saintbot | 91f0ea31d908f46e89dcc0257c517c876194f9688fd9a2d5b2f9e82074ce0f94

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	91f0ea31d908f46e89dcc0257c517c876194f9688fd9a2d5b2f9e82074ce0f94.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	91f0ea31d908f46e89dcc0257c517c876194f9688fd9a2d5b2f9e82074ce0f94.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	13309.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\13309.exe	91f0ea31d908f46e89dcc0257c517c876194f9688fd9a2d5b2f9e82074ce0f94.exe

Loads dropped DLL 2 IoCs

pid	Process
1864	13309.exe
1800	dfrgui.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\exp = "C:\\Users\\Admin\\AppData\\Local\\zzAdmin\\Admin.vbs"	dfrgui.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 6 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	91f0ea31d908f46e89dcc0257c517c876194f9688fd9a2d5b2f9e82074ce0f94.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\start /b "" cmd /c del "%~f0"&exit /b	91f0ea31d908f46e89dcc0257c517c876194f9688fd9a2d5b2f9e82074ce0f94.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	13309.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\start /b "" cmd /c del "%~f0"&exit /b	13309.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	dfrgui.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\start /b "" cmd /c del "%~f0"&exit /b	dfrgui.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\dfrgui.exe	dfrgui.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3312 set thread context of 3512	3312	91f0ea31d908f46e89dcc0257c517c876194f9688fd9a2d5b2f9e82074ce0f94.exe	91
PID 3172 set thread context of 1864	3172	13309.exe	102

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3644	1048	WerFault.exe	92
4544	2140	WerFault.exe	104

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dfrgui.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	dfrgui.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
1828	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings	91f0ea31d908f46e89dcc0257c517c876194f9688fd9a2d5b2f9e82074ce0f94.exe
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings	13309.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1968	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3312	91f0ea31d908f46e89dcc0257c517c876194f9688fd9a2d5b2f9e82074ce0f94.exe
3312	91f0ea31d908f46e89dcc0257c517c876194f9688fd9a2d5b2f9e82074ce0f94.exe
3172	13309.exe
3172	13309.exe
1864	13309.exe
1864	13309.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3312	91f0ea31d908f46e89dcc0257c517c876194f9688fd9a2d5b2f9e82074ce0f94.exe
Token: SeDebugPrivilege	1048	Wmwzygtmuexmtrashhold.exe
Token: SeDebugPrivilege	3172	13309.exe
Token: SeDebugPrivilege	2140	Wmwzygtmuexmtrashhold.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 1924	3312	91f0ea31d908f46e89dcc0257c517c876194f9688fd9a2d5b2f9e82074ce0f94.exe	90
PID 3312 wrote to memory of 1924	3312	91f0ea31d908f46e89dcc0257c517c876194f9688fd9a2d5b2f9e82074ce0f94.exe	90
PID 3312 wrote to memory of 1924	3312	91f0ea31d908f46e89dcc0257c517c876194f9688fd9a2d5b2f9e82074ce0f94.exe	90
PID 3312 wrote to memory of 3512	3312	91f0ea31d908f46e89dcc0257c517c876194f9688fd9a2d5b2f9e82074ce0f94.exe	91
PID 3312 wrote to memory of 3512	3312	91f0ea31d908f46e89dcc0257c517c876194f9688fd9a2d5b2f9e82074ce0f94.exe	91
PID 3312 wrote to memory of 3512	3312	91f0ea31d908f46e89dcc0257c517c876194f9688fd9a2d5b2f9e82074ce0f94.exe	91
PID 3312 wrote to memory of 3512	3312	91f0ea31d908f46e89dcc0257c517c876194f9688fd9a2d5b2f9e82074ce0f94.exe	91
PID 3312 wrote to memory of 3512	3312	91f0ea31d908f46e89dcc0257c517c876194f9688fd9a2d5b2f9e82074ce0f94.exe	91
PID 3312 wrote to memory of 3512	3312	91f0ea31d908f46e89dcc0257c517c876194f9688fd9a2d5b2f9e82074ce0f94.exe	91
PID 3312 wrote to memory of 3512	3312	91f0ea31d908f46e89dcc0257c517c876194f9688fd9a2d5b2f9e82074ce0f94.exe	91
PID 3312 wrote to memory of 3512	3312	91f0ea31d908f46e89dcc0257c517c876194f9688fd9a2d5b2f9e82074ce0f94.exe	91
PID 3312 wrote to memory of 3512	3312	91f0ea31d908f46e89dcc0257c517c876194f9688fd9a2d5b2f9e82074ce0f94.exe	91
PID 3312 wrote to memory of 3512	3312	91f0ea31d908f46e89dcc0257c517c876194f9688fd9a2d5b2f9e82074ce0f94.exe	91
PID 1924 wrote to memory of 1048	1924	WScript.exe	92
PID 1924 wrote to memory of 1048	1924	WScript.exe	92
PID 3512 wrote to memory of 3172	3512	91f0ea31d908f46e89dcc0257c517c876194f9688fd9a2d5b2f9e82074ce0f94.exe	93
PID 3512 wrote to memory of 3172	3512	91f0ea31d908f46e89dcc0257c517c876194f9688fd9a2d5b2f9e82074ce0f94.exe	93
PID 3512 wrote to memory of 3172	3512	91f0ea31d908f46e89dcc0257c517c876194f9688fd9a2d5b2f9e82074ce0f94.exe	93
PID 3512 wrote to memory of 3564	3512	91f0ea31d908f46e89dcc0257c517c876194f9688fd9a2d5b2f9e82074ce0f94.exe	94
PID 3512 wrote to memory of 3564	3512	91f0ea31d908f46e89dcc0257c517c876194f9688fd9a2d5b2f9e82074ce0f94.exe	94
PID 3512 wrote to memory of 3564	3512	91f0ea31d908f46e89dcc0257c517c876194f9688fd9a2d5b2f9e82074ce0f94.exe	94
PID 3564 wrote to memory of 1968	3564	cmd.exe	96
PID 3564 wrote to memory of 1968	3564	cmd.exe	96
PID 3564 wrote to memory of 1968	3564	cmd.exe	96
PID 3564 wrote to memory of 4284	3564	cmd.exe	97
PID 3564 wrote to memory of 4284	3564	cmd.exe	97
PID 3564 wrote to memory of 4284	3564	cmd.exe	97
PID 3172 wrote to memory of 2596	3172	13309.exe	101
PID 3172 wrote to memory of 2596	3172	13309.exe	101
PID 3172 wrote to memory of 2596	3172	13309.exe	101
PID 3172 wrote to memory of 1864	3172	13309.exe	102
PID 3172 wrote to memory of 1864	3172	13309.exe	102
PID 3172 wrote to memory of 1864	3172	13309.exe	102
PID 3172 wrote to memory of 1864	3172	13309.exe	102
PID 3172 wrote to memory of 1864	3172	13309.exe	102
PID 3172 wrote to memory of 1864	3172	13309.exe	102
PID 3172 wrote to memory of 1864	3172	13309.exe	102
PID 3172 wrote to memory of 1864	3172	13309.exe	102
PID 3172 wrote to memory of 1864	3172	13309.exe	102
PID 3172 wrote to memory of 1864	3172	13309.exe	102
PID 1864 wrote to memory of 1800	1864	13309.exe	103
PID 1864 wrote to memory of 1800	1864	13309.exe	103
PID 1864 wrote to memory of 1800	1864	13309.exe	103
PID 2596 wrote to memory of 2140	2596	WScript.exe	104
PID 2596 wrote to memory of 2140	2596	WScript.exe	104
PID 1864 wrote to memory of 1800	1864	13309.exe	103
PID 1800 wrote to memory of 1828	1800	dfrgui.exe	105
PID 1800 wrote to memory of 1828	1800	dfrgui.exe	105
PID 1800 wrote to memory of 1828	1800	dfrgui.exe	105

C:\Users\Admin\AppData\Local\Temp\91f0ea31d908f46e89dcc0257c517c876194f9688fd9a2d5b2f9e82074ce0f94.exe
"C:\Users\Admin\AppData\Local\Temp\91f0ea31d908f46e89dcc0257c517c876194f9688fd9a2d5b2f9e82074ce0f94.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Lgfmyvtomp.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Users\Admin\AppData\Local\Temp\Wmwzygtmuexmtrashhold.exe
    "C:\Users\Admin\AppData\Local\Temp\Wmwzygtmuexmtrashhold.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1048
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 1048 -s 1484
      4⤵
      Program crash
      PID:3644
- C:\Users\Admin\AppData\Local\Temp\91f0ea31d908f46e89dcc0257c517c876194f9688fd9a2d5b2f9e82074ce0f94.exe
  C:\Users\Admin\AppData\Local\Temp\91f0ea31d908f46e89dcc0257c517c876194f9688fd9a2d5b2f9e82074ce0f94.exe
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Maps connected drives based on registry
  - Suspicious use of WriteProcessMemory
  PID:3512
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\13309.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\13309.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious use of SetThreadContext
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3172
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Lgfmyvtomp.vbs"
      4⤵
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:2596
    - - C:\Users\Admin\AppData\Local\Temp\Wmwzygtmuexmtrashhold.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wmwzygtmuexmtrashhold.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2140
      - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2140 -s 1460
        6⤵
        Program crash
        
        PID:4544
  - - C:\Users\Admin\AppData\Local\Temp\13309.exe
      C:\Users\Admin\AppData\Local\Temp\13309.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Maps connected drives based on registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1864
    - - C:\Windows\SysWOW64\dfrgui.exe
        
        "C:\Windows\system32\dfrgui.exe"
        5⤵
        Loads dropped DLL
        Adds Run key to start application
        Maps connected drives based on registry
        Drops file in System32 directory
        Checks processor information in registry
        Suspicious use of WriteProcessMemory
        
        PID:1800
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 5 /tn "Update" /tr "%SYSTEMDRIVE%\Users\%USERNAME%\AppData\Local\zz%USERNAME%\%USERNAME%.vbs" /F
        6⤵
        Creates scheduled task(s)
        
        PID:1828
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\del.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3564
  - - C:\Windows\SysWOW64\PING.EXE
      ping localhost -n 3
      4⤵
      Runs ping.exe
      PID:1968
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c del "C:\Users\Admin\AppData\Roaming\del.bat"
      4⤵
      PID:4284

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 184 -p 1048 -ip 1048
1⤵
PID:4452

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 180 -p 2140 -ip 2140
1⤵
PID:3956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery