donutloader | af05c0b7aefa3554b15792bab2ed7460b011d62ae64841541ebc24a33dd103d6

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	Notice from Tax Department.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	Notice from Tax Department.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	Notice from Tax Department.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	Notice from Tax Department.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	Notice from Tax Department.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Notice from Tax Department.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Notice from Tax Department.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	Notice from Tax Department.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	Notice from Tax Department.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	Notice from Tax Department.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Notice from Tax Department.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	Notice from Tax Department.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	Notice from Tax Department.exe

Modifies Windows Defender notification settings 3 TTPs 4 IoCs

defense_evasion trojan

Windows Service

Modify Registry

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Notice from Tax Department.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	Notice from Tax Department.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications	Notice from Tax Department.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	Notice from Tax Department.exe

Windows security bypass 2 TTPs 1 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	Notice from Tax Department.exe

Enumerates VirtualBox registry keys 2 TTPs 12 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	Notice from Tax Department.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	Notice from Tax Department.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	Notice from Tax Department.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	Notice from Tax Department.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	Notice from Tax Department.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	Notice from Tax Department.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	Notice from Tax Department.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	Notice from Tax Department.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	Notice from Tax Department.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	Notice from Tax Department.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	Notice from Tax Department.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	Notice from Tax Department.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 4 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Notice from Tax Department.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Notice from Tax Department.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Notice from Tax Department.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Notice from Tax Department.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2552	powershell.exe
6044	powershell.exe
2552	powershell.exe
6044	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 4 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Notice from Tax Department.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Notice from Tax Department.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Notice from Tax Department.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Notice from Tax Department.exe

Executes dropped EXE 3 IoCs

pid	Process
4872	Notice from Tax Department.exe
1688	MsProfileSvc.exe
5880	Notice from Tax Department.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wine	Notice from Tax Department.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wine	Notice from Tax Department.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wine	Notice from Tax Department.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wine	Notice from Tax Department.exe

Loads dropped DLL 5 IoCs

pid	Process
4740	Notice from Tax Department.exe
4872	Notice from Tax Department.exe
5880	Notice from Tax Department.exe
4872	Notice from Tax Department.exe
5880	Notice from Tax Department.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 1 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

File/Path Exclusions

T1564.012

Disable or Modify Tools

pid	Process
3116	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\NetTokenBroker = "C:\\ProgramData\\Microsoft\\NetTokenBroker\\Notice from Tax Department.exe "	Notice from Tax Department.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

Ignore Process Interrupts

T1564.011

pid	Process
1932	cmd.exe
3116	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4392	Notice from Tax Department.exe
4392	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe
4740	Notice from Tax Department.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4740	Notice from Tax Department.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2552	powershell.exe
Token: SeIncreaseQuotaPrivilege	2552	powershell.exe
Token: SeSecurityPrivilege	2552	powershell.exe
Token: SeTakeOwnershipPrivilege	2552	powershell.exe
Token: SeLoadDriverPrivilege	2552	powershell.exe
Token: SeSystemProfilePrivilege	2552	powershell.exe
Token: SeSystemtimePrivilege	2552	powershell.exe
Token: SeProfSingleProcessPrivilege	2552	powershell.exe
Token: SeIncBasePriorityPrivilege	2552	powershell.exe
Token: SeCreatePagefilePrivilege	2552	powershell.exe
Token: SeBackupPrivilege	2552	powershell.exe
Token: SeRestorePrivilege	2552	powershell.exe
Token: SeShutdownPrivilege	2552	powershell.exe
Token: SeDebugPrivilege	2552	powershell.exe
Token: SeSystemEnvironmentPrivilege	2552	powershell.exe
Token: SeRemoteShutdownPrivilege	2552	powershell.exe
Token: SeUndockPrivilege	2552	powershell.exe
Token: SeManageVolumePrivilege	2552	powershell.exe
Token: 33	2552	powershell.exe
Token: 34	2552	powershell.exe
Token: 35	2552	powershell.exe
Token: 36	2552	powershell.exe
Token: SeIncreaseQuotaPrivilege	2552	powershell.exe
Token: SeSecurityPrivilege	2552	powershell.exe
Token: SeTakeOwnershipPrivilege	2552	powershell.exe
Token: SeLoadDriverPrivilege	2552	powershell.exe
Token: SeSystemProfilePrivilege	2552	powershell.exe
Token: SeSystemtimePrivilege	2552	powershell.exe
Token: SeProfSingleProcessPrivilege	2552	powershell.exe
Token: SeIncBasePriorityPrivilege	2552	powershell.exe
Token: SeCreatePagefilePrivilege	2552	powershell.exe
Token: SeBackupPrivilege	2552	powershell.exe
Token: SeRestorePrivilege	2552	powershell.exe
Token: SeShutdownPrivilege	2552	powershell.exe
Token: SeDebugPrivilege	2552	powershell.exe
Token: SeSystemEnvironmentPrivilege	2552	powershell.exe
Token: SeRemoteShutdownPrivilege	2552	powershell.exe
Token: SeUndockPrivilege	2552	powershell.exe
Token: SeManageVolumePrivilege	2552	powershell.exe
Token: 33	2552	powershell.exe
Token: 34	2552	powershell.exe
Token: 35	2552	powershell.exe
Token: 36	2552	powershell.exe
Token: SeDebugPrivilege	6044	powershell.exe
Token: SeIncreaseQuotaPrivilege	6044	powershell.exe
Token: SeSecurityPrivilege	6044	powershell.exe
Token: SeTakeOwnershipPrivilege	6044	powershell.exe
Token: SeLoadDriverPrivilege	6044	powershell.exe
Token: SeSystemProfilePrivilege	6044	powershell.exe
Token: SeSystemtimePrivilege	6044	powershell.exe
Token: SeProfSingleProcessPrivilege	6044	powershell.exe
Token: SeIncBasePriorityPrivilege	6044	powershell.exe
Token: SeCreatePagefilePrivilege	6044	powershell.exe
Token: SeBackupPrivilege	6044	powershell.exe
Token: SeRestorePrivilege	6044	powershell.exe
Token: SeShutdownPrivilege	6044	powershell.exe
Token: SeDebugPrivilege	6044	powershell.exe
Token: SeSystemEnvironmentPrivilege	6044	powershell.exe
Token: SeRemoteShutdownPrivilege	6044	powershell.exe
Token: SeUndockPrivilege	6044	powershell.exe
Token: SeManageVolumePrivilege	6044	powershell.exe
Token: 33	6044	powershell.exe
Token: 34	6044	powershell.exe
Token: 35	6044	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 4392	4740	Notice from Tax Department.exe	96
PID 4740 wrote to memory of 1932	4740	Notice from Tax Department.exe	99
PID 1932 wrote to memory of 2552	1932	cmd.exe	101
PID 1688 wrote to memory of 5880	1688	MsProfileSvc.exe	106
PID 4740 wrote to memory of 3116	4740	Notice from Tax Department.exe	108
PID 3116 wrote to memory of 6044	3116	cmd.exe	110

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\Notice from Tax Department.zip"
1⤵
PID:3008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5592

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3444

\??\D:\Notice from Tax Department.exe
"D:\Notice from Tax Department.exe"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Modifies Windows Defender notification settings
- Windows security bypass
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4740
- \??\D:\Notice from Tax Department.exe
  "D:\Notice from Tax Department.exe"
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Enumerates VirtualBox registry keys
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Identifies Wine through registry keys
  - Suspicious behavior: EnumeratesProcesses
  PID:4392
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell.exe -ep bypass -w hidden -c "Add-MpPreference -ExclusionProcess 'Bginfo64.exe' -ErrorAction SilentlyContinue;Add-MpPreference -ExclusionProcess '%%SVC_NAME%%.exe' -ErrorAction SilentlyContinue" >nul 2>&1
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ep bypass -w hidden -c "Add-MpPreference -ExclusionProcess 'Bginfo64.exe' -ErrorAction SilentlyContinue;Add-MpPreference -ExclusionProcess '%%SVC_NAME%%.exe' -ErrorAction SilentlyContinue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2552
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell.exe -ep bypass -w hidden -c "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\NetTokenBroker' -ErrorAction SilentlyContinue" >nul 2>&1
  2⤵
  - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious use of WriteProcessMemory
  PID:3116
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ep bypass -w hidden -c "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\NetTokenBroker' -ErrorAction SilentlyContinue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:6044

C:\ProgramData\Microsoft\NetTokenBroker\Notice from Tax Department.exe
"C:\ProgramData\Microsoft\NetTokenBroker\Notice from Tax Department.exe"
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
PID:4872

C:\ProgramData\Microsoft\NetTokenBroker\MsProfileSvc.exe
C:\ProgramData\Microsoft\NetTokenBroker\MsProfileSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688
- C:\ProgramData\Microsoft\NetTokenBroker\Notice from Tax Department.exe
  C:\ProgramData\Microsoft\NetTokenBroker\Notice from Tax Department.exe
  2⤵
  - Enumerates VirtualBox registry keys
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  PID:5880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

Virtualization/Sandbox Evasion