discordrat | d92cabc30a30e7b12445728d0400df31ea218dae71a850885b7eeabe53824938

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	11.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	11.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

defense_evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools	11.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools	11.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	11.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	11.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\11.lnk	11.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\11.lnk	11.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\11.lnk	11.exe

Executes dropped EXE 1 IoCs

pid	Process
4552	11.exe

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	11.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	11.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 2 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S	11.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S	11.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation	11.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer	11.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName	11.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation	11.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer	11.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName	11.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4236	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1284	wmic.exe
1284	wmic.exe
1284	wmic.exe
1284	wmic.exe
2520	11.exe
2520	11.exe
4456	wmic.exe
4456	wmic.exe
4456	wmic.exe
4456	wmic.exe
4552	11.exe
4552	11.exe
4552	11.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5808	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1284	wmic.exe
Token: SeSecurityPrivilege	1284	wmic.exe
Token: SeTakeOwnershipPrivilege	1284	wmic.exe
Token: SeLoadDriverPrivilege	1284	wmic.exe
Token: SeSystemProfilePrivilege	1284	wmic.exe
Token: SeSystemtimePrivilege	1284	wmic.exe
Token: SeProfSingleProcessPrivilege	1284	wmic.exe
Token: SeIncBasePriorityPrivilege	1284	wmic.exe
Token: SeCreatePagefilePrivilege	1284	wmic.exe
Token: SeBackupPrivilege	1284	wmic.exe
Token: SeRestorePrivilege	1284	wmic.exe
Token: SeShutdownPrivilege	1284	wmic.exe
Token: SeDebugPrivilege	1284	wmic.exe
Token: SeSystemEnvironmentPrivilege	1284	wmic.exe
Token: SeRemoteShutdownPrivilege	1284	wmic.exe
Token: SeUndockPrivilege	1284	wmic.exe
Token: SeManageVolumePrivilege	1284	wmic.exe
Token: 33	1284	wmic.exe
Token: 34	1284	wmic.exe
Token: 35	1284	wmic.exe
Token: 36	1284	wmic.exe
Token: SeIncreaseQuotaPrivilege	1284	wmic.exe
Token: SeSecurityPrivilege	1284	wmic.exe
Token: SeTakeOwnershipPrivilege	1284	wmic.exe
Token: SeLoadDriverPrivilege	1284	wmic.exe
Token: SeSystemProfilePrivilege	1284	wmic.exe
Token: SeSystemtimePrivilege	1284	wmic.exe
Token: SeProfSingleProcessPrivilege	1284	wmic.exe
Token: SeIncBasePriorityPrivilege	1284	wmic.exe
Token: SeCreatePagefilePrivilege	1284	wmic.exe
Token: SeBackupPrivilege	1284	wmic.exe
Token: SeRestorePrivilege	1284	wmic.exe
Token: SeShutdownPrivilege	1284	wmic.exe
Token: SeDebugPrivilege	1284	wmic.exe
Token: SeSystemEnvironmentPrivilege	1284	wmic.exe
Token: SeRemoteShutdownPrivilege	1284	wmic.exe
Token: SeUndockPrivilege	1284	wmic.exe
Token: SeManageVolumePrivilege	1284	wmic.exe
Token: 33	1284	wmic.exe
Token: 34	1284	wmic.exe
Token: 35	1284	wmic.exe
Token: 36	1284	wmic.exe
Token: SeDebugPrivilege	2520	11.exe
Token: SeDebugPrivilege	5808	explorer.exe
Token: SeShutdownPrivilege	5808	explorer.exe
Token: SeCreatePagefilePrivilege	5808	explorer.exe
Token: SeShutdownPrivilege	5808	explorer.exe
Token: SeCreatePagefilePrivilege	5808	explorer.exe
Token: SeIncreaseQuotaPrivilege	4456	wmic.exe
Token: SeSecurityPrivilege	4456	wmic.exe
Token: SeTakeOwnershipPrivilege	4456	wmic.exe
Token: SeLoadDriverPrivilege	4456	wmic.exe
Token: SeSystemProfilePrivilege	4456	wmic.exe
Token: SeSystemtimePrivilege	4456	wmic.exe
Token: SeProfSingleProcessPrivilege	4456	wmic.exe
Token: SeIncBasePriorityPrivilege	4456	wmic.exe
Token: SeCreatePagefilePrivilege	4456	wmic.exe
Token: SeBackupPrivilege	4456	wmic.exe
Token: SeRestorePrivilege	4456	wmic.exe
Token: SeShutdownPrivilege	4456	wmic.exe
Token: SeDebugPrivilege	4456	wmic.exe
Token: SeSystemEnvironmentPrivilege	4456	wmic.exe
Token: SeRemoteShutdownPrivilege	4456	wmic.exe
Token: SeUndockPrivilege	4456	wmic.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 1284	2520	11.exe	89
PID 2520 wrote to memory of 3444	2520	11.exe	92
PID 2520 wrote to memory of 4236	2520	11.exe	94
PID 2520 wrote to memory of 5808	2520	11.exe	81
PID 5808 wrote to memory of 5332	5808	explorer.exe
PID 4552 wrote to memory of 4456	4552	11.exe	98
PID 4552 wrote to memory of 1688	4552	11.exe	100
PID 4552 wrote to memory of 5808	4552	11.exe	81

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5808
- C:\Users\Admin\AppData\Local\Temp\11.exe
  "C:\Users\Admin\AppData\Local\Temp\11.exe"
  2⤵
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Checks BIOS information in registry
  - Drops startup file
  - Maps connected drives based on registry
  - Checks SCSI registry key(s)
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1284
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /Query /TN "11"
    3⤵
    PID:3444
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /f /tn "11" /tr "C:\Users\Public\11.exe" /sc onlogon /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4236

C:\Users\Public\11.exe
C:\Users\Public\11.exe
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Drops startup file
- Executes dropped EXE
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4456
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /Query /TN "11"
  2⤵
  PID:1688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion