229ab5c6f62bc63d566a57c60a0500e62fa05215c5b39a00bf2972db1052106c

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	42AE90BB.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	wttv.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	qbclient.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	qbclient.exe

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\UISrv\Parameters\ServiceDll = "C:\\ProgramData\\qbcore.dll"	qbclient.exe

Checks BIOS information in registry 2 TTPs 14 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	qbclient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	conhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wttv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	qbclient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	conhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	conhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	conhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	42AE90BB.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	42AE90BB.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	wttv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	qbclient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	qbclient.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation	42AE90BB.exe

Executes dropped EXE 3 IoCs

pid	Process
4668	wttv.exe
1844	qbclient.exe
464	qbclient.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Software\Wine	42AE90BB.exe
Key opened	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Software\Wine	wttv.exe
Key opened	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Software\Wine	qbclient.exe
Key opened	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Software\Wine	qbclient.exe

Loads dropped DLL 7 IoCs

pid	Process
1844	qbclient.exe
4588	svchost.exe
464	qbclient.exe
564	conhost.exe
1160	conhost.exe
564	conhost.exe
1160	conhost.exe

Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
3608	cmd.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	ip-api.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\xgl.log	conhost.exe
File opened for modification	C:\Windows\System32\xgl.log	conhost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3888	42AE90BB.exe
4668	wttv.exe

UPX packed file 46 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3888-16-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3888-36-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3888-56-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3888-57-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3888-60-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3888-52-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3888-50-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3888-48-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3888-46-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3888-44-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3888-42-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3888-40-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3888-38-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3888-34-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3888-32-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3888-30-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3888-28-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3888-26-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3888-24-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3888-22-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3888-20-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3888-18-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3888-17-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3888-62-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/4668-112-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/4668-108-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/4668-106-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/4668-104-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/4668-102-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/4668-100-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/4668-96-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/4668-94-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/4668-93-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/4668-90-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/4668-88-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/4668-86-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/4668-84-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/4668-82-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/4668-80-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/4668-78-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/4668-77-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/4668-74-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/4668-71-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/4668-72-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/4668-110-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/4668-98-0x0000000010000000-0x000000001003E000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	42AE90BB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wttv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qbclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qbclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
1712	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3888	42AE90BB.exe
3888	42AE90BB.exe
3888	42AE90BB.exe
3888	42AE90BB.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	3888	42AE90BB.exe
Token: SeDebugPrivilege	4668	wttv.exe
Token: SeIncBasePriorityPrivilege	3888	42AE90BB.exe
Token: SeDebugPrivilege	1844	qbclient.exe
Token: SeDebugPrivilege	1844	qbclient.exe
Token: SeDebugPrivilege	4588	svchost.exe
Token: SeDebugPrivilege	464	qbclient.exe
Token: SeLockMemoryPrivilege	564	conhost.exe
Token: SeLockMemoryPrivilege	564	conhost.exe
Token: SeLockMemoryPrivilege	1160	conhost.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
3888	42AE90BB.exe
3888	42AE90BB.exe
3888	42AE90BB.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
4668	wttv.exe
1160	conhost.exe
564	conhost.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3888 wrote to memory of 4668	3888	42AE90BB.exe	83
PID 3888 wrote to memory of 5000	3888	42AE90BB.exe	84
PID 4668 wrote to memory of 1844	4668	wttv.exe	87
PID 1844 wrote to memory of 3608	1844	qbclient.exe	89
PID 1844 wrote to memory of 204	1844	qbclient.exe	91
PID 204 wrote to memory of 1712	204	cmd.exe	93
PID 3608 wrote to memory of 4820	3608	cmd.exe	94
PID 4668 wrote to memory of 2344	4668	wttv.exe	101
PID 1844 wrote to memory of 564	1844	qbclient.exe	109
PID 4588 wrote to memory of 1160	4588	svchost.exe	110
PID 564 wrote to memory of 2052	564	conhost.exe	111
PID 1160 wrote to memory of 4936	1160	conhost.exe	112
PID 1844 wrote to memory of 564	1844	qbclient.exe	109
PID 1844 wrote to memory of 564	1844	qbclient.exe	109
PID 4588 wrote to memory of 1160	4588	svchost.exe	110
PID 4588 wrote to memory of 1160	4588	svchost.exe	110

C:\Users\Admin\AppData\Local\Temp\42AE90BB.exe
"C:\Users\Admin\AppData\Local\Temp\42AE90BB.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3888
- C:\Users\Admin\AppData\Local\Temp\wttv.exe
  C:\Users\Admin\AppData\Local\Temp\wttv.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4668
- - C:\ProgramData\qbclient.exe
    "C:\ProgramData\qbclient.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Server Software Component: Terminal Services DLL
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1844
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c schtasks /delete /tn UpdateInfo /F
      4⤵
      Indicator Removal: Clear Persistence
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3608
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn UpdateInfo /F
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4820
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c schtasks /create /sc MINUTE /tn UpdateInfo /tr "C:\ProgramData\qbclient.exe" /mo 30 /RU "NT Authority\System"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:204
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc MINUTE /tn UpdateInfo /tr "C:\ProgramData\qbclient.exe" /mo 30 /RU "NT Authority\System"
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1712
  - - C:\Windows\system32\conhost.exe
      "C:\Windows\Sysnative\conhost.exe"
      4⤵
      Checks BIOS information in registry
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:564
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe
        5⤵
        
        PID:2052
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\365.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2344
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\42AE90BB.exe > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5000

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k UISrvicesGroup -s UISrv
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Windows\system32\conhost.exe
  "C:\Windows\Sysnative\conhost.exe"
  2⤵
  - Checks BIOS information in registry
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4936

C:\ProgramData\qbclient.exe
C:\ProgramData\qbclient.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:464

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UISrvicesGroup
1⤵
PID:3268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

File Deletion

T1070.004

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion