ghostsocks | 772a6c1dbea546cdce82a19f7c6cb878a35b9a0c81e32e29dd0b16fa83403a1c

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,,C:\\Users\\Public\\Documents\\DisplayUpdater\\NetworkHandler\\node_ipsec.exe"	node_ipsec.exe

Enumerates VirtualBox DLL files 2 TTPs 10 IoCs

File and Directory Discovery

Virtualization/Sandbox Evasion

description	ioc	Process
File opened (read-only)	C:\Windows\System32\vboxdisp.dll	viconnect.exe
File opened (read-only)	C:\Windows\System32\vboxhook.dll	viconnect.exe
File opened (read-only)	C:\Windows\System32\vboxogl.dll	viconnect.exe
File opened (read-only)	C:\Windows\System32\vboxoglerrorspu.dll	viconnect.exe
File opened (read-only)	C:\Windows\System32\vboxmrxnp.dll	viconnect.exe
File opened (read-only)	C:\Windows\System32\vboxoglarrayspu.dll	viconnect.exe
File opened (read-only)	C:\Windows\System32\vboxoglcrutil.dll	viconnect.exe
File opened (read-only)	C:\Windows\System32\vboxoglfeedbackspu.dll	viconnect.exe
File opened (read-only)	C:\Windows\System32\vboxoglpackspu.dll	viconnect.exe
File opened (read-only)	C:\Windows\System32\vboxoglpassthroughspu.dll	viconnect.exe

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService	serveless.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	viconnect.exe

Looks for VirtualBox drivers on disk 2 TTPs 4 IoCs

File and Directory Discovery

Virtualization/Sandbox Evasion

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\VBoxMouse.sys	serveless.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxGuest.sys	serveless.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxSF.sys	serveless.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxVideo.sys	serveless.exe

Looks for VirtualBox executables on disk 2 TTPs 3 IoCs

File and Directory Discovery

Virtualization/Sandbox Evasion

description	ioc	Process
File opened (read-only)	C:\Windows\System32\vboxservice.exe	viconnect.exe
File opened (read-only)	C:\Windows\System32\vboxtray.exe	viconnect.exe
File opened (read-only)	C:\Windows\System32\VBoxControl.exe	viconnect.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	viconnect.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	serveless.exe

Looks for VMWare drivers on disk 2 TTPs 2 IoCs

File and Directory Discovery

Virtualization/Sandbox Evasion

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	serveless.exe
File opened (read-only)	C:\Windows\System32\drivers\vmhgfs.sys	serveless.exe

Looks for VMWare services registry key. 1 TTPs 1 IoCs

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	serveless.exe

Modifies Windows Firewall 2 TTPs 6 IoCs

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2724	netsh.exe
2236	netsh.exe
3780	netsh.exe
536	netsh.exe
3632	netsh.exe
2348	netsh.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Fable-5-x64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	viconnect.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	audioconfig.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ProfileMgr.lnk	vsghssl.exe

Executes dropped EXE 16 IoCs

pid	Process
4576	node_ipsec.exe
5044	viconnect.exe
4968	serveless.exe
1160	cloude_edge.exe
1188	vsghssl.exe
3340	audioconfig.exe
4132	cloude_edge.exe
1288	serveless.exe
3144	genodeb.exe
4548	geminsync.exe
1268	GraphicsHost.exe
2420	GeminiService.exe
4204	vsghssl.exe
5368	service_host.exe
5376	service_host.exe
2052	node_ipsec.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DisplayComponent = "C:\\Users\\Public\\Videos\\SystemAdapter\\GraphicsSupport\\serveless.exe"	serveless.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AudioHelper = "C:\\Users\\Public\\Pictures\\SystemService\\MicrosoftHelper\\cloude_edge.exe"	cloude_edge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemUpdate = "C:\\ProgramData\\nodes\\geminsync.exe"	serveless.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SyncCoordinator = "C:\\Users\\Admin\\AppData\\Local\\AppCache\\service_host.exe"	reg.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
6	pastebin.com
7	pastebin.com
69	pastebin.com
79	pastebin.com
82	pastebin.com
84	pastebin.com
5	pastebin.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	checkip.amazonaws.com

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

persistence privilege_escalation

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	Fable-5-x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	serveless.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5044	viconnect.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4244	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 18 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service_host.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service_host.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsghssl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsghssl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Checks processor information in registry 2 TTPs 23 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	audioconfig.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	audioconfig.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	audioconfig.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	audioconfig.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Fable-5-x64.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	viconnect.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	audioconfig.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	audioconfig.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	audioconfig.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	audioconfig.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	audioconfig.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	audioconfig.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Fable-5-x64.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	audioconfig.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	audioconfig.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	audioconfig.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	audioconfig.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	audioconfig.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	viconnect.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	audioconfig.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	audioconfig.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	audioconfig.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	audioconfig.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSerialNumber	Fable-5-x64.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	serveless.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	serveless.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	serveless.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Fable-5-x64.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

T1059

pid	Process
1556	ipconfig.exe
3256	ipconfig.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

pid	Process
1988	reg.exe
4872	reg.exe
5236	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
5904	schtasks.exe
4552	schtasks.exe
4264	schtasks.exe
4880	schtasks.exe
5240	schtasks.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
1116	Fable-5-x64.exe
1116	Fable-5-x64.exe
1116	Fable-5-x64.exe
1116	Fable-5-x64.exe
5044	viconnect.exe
5044	viconnect.exe
5044	viconnect.exe
5044	viconnect.exe
5044	viconnect.exe
5044	viconnect.exe
5044	viconnect.exe
5044	viconnect.exe
5044	viconnect.exe
5044	viconnect.exe
3340	audioconfig.exe
3340	audioconfig.exe
4968	serveless.exe
4968	serveless.exe
5044	viconnect.exe
4968	serveless.exe
4968	serveless.exe
4244	powershell.exe
4244	powershell.exe
4244	powershell.exe
3340	audioconfig.exe
3340	audioconfig.exe
4576	node_ipsec.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5044	viconnect.exe
Token: SeDebugPrivilege	4244	powershell.exe
Token: SeDebugPrivilege	4576	node_ipsec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1116	Fable-5-x64.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1116	Fable-5-x64.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 1556	1116	Fable-5-x64.exe	90
PID 1116 wrote to memory of 1076	1116	Fable-5-x64.exe	92
PID 1116 wrote to memory of 4576	1116	Fable-5-x64.exe	96
PID 1116 wrote to memory of 5044	1116	Fable-5-x64.exe	97
PID 1116 wrote to memory of 4968	1116	Fable-5-x64.exe	99
PID 1116 wrote to memory of 1160	1116	Fable-5-x64.exe	100
PID 4576 wrote to memory of 2724	4576	node_ipsec.exe	98
PID 1116 wrote to memory of 1188	1116	Fable-5-x64.exe	102
PID 1116 wrote to memory of 3340	1116	Fable-5-x64.exe	104
PID 4576 wrote to memory of 2236	4576	node_ipsec.exe	105
PID 4576 wrote to memory of 3780	4576	node_ipsec.exe	107
PID 4576 wrote to memory of 536	4576	node_ipsec.exe	110
PID 4576 wrote to memory of 3632	4576	node_ipsec.exe	112
PID 4576 wrote to memory of 2348	4576	node_ipsec.exe	114
PID 3340 wrote to memory of 4784	3340	audioconfig.exe	117
PID 4968 wrote to memory of 3256	4968	serveless.exe	122
PID 4968 wrote to memory of 1484	4968	serveless.exe	125
PID 4968 wrote to memory of 3028	4968	serveless.exe	128
PID 4968 wrote to memory of 4552	4968	serveless.exe	132
PID 4968 wrote to memory of 2848	4968	serveless.exe	135
PID 4968 wrote to memory of 4264	4968	serveless.exe	140
PID 4968 wrote to memory of 4244	4968	serveless.exe	144
PID 4968 wrote to memory of 4648	4968	serveless.exe	148
PID 4968 wrote to memory of 4880	4968	serveless.exe	150
PID 1188 wrote to memory of 1988	1188	vsghssl.exe	161
PID 1188 wrote to memory of 4872	1188	vsghssl.exe	168
PID 1188 wrote to memory of 1504	1188	vsghssl.exe	170
PID 1188 wrote to memory of 5240	1188	vsghssl.exe	172
PID 4576 wrote to memory of 5904	4576	node_ipsec.exe	178
PID 4576 wrote to memory of 5236	4576	node_ipsec.exe	180

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Fable-5-x64.exe
"C:\Users\Admin\AppData\Local\Temp\Fable-5-x64.exe"
1⤵
- Checks BIOS information in registry
- Checks system information in the registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Windows\system32\ipconfig.exe
  "ipconfig"
  2⤵
  - Gathers network information
  PID:1556
- C:\Windows\system32\getmac.exe
  "getmac" /FO CSV /NH
  2⤵
  PID:1076
- C:\Users\Public\Documents\DisplayUpdater\NetworkHandler\node_ipsec.exe
  "C:\Users\Public\Documents\DisplayUpdater\NetworkHandler\node_ipsec.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\Windows\system32\netsh.exe
    "netsh" advfirewall firewall add rule name=Telemetry_In_57001 dir=in action=allow protocol=TCP localport=57001
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2724
- - C:\Windows\system32\netsh.exe
    "netsh" advfirewall firewall add rule name=Telemetry_Out_57001 dir=out action=allow protocol=TCP localport=57001
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2236
- - C:\Windows\system32\netsh.exe
    "netsh" advfirewall firewall add rule name=Telemetry_In_57002 dir=in action=allow protocol=TCP localport=57002
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3780
- - C:\Windows\system32\netsh.exe
    "netsh" advfirewall firewall add rule name=Telemetry_Out_57002 dir=out action=allow protocol=TCP localport=57002
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:536
- - C:\Windows\system32\netsh.exe
    "netsh" advfirewall firewall add rule name=Telemetry_In_56001 dir=in action=allow protocol=TCP localport=56001
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3632
- - C:\Windows\system32\netsh.exe
    "netsh" advfirewall firewall add rule name=Telemetry_Out_56001 dir=out action=allow protocol=TCP localport=56001
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2348
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Create /F /SC ONLOGON /TN DataPruneJob /TR C:\Users\Public\Documents\DisplayUpdater\NetworkHandler\node_ipsec.exe /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5904
- - C:\Windows\system32\reg.exe
    "reg.exe" ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Run /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:5236
- C:\Users\Public\Videos\NetworkHost\GraphicsAdapter\viconnect.exe
  "C:\Users\Public\Videos\NetworkHost\GraphicsAdapter\viconnect.exe"
  2⤵
  - Enumerates VirtualBox DLL files
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VirtualBox executables on disk
  - Looks for VMWare Tools registry key
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5044
- C:\Users\Public\Videos\SystemAdapter\GraphicsSupport\serveless.exe
  "C:\Users\Public\Videos\SystemAdapter\GraphicsSupport\serveless.exe"
  2⤵
  - Enumerates VirtualBox registry keys
  - Looks for VirtualBox drivers on disk
  - Looks for VMWare Tools registry key
  - Looks for VMWare drivers on disk
  - Looks for VMWare services registry key.
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks system information in the registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4968
- - C:\Windows\system32\ipconfig.exe
    "ipconfig"
    3⤵
    - Gathers network information
    PID:3256
- - C:\Windows\system32\getmac.exe
    "getmac" /FO CSV /NH
    3⤵
    PID:1484
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Query /TN AdobeCloudSync
    3⤵
    PID:3028
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Create /TN AdobeCloudSync /TR C:\ProgramData\gemini\genodeb.exe /F /RL HIGHEST /RU SYSTEM /SC ONSTART
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4552
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Query /TN ChromeUpdateSvc
    3⤵
    PID:2848
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Create /TN ChromeUpdateSvc /TR C:\ProgramData\nodes\GeminiService.exe /F /RL HIGHEST /RU SYSTEM /SC ONSTART /DELAY 0001:00
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4264
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -NoProfile -Command "$WshShell = New-Object -comObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\OneSync.lnk'); $Shortcut.TargetPath = 'C:\Users\Public\OneSync.exe'; $Shortcut.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4244
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Query /TN DiagnosticsCloudHost
    3⤵
    PID:4648
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Create /TN DiagnosticsCloudHost /TR C:\ProgramData\Graphics\GraphicsHost.exe /F /RL HIGHEST /RU SYSTEM /SC DAILY
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4880
- C:\Users\Public\Pictures\SystemService\MicrosoftHelper\cloude_edge.exe
  "C:\Users\Public\Pictures\SystemService\MicrosoftHelper\cloude_edge.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:1160
- C:\Users\Public\Documents\USBProcess\MicrosoftAgent\vsghssl.exe
  "C:\Users\Public\Documents\USBProcess\MicrosoftAgent\vsghssl.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1188
- - C:\Windows\SysWOW64\reg.exe
    "reg.exe" ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1988
- - C:\Windows\SysWOW64\reg.exe
    "reg.exe" ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SyncCoordinator /t REG_SZ /d C:\Users\Admin\AppData\Local\AppCache\service_host.exe /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4872
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /Query /TN WorkspaceMaintenance
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1504
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /Create /F /SC DAILY /ST 10:10 /TN WorkspaceMaintenance /TR C:\Users\Admin\AppData\Roaming\SessionData\service_host.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5240
- C:\Users\Public\Videos\USBDriver\ServiceProcess\audioconfig.exe
  "C:\Users\Public\Videos\USBDriver\ServiceProcess\audioconfig.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3340
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless
    3⤵
    PID:4784

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3348

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3784

C:\Users\Public\Pictures\SystemService\MicrosoftHelper\cloude_edge.exe
C:\Users\Public\Pictures\SystemService\MicrosoftHelper\cloude_edge.exe
1⤵
- Executes dropped EXE
PID:4132

C:\Users\Public\Videos\SystemAdapter\GraphicsSupport\serveless.exe
C:\Users\Public\Videos\SystemAdapter\GraphicsSupport\serveless.exe
1⤵
- Executes dropped EXE
PID:1288

C:\ProgramData\gemini\genodeb.exe
C:\ProgramData\gemini\genodeb.exe
1⤵
- Executes dropped EXE
PID:3144

C:\ProgramData\nodes\geminsync.exe
C:\ProgramData\nodes\geminsync.exe
1⤵
- Executes dropped EXE
PID:4548

C:\ProgramData\Graphics\GraphicsHost.exe
C:\ProgramData\Graphics\GraphicsHost.exe
1⤵
- Executes dropped EXE
PID:1268

C:\ProgramData\nodes\GeminiService.exe
C:\ProgramData\nodes\GeminiService.exe
1⤵
- Executes dropped EXE
PID:2420

C:\Users\Public\Documents\USBPRO~1\MICROS~1\vsghssl.exe
C:\Users\Public\Documents\USBPRO~1\MICROS~1\vsghssl.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4204

C:\Users\Admin\AppData\Roaming\SessionData\service_host.exe
C:\Users\Admin\AppData\Roaming\SessionData\service_host.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5368

C:\Users\Admin\AppData\Local\AppCache\service_host.exe
C:\Users\Admin\AppData\Local\AppCache\service_host.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5376

C:\Users\Public\Documents\DisplayUpdater\NetworkHandler\node_ipsec.exe
C:\Users\Public\Documents\DisplayUpdater\NetworkHandler\node_ipsec.exe
1⤵
- Executes dropped EXE
PID:2052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

File and Directory Discovery

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion