skotes.exe
2912	skotes.exe
2912	skotes.exe
1380	02f53e2278.exe
2912	skotes.exe
4728	taskeng.exe
4728	taskeng.exe
2912	skotes.exe
2912	skotes.exe
5636	e3aff30fc4.exe
4728	taskeng.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	758d312349.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	758d312349.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\758d312349.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1019061001\\758d312349.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\3cb57239ec.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1019058001\\3cb57239ec.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\9984bf5154.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1019059001\\9984bf5154.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceb9b1ec8f.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1019060001\\ceb9b1ec8f.exe"	skotes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x000500000001a4c5-93.dat	autoit_exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
3548	tasklist.exe
3588	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs

pid	Process
2620	d4d873be4406e74df951d8ec2781150c426663904bf44e504fafa7d70b0e7099.exe
2912	skotes.exe
1220	3cb57239ec.exe
2364	9984bf5154.exe
1768	758d312349.exe
3732	088882ec9e.exe
4036	bce03ac5c1.exe
5412	ddb580e8ca.exe
5636	e3aff30fc4.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1380 set thread context of 3220	1380	ab866f55be.exe	58
PID 1380 set thread context of 4196	1380	02f53e2278.exe	100
PID 4768 set thread context of 4796	4768	Intel_PTT_EK_Recertification.exe	105
PID 6632 set thread context of 6644	6632	Intel_PTT_EK_Recertification.exe	120

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/12208-2527-0x000000013FA80000-0x000000013FF10000-memory.dmp	upx
behavioral1/memory/12208-2530-0x000000013FA80000-0x000000013FF10000-memory.dmp	upx

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	d4d873be4406e74df951d8ec2781150c426663904bf44e504fafa7d70b0e7099.exe
File opened for modification	C:\Windows\MpForgotten	0977c7d44d.exe
File opened for modification	C:\Windows\TabletAction	0977c7d44d.exe
File opened for modification	C:\Windows\CommunityProduction	0977c7d44d.exe
File opened for modification	C:\Windows\ExtractNicholas	0977c7d44d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 38 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e030ab590b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ddb580e8ca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3cb57239ec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	37bc592bbe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	02f53e2278.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	02f53e2278.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	ceb9b1ec8f.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	ceb9b1ec8f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9984bf5154.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	758d312349.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d4d873be4406e74df951d8ec2781150c426663904bf44e504fafa7d70b0e7099.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ab866f55be.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	088882ec9e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bce03ac5c1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ab866f55be.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0977c7d44d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e3aff30fc4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ceb9b1ec8f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dry.com

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3528	PING.EXE
3572	powershell.exe
4856	powershell.exe
5016	PING.EXE
6692	powershell.exe
6800	PING.EXE

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Dry.com
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Dry.com

Delays execution with timeout.exe 1 IoCs

pid	Process
5320	timeout.exe

Kills process with taskkill 5 IoCs

pid	Process
2312	taskkill.exe
1632	taskkill.exe
880	taskkill.exe
876	taskkill.exe
940	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_Classes\Local Settings	firefox.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	3cb57239ec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	3cb57239ec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	Dry.com
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Dry.com
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	3cb57239ec.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
3528	PING.EXE
5016	PING.EXE
6800	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
12276	schtasks.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

pid	Process
2620	d4d873be4406e74df951d8ec2781150c426663904bf44e504fafa7d70b0e7099.exe
2912	skotes.exe
1220	3cb57239ec.exe
2364	9984bf5154.exe
2012	ceb9b1ec8f.exe
1768	758d312349.exe
2012	ceb9b1ec8f.exe
1768	758d312349.exe
1768	758d312349.exe
3220	ab866f55be.exe
3220	ab866f55be.exe
3220	ab866f55be.exe
3572	powershell.exe
6836	Dry.com
6836	Dry.com
6836	Dry.com
6836	Dry.com
6836	Dry.com
6836	Dry.com
3732	088882ec9e.exe
3732	088882ec9e.exe
3732	088882ec9e.exe
3732	088882ec9e.exe
3732	088882ec9e.exe
3732	088882ec9e.exe
3732	088882ec9e.exe
3732	088882ec9e.exe
3732	088882ec9e.exe
3732	088882ec9e.exe
3732	088882ec9e.exe
4036	bce03ac5c1.exe
4036	bce03ac5c1.exe
4492	e030ab590b.exe
6836	Dry.com
6836	Dry.com
4768	Intel_PTT_EK_Recertification.exe
4856	powershell.exe
4992	powershell.exe
5176	powershell.exe
5412	ddb580e8ca.exe
5412	ddb580e8ca.exe
5412	ddb580e8ca.exe
5412	ddb580e8ca.exe
5412	ddb580e8ca.exe
5412	ddb580e8ca.exe
5412	ddb580e8ca.exe
5412	ddb580e8ca.exe
5412	ddb580e8ca.exe
5412	ddb580e8ca.exe
5412	ddb580e8ca.exe
5636	e3aff30fc4.exe
5636	e3aff30fc4.exe
6632	Intel_PTT_EK_Recertification.exe
6692	powershell.exe

Suspicious use of AdjustPrivilegeToken 51 IoCs

description	pid	Process
Token: SeDebugPrivilege	940	taskkill.exe
Token: SeDebugPrivilege	2312	taskkill.exe
Token: SeDebugPrivilege	1632	taskkill.exe
Token: SeDebugPrivilege	880	taskkill.exe
Token: SeDebugPrivilege	876	taskkill.exe
Token: SeDebugPrivilege	2636	firefox.exe
Token: SeDebugPrivilege	2636	firefox.exe
Token: SeDebugPrivilege	1768	758d312349.exe
Token: SeDebugPrivilege	3220	ab866f55be.exe
Token: SeRestorePrivilege	11868	7z.exe
Token: 35	11868	7z.exe
Token: SeSecurityPrivilege	11868	7z.exe
Token: SeSecurityPrivilege	11868	7z.exe
Token: SeRestorePrivilege	11916	7z.exe
Token: 35	11916	7z.exe
Token: SeSecurityPrivilege	11916	7z.exe
Token: SeSecurityPrivilege	11916	7z.exe
Token: SeRestorePrivilege	11964	7z.exe
Token: 35	11964	7z.exe
Token: SeSecurityPrivilege	11964	7z.exe
Token: SeSecurityPrivilege	11964	7z.exe
Token: SeRestorePrivilege	12004	7z.exe
Token: 35	12004	7z.exe
Token: SeSecurityPrivilege	12004	7z.exe
Token: SeSecurityPrivilege	12004	7z.exe
Token: SeRestorePrivilege	12044	7z.exe
Token: 35	12044	7z.exe
Token: SeSecurityPrivilege	12044	7z.exe
Token: SeSecurityPrivilege	12044	7z.exe
Token: SeRestorePrivilege	12084	7z.exe
Token: 35	12084	7z.exe
Token: SeSecurityPrivilege	12084	7z.exe
Token: SeSecurityPrivilege	12084	7z.exe
Token: SeRestorePrivilege	12124	7z.exe
Token: 35	12124	7z.exe
Token: SeSecurityPrivilege	12124	7z.exe
Token: SeSecurityPrivilege	12124	7z.exe
Token: SeRestorePrivilege	12164	7z.exe
Token: 35	12164	7z.exe
Token: SeSecurityPrivilege	12164	7z.exe
Token: SeSecurityPrivilege	12164	7z.exe
Token: SeDebugPrivilege	3572	powershell.exe
Token: SeDebugPrivilege	3548	tasklist.exe
Token: SeDebugPrivilege	3588	tasklist.exe
Token: SeDebugPrivilege	4492	e030ab590b.exe
Token: SeDebugPrivilege	4856	powershell.exe
Token: SeDebugPrivilege	4992	powershell.exe
Token: SeDebugPrivilege	5176	powershell.exe
Token: SeLockMemoryPrivilege	4796	explorer.exe
Token: SeDebugPrivilege	6692	powershell.exe
Token: SeLockMemoryPrivilege	6644	explorer.exe

Suspicious use of FindShellTrayWindow 19 IoCs

pid	Process
2620	d4d873be4406e74df951d8ec2781150c426663904bf44e504fafa7d70b0e7099.exe
2012	ceb9b1ec8f.exe
2012	ceb9b1ec8f.exe
2012	ceb9b1ec8f.exe
2012	ceb9b1ec8f.exe
2012	ceb9b1ec8f.exe
2012	ceb9b1ec8f.exe
2012	ceb9b1ec8f.exe
2636	firefox.exe
2636	firefox.exe
2636	firefox.exe
2636	firefox.exe
2012	ceb9b1ec8f.exe
2012	ceb9b1ec8f.exe
2012	ceb9b1ec8f.exe
2012	ceb9b1ec8f.exe
6836	Dry.com
6836	Dry.com
6836	Dry.com

Suspicious use of SendNotifyMessage 17 IoCs

pid	Process
2012	ceb9b1ec8f.exe
2012	ceb9b1ec8f.exe
2012	ceb9b1ec8f.exe
2012	ceb9b1ec8f.exe
2012	ceb9b1ec8f.exe
2012	ceb9b1ec8f.exe
2012	ceb9b1ec8f.exe
2636	firefox.exe
2636	firefox.exe
2636	firefox.exe
2012	ceb9b1ec8f.exe
2012	ceb9b1ec8f.exe
2012	ceb9b1ec8f.exe
2012	ceb9b1ec8f.exe
6836	Dry.com
6836	Dry.com
6836	Dry.com

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 2912	2620	d4d873be4406e74df951d8ec2781150c426663904bf44e504fafa7d70b0e7099.exe	30
PID 2620 wrote to memory of 2912	2620	d4d873be4406e74df951d8ec2781150c426663904bf44e504fafa7d70b0e7099.exe	30
PID 2620 wrote to memory of 2912	2620	d4d873be4406e74df951d8ec2781150c426663904bf44e504fafa7d70b0e7099.exe	30
PID 2620 wrote to memory of 2912	2620	d4d873be4406e74df951d8ec2781150c426663904bf44e504fafa7d70b0e7099.exe	30
PID 2912 wrote to memory of 1380	2912	skotes.exe	33
PID 2912 wrote to memory of 1380	2912	skotes.exe	33
PID 2912 wrote to memory of 1380	2912	skotes.exe	33
PID 2912 wrote to memory of 1380	2912	skotes.exe	33
PID 2912 wrote to memory of 1220	2912	skotes.exe	34
PID 2912 wrote to memory of 1220	2912	skotes.exe	34
PID 2912 wrote to memory of 1220	2912	skotes.exe	34
PID 2912 wrote to memory of 1220	2912	skotes.exe	34
PID 2912 wrote to memory of 2364	2912	skotes.exe	35
PID 2912 wrote to memory of 2364	2912	skotes.exe	35
PID 2912 wrote to memory of 2364	2912	skotes.exe	35
PID 2912 wrote to memory of 2364	2912	skotes.exe	35
PID 2912 wrote to memory of 2012	2912	skotes.exe	36
PID 2912 wrote to memory of 2012	2912	skotes.exe	36
PID 2912 wrote to memory of 2012	2912	skotes.exe	36
PID 2912 wrote to memory of 2012	2912	skotes.exe	36
PID 2012 wrote to memory of 940	2012	ceb9b1ec8f.exe	37
PID 2012 wrote to memory of 940	2012	ceb9b1ec8f.exe	37
PID 2012 wrote to memory of 940	2012	ceb9b1ec8f.exe	37
PID 2012 wrote to memory of 940	2012	ceb9b1ec8f.exe	37
PID 2012 wrote to memory of 2312	2012	ceb9b1ec8f.exe	40
PID 2012 wrote to memory of 2312	2012	ceb9b1ec8f.exe	40
PID 2012 wrote to memory of 2312	2012	ceb9b1ec8f.exe	40
PID 2012 wrote to memory of 2312	2012	ceb9b1ec8f.exe	40
PID 2012 wrote to memory of 1632	2012	ceb9b1ec8f.exe	42
PID 2012 wrote to memory of 1632	2012	ceb9b1ec8f.exe	42
PID 2012 wrote to memory of 1632	2012	ceb9b1ec8f.exe	42
PID 2012 wrote to memory of 1632	2012	ceb9b1ec8f.exe	42
PID 2012 wrote to memory of 880	2012	ceb9b1ec8f.exe	44
PID 2012 wrote to memory of 880	2012	ceb9b1ec8f.exe	44
PID 2012 wrote to memory of 880	2012	ceb9b1ec8f.exe	44
PID 2012 wrote to memory of 880	2012	ceb9b1ec8f.exe	44
PID 2012 wrote to memory of 876	2012	ceb9b1ec8f.exe	46
PID 2012 wrote to memory of 876	2012	ceb9b1ec8f.exe	46
PID 2012 wrote to memory of 876	2012	ceb9b1ec8f.exe	46
PID 2012 wrote to memory of 876	2012	ceb9b1ec8f.exe	46
PID 2012 wrote to memory of 1588	2012	ceb9b1ec8f.exe	48
PID 2012 wrote to memory of 1588	2012	ceb9b1ec8f.exe	48
PID 2012 wrote to memory of 1588	2012	ceb9b1ec8f.exe	48
PID 2012 wrote to memory of 1588	2012	ceb9b1ec8f.exe	48
PID 1588 wrote to memory of 2636	1588	firefox.exe	49
PID 1588 wrote to memory of 2636	1588	firefox.exe	49
PID 1588 wrote to memory of 2636	1588	firefox.exe	49
PID 1588 wrote to memory of 2636	1588	firefox.exe	49
PID 1588 wrote to memory of 2636	1588	firefox.exe	49
PID 1588 wrote to memory of 2636	1588	firefox.exe	49
PID 1588 wrote to memory of 2636	1588	firefox.exe	49
PID 1588 wrote to memory of 2636	1588	firefox.exe	49
PID 1588 wrote to memory of 2636	1588	firefox.exe	49
PID 1588 wrote to memory of 2636	1588	firefox.exe	49
PID 1588 wrote to memory of 2636	1588	firefox.exe	49
PID 1588 wrote to memory of 2636	1588	firefox.exe	49
PID 2636 wrote to memory of 2768	2636	firefox.exe	50
PID 2636 wrote to memory of 2768	2636	firefox.exe	50
PID 2636 wrote to memory of 2768	2636	firefox.exe	50
PID 2636 wrote to memory of 2176	2636	firefox.exe	51
PID 2636 wrote to memory of 2176	2636	firefox.exe	51
PID 2636 wrote to memory of 2176	2636	firefox.exe	51
PID 2636 wrote to memory of 2176	2636	firefox.exe	51
PID 2636 wrote to memory of 2176	2636	firefox.exe	51

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 3 IoCs

Hidden Files and Directories

T1564.001

pid	Process
12256	attrib.exe
12248	attrib.exe
12200	attrib.exe

C:\Users\Admin\AppData\Local\Temp\d4d873be4406e74df951d8ec2781150c426663904bf44e504fafa7d70b0e7099.exe
"C:\Users\Admin\AppData\Local\Temp\d4d873be4406e74df951d8ec2781150c426663904bf44e504fafa7d70b0e7099.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
  "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Users\Admin\AppData\Local\Temp\1019054001\ab866f55be.exe
    "C:\Users\Admin\AppData\Local\Temp\1019054001\ab866f55be.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:1380
  - - C:\Users\Admin\AppData\Local\Temp\1019054001\ab866f55be.exe
      "C:\Users\Admin\AppData\Local\Temp\1019054001\ab866f55be.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3220
- - C:\Users\Admin\AppData\Local\Temp\1019058001\3cb57239ec.exe
    "C:\Users\Admin\AppData\Local\Temp\1019058001\3cb57239ec.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    PID:1220
- - C:\Users\Admin\AppData\Local\Temp\1019059001\9984bf5154.exe
    "C:\Users\Admin\AppData\Local\Temp\1019059001\9984bf5154.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2364
- - C:\Users\Admin\AppData\Local\Temp\1019060001\ceb9b1ec8f.exe
    "C:\Users\Admin\AppData\Local\Temp\1019060001\ceb9b1ec8f.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2012
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM firefox.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:940
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM chrome.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2312
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM msedge.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1632
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM opera.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:880
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM brave.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:876
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1588
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2636
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.0.1224405305\189508148" -parentBuildID 20221007134813 -prefsHandle 1256 -prefMapHandle 1096 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5fa18639-ad76-40b3-b257-63722e92162b} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 1360 101d7d58 gpu
        6⤵
        
        PID:2768
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.1.1844455185\588048049" -parentBuildID 20221007134813 -prefsHandle 1564 -prefMapHandle 1560 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {47027136-2515-44cd-ac08-185444fd423b} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 1576 43eeb58 socket
        6⤵
        
        PID:2176
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.2.1870117727\923535387" -childID 1 -isForBrowser -prefsHandle 1936 -prefMapHandle 1952 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 592 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1f63dbc0-01af-48ba-b93c-ce9ac154d5d2} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 1928 19a66658 tab
        6⤵
        
        PID:2960
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.3.880903567\1220484101" -childID 2 -isForBrowser -prefsHandle 2956 -prefMapHandle 2924 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 592 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c1983a50-c6bf-427b-9d15-3273954e1105} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 2968 1b61ff58 tab
        6⤵
        
        PID:888
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.4.1819871815\2100001684" -childID 3 -isForBrowser -prefsHandle 3764 -prefMapHandle 3584 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 592 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e0257113-833c-4b34-af34-c9481a643fc7} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 3756 1db7fd58 tab
        6⤵
        
        PID:1092
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.5.884228820\2087414964" -childID 4 -isForBrowser -prefsHandle 3884 -prefMapHandle 3888 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 592 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {16c0bae5-7ed5-452e-b8e5-d5947e1e9aa0} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 3872 1f0f4858 tab
        6⤵
        
        PID:3068
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2636.6.328583331\943800085" -childID 5 -isForBrowser -prefsHandle 4064 -prefMapHandle 4068 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 592 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0c29613e-369d-4b67-a52d-19dab6394014} 2636 "\\.\pipe\gecko-crash-server-pipe.2636" 4052 1f0f2758 tab
        6⤵
        
        PID:1636
- - C:\Users\Admin\AppData\Local\Temp\1019061001\758d312349.exe
    "C:\Users\Admin\AppData\Local\Temp\1019061001\758d312349.exe"
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Windows security modification
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1768
- - C:\Users\Admin\AppData\Local\Temp\1019062001\37bc592bbe.exe
    "C:\Users\Admin\AppData\Local\Temp\1019062001\37bc592bbe.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:11464
  - - C:\Windows\system32\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
      4⤵
      Loads dropped DLL
      PID:11792
    - - C:\Windows\system32\mode.com
        
        mode 65,10
        5⤵
        
        PID:11824
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e file.zip -p24291711423417250691697322505 -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:11868
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_7.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:11916
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_6.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:11964
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_5.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:12004
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_4.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:12044
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_3.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:12084
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_2.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:12124
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_1.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:12164
    - - C:\Windows\system32\attrib.exe
        
        attrib +H "in.exe"
        5⤵
        Views/modifies file attributes
        
        PID:12200
    - - C:\Users\Admin\AppData\Local\Temp\main\in.exe
        
        "in.exe"
        5⤵
        Executes dropped EXE
        
        PID:12208
      - C:\Windows\system32\attrib.exe
        
        attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
        6⤵
        Views/modifies file attributes
        
        PID:12248
      - C:\Windows\system32\attrib.exe
        
        attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
        6⤵
        Views/modifies file attributes
        
        PID:12256
      - C:\Windows\system32\schtasks.exe
        
        schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:12276
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell ping 127.0.0.1; del in.exe
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3572
        
        C:\Windows\system32\PING.EXE
        
        "C:\Windows\system32\PING.EXE" 127.0.0.1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3528
- - C:\Users\Admin\AppData\Local\Temp\1019063001\0977c7d44d.exe
    "C:\Users\Admin\AppData\Local\Temp\1019063001\0977c7d44d.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:11612
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c move App App.cmd & App.cmd
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:11840
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3548
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "opssvc wrsa"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3556
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3588
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3600
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 245347
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3632
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "profiles" Organizing
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3648
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Judy + ..\Sheets + ..\Another + ..\Wanting b
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3668
    - - C:\Users\Admin\AppData\Local\Temp\245347\Dry.com
        
        Dry.com b
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:6836
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\245347\Dry.com" & rd /s /q "C:\ProgramData\ZCTRQ1VS0ZUA" & exit
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5284
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:5320
    - - C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3688
- - C:\Users\Admin\AppData\Local\Temp\1019064001\088882ec9e.exe
    "C:\Users\Admin\AppData\Local\Temp\1019064001\088882ec9e.exe"
    3⤵
    - Enumerates VirtualBox registry keys
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3732
- - C:\Users\Admin\AppData\Local\Temp\1019065001\1b0d6a38eb.exe
    "C:\Users\Admin\AppData\Local\Temp\1019065001\1b0d6a38eb.exe"
    3⤵
    - Executes dropped EXE
    PID:3896
- - C:\Users\Admin\AppData\Local\Temp\1019066001\bce03ac5c1.exe
    "C:\Users\Admin\AppData\Local\Temp\1019066001\bce03ac5c1.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4036
- - C:\Users\Admin\AppData\Local\Temp\1019067001\02f53e2278.exe
    "C:\Users\Admin\AppData\Local\Temp\1019067001\02f53e2278.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:1380
  - - C:\Users\Admin\AppData\Local\Temp\1019067001\02f53e2278.exe
      "C:\Users\Admin\AppData\Local\Temp\1019067001\02f53e2278.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4196
- - C:\Users\Admin\AppData\Local\Temp\1019068001\e030ab590b.exe
    "C:\Users\Admin\AppData\Local\Temp\1019068001\e030ab590b.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4492
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Add-MpPreference -ExclusionPath "C:\snhnrb"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4992
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5176
- - C:\Users\Admin\AppData\Local\Temp\1019069001\ddb580e8ca.exe
    "C:\Users\Admin\AppData\Local\Temp\1019069001\ddb580e8ca.exe"
    3⤵
    - Enumerates VirtualBox registry keys
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5412
- - C:\Users\Admin\AppData\Local\Temp\1019070001\e3aff30fc4.exe
    "C:\Users\Admin\AppData\Local\Temp\1019070001\e3aff30fc4.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5636

C:\Windows\system32\taskeng.exe
taskeng.exe {BAA6F896-42B5-4525-BCA6-D89CA13DF105} S-1-5-21-2039016743-699959520-214465309-1000:PIDEURYY\Admin:Interactive:[1]
1⤵
- Loads dropped DLL
PID:4728
- C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  PID:4768
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4796
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
    3⤵
    - Drops file in System32 directory
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4856
  - - C:\Windows\system32\PING.EXE
      "C:\Windows\system32\PING.EXE" 127.1.10.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5016
- C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  PID:6632
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6644
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
    3⤵
    - Drops file in System32 directory
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6692
  - - C:\Windows\system32\PING.EXE
      "C:\Windows\system32\PING.EXE" 127.1.10.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:6800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion