3971b5349b6882bab47604dbfb646b80ac4172d478990ef29349537084291bc5

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Virus.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Virus.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Virus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Virus.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	ALERH2BYH.Malware.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	Virus.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	Hacked By NahSmi.exe

Executes dropped EXE 3 IoCs

pid	Process
1584	Hacked By NahSmi.exe
3268	Virus.exe
3696	Virus REvi DRX1.exe

Loads dropped DLL 1 IoCs

pid	Process
3268	Virus.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	Virus.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	Virus.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3564	4876	WerFault.exe	100

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Virus REvi DRX1.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\*\OpenWithList\WordPad.exe	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\.dng	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.bmp\ShellNew	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.dav	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.m1v\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mak	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\PropertySheetHandlers\CryptoSignMenu	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.contact	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.kci	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ogx\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.rpc	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\.3g2\OpenWithProgids	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\.bay\OpenWithProgids	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.imesx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mef\ShellEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ods\ShellEx	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\.3fr	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.application	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.bkf\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.epub	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpc	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ppam\ShellEx\PropertyHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.accdt\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.cda\PersistentHandler	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\.mos\OpenWithProgids	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\ShellEx\{8895b1c6-b41f-4c1c-a562-0d564250836f}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\.R3D	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.rle\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ani	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\.flac	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.fnd\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pch	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdfxml\OpenWithList	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.aif\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.hhc	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\.jpg\OpenWithProgids	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mmf\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpga	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pfx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ppsx\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ppt\ShellEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.dct	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.fff\ShellEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ghi\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.jpe\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mrw\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.msepub	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.odctablefile	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.dng\ShellEx	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\.html\OpenWithProgids	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ini\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.lex	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ncb\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.potx\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ppam\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\.arw	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.diagpkg	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.glox	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pxn	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.rat	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.iiq\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.cc	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.cod\PersistentHandler	reg.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3696	Virus REvi DRX1.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4164 wrote to memory of 1584	4164	ALERH2BYH.Malware.exe	87
PID 4164 wrote to memory of 3268	4164	ALERH2BYH.Malware.exe	88
PID 3268 wrote to memory of 3696	3268	Virus.exe	91
PID 1584 wrote to memory of 1944	1584	Hacked By NahSmi.exe	93
PID 1944 wrote to memory of 4112	1944	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\ALERH2BYH.Malware.exe
"C:\Users\Admin\AppData\Local\Temp\ALERH2BYH.Malware.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4164
- C:\Users\Admin\AppData\Roaming\Hacked By NahSmi.exe
  "C:\Users\Admin\AppData\Roaming\Hacked By NahSmi.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1584
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /k reg delete HKCR /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1944
  - - C:\Windows\system32\reg.exe
      reg delete HKCR /f
      4⤵
      Modifies registry class
      PID:4112
- C:\Users\Admin\AppData\Roaming\Virus.exe
  "C:\Users\Admin\AppData\Roaming\Virus.exe"
  2⤵
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Checks BIOS information in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Maps connected drives based on registry
  - Suspicious use of WriteProcessMemory
  PID:3268
- - C:\Users\Admin\AppData\Local\Temp\Virus REvi DRX1.exe
    "C:\Users\Admin\AppData\Local\Temp\Virus REvi DRX1.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3696
  - - C:\Users\Admin\AppData\Local\Temp\Virus REvi DRX1.exe
      "C:\Users\Admin\AppData\Local\Temp\Virus REvi DRX1.exe"
      4⤵
      PID:4876
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 1296
        5⤵
        Program crash
        
        PID:3564

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3d4 0x418
1⤵
PID:2072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4876 -ip 4876
1⤵
PID:3024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion