92a65702c5459eb17d64e89027aed58452d5c2af82b4263416d8d1d0c9707bc7

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	SecretTweak.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	SecretTweak.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	SecretTweak.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	SecretTweak.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	SecretTweak.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	SecretTweak.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SecretTweak.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SecretTweak.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
2644	SecretTweak.exe
6004	SecretTweak.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1100	cmd.exe
4968	cmd.exe
4136	cmd.exe
2588	cmd.exe
5604	cmd.exe
2400	cmd.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{284C550B-FCF0-4E62-8C9D-1E27D94AE0A1}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{A28581B8-AC7A-4764-A3E5-CC5C444E4DBD}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
5692	schtasks.exe
4252	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2644	SecretTweak.exe
2644	SecretTweak.exe
6004	SecretTweak.exe
6004	SecretTweak.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	2644	SecretTweak.exe
Token: 33	2644	SecretTweak.exe
Token: SeIncBasePriorityPrivilege	2644	SecretTweak.exe
Token: SeDebugPrivilege	6004	SecretTweak.exe
Token: 33	6004	SecretTweak.exe
Token: SeIncBasePriorityPrivilege	6004	SecretTweak.exe
Token: SeShutdownPrivilege	4796	explorer.exe
Token: SeCreatePagefilePrivilege	4796	explorer.exe
Token: SeShutdownPrivilege	4796	explorer.exe
Token: SeCreatePagefilePrivilege	4796	explorer.exe
Token: SeShutdownPrivilege	4796	explorer.exe
Token: SeCreatePagefilePrivilege	4796	explorer.exe
Token: SeShutdownPrivilege	4796	explorer.exe
Token: SeCreatePagefilePrivilege	4796	explorer.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
2644	SecretTweak.exe
2644	SecretTweak.exe
2644	SecretTweak.exe
6004	SecretTweak.exe
6004	SecretTweak.exe
6004	SecretTweak.exe
2100	sihost.exe
4796	explorer.exe
4796	explorer.exe
4796	explorer.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2644	SecretTweak.exe
6004	SecretTweak.exe
4796	explorer.exe
4796	explorer.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 1100	2644	SecretTweak.exe	88
PID 1100 wrote to memory of 4920	1100	cmd.exe	90
PID 2644 wrote to memory of 4968	2644	SecretTweak.exe	91
PID 4968 wrote to memory of 5692	4968	cmd.exe	93
PID 2644 wrote to memory of 4136	2644	SecretTweak.exe	96
PID 4136 wrote to memory of 2412	4136	cmd.exe	100
PID 6004 wrote to memory of 2588	6004	SecretTweak.exe	103
PID 2588 wrote to memory of 1296	2588	cmd.exe	105
PID 6004 wrote to memory of 5604	6004	SecretTweak.exe	106
PID 5604 wrote to memory of 4252	5604	cmd.exe	108
PID 6004 wrote to memory of 2400	6004	SecretTweak.exe	111
PID 2400 wrote to memory of 1600	2400	cmd.exe	113
PID 2100 wrote to memory of 4796	2100	sihost.exe	126

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\SecretTweak\SecretTweak.exe
"C:\Users\Admin\AppData\Local\Temp\SecretTweak\SecretTweak.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c w32tm /resync /force >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Windows\system32\w32tm.exe
    w32tm /resync /force
    3⤵
    PID:4920
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C schtasks /create /xml "C:\Users\Admin\AppData\Local\Temp\SecretTweak_AutoStart.xml" /tn "SecretTweak" /f 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4968
- - C:\Windows\system32\schtasks.exe
    schtasks /create /xml "C:\Users\Admin\AppData\Local\Temp\SecretTweak_AutoStart.xml" /tn "SecretTweak" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5692
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C schtasks /query /tn "SecretTweak" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4136
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn "SecretTweak"
    3⤵
    PID:2412

C:\Users\Admin\AppData\Local\Temp\SecretTweak\SecretTweak.exe
C:\Users\Admin\AppData\Local\Temp\SecretTweak\SecretTweak.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6004
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c w32tm /resync /force >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Windows\system32\w32tm.exe
    w32tm /resync /force
    3⤵
    PID:1296
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C schtasks /create /xml "C:\Users\Admin\AppData\Local\Temp\SecretTweak_AutoStart.xml" /tn "SecretTweak" /f 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5604
- - C:\Windows\system32\schtasks.exe
    schtasks /create /xml "C:\Users\Admin\AppData\Local\Temp\SecretTweak_AutoStart.xml" /tn "SecretTweak" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4252
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C schtasks /query /tn "SecretTweak" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn "SecretTweak"
    3⤵
    PID:1600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3164

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4796

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:4052

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Debugger Evasion

T1622

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Debugger Evasion

T1622

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery