rms | 3c2c66b88b34ee69f3d8fe88171b0f4661765b99586c3780ed27ba8098deaa3f

pid	Process
4044	attrib.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0006000000022e1c-146.dat	upx
behavioral2/files/0x0006000000022e1c-147.dat	upx
behavioral2/memory/1492-148-0x0000000000400000-0x0000000000AAA000-memory.dmp	upx
behavioral2/memory/1492-149-0x0000000000400000-0x0000000000AAA000-memory.dmp	upx
behavioral2/files/0x0006000000022e1c-151.dat	upx
behavioral2/memory/4712-152-0x0000000000400000-0x0000000000AAA000-memory.dmp	upx
behavioral2/memory/4712-153-0x0000000000400000-0x0000000000AAA000-memory.dmp	upx
behavioral2/files/0x0006000000022e1c-159.dat	upx
behavioral2/files/0x0006000000022e1c-160.dat	upx
behavioral2/memory/3424-161-0x0000000000400000-0x0000000000AAA000-memory.dmp	upx
behavioral2/memory/1200-162-0x0000000000400000-0x0000000000AAA000-memory.dmp	upx
behavioral2/files/0x0006000000022e1b-169.dat	upx
behavioral2/files/0x0006000000022e1b-172.dat	upx
behavioral2/files/0x0006000000022e1b-173.dat	upx
behavioral2/memory/3424-174-0x0000000000400000-0x0000000000AAA000-memory.dmp	upx
behavioral2/memory/1432-175-0x0000000000400000-0x00000000009BD000-memory.dmp	upx
behavioral2/memory/4384-176-0x0000000000400000-0x00000000009BD000-memory.dmp	upx
behavioral2/files/0x0006000000022e1b-178.dat	upx
behavioral2/memory/1156-179-0x0000000000400000-0x00000000009BD000-memory.dmp	upx
behavioral2/memory/1200-180-0x0000000000400000-0x0000000000AAA000-memory.dmp	upx
behavioral2/memory/1432-181-0x0000000000400000-0x00000000009BD000-memory.dmp	upx
behavioral2/memory/4384-182-0x0000000000400000-0x00000000009BD000-memory.dmp	upx

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	3c2c66b88b34ee69f3d8fe88171b0f4661765b99586c3780ed27ba8098deaa3f.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	drv_install(x86).exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\symbols\exe\xpsrchv.pdb	xpsrchv.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{B1E6668C-7013-4136-ACFB-06120FE1DC72}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{615A80BD-5467-4C10-A0B5-139AAC4AAB8E}.catalogItem	svchost.exe
File opened for modification	C:\Windows\SysWOW64\xpsrchv.pdb	xpsrchv.exe
File opened for modification	C:\Windows\SysWOW64\exe\xpsrchv.pdb	xpsrchv.exe

Drops file in Windows directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ehome\ASCON	3c2c66b88b34ee69f3d8fe88171b0f4661765b99586c3780ed27ba8098deaa3f.exe
File opened for modification	C:\Windows\ehome\ASCON\vp8encoder.dll	3c2c66b88b34ee69f3d8fe88171b0f4661765b99586c3780ed27ba8098deaa3f.exe
File opened for modification	C:\Windows\ehome\ASCON\drv_set.reg	3c2c66b88b34ee69f3d8fe88171b0f4661765b99586c3780ed27ba8098deaa3f.exe
File created	C:\Windows\ehome\ASCON\webmvorbisencoder.dll	3c2c66b88b34ee69f3d8fe88171b0f4661765b99586c3780ed27ba8098deaa3f.exe
File created	C:\Windows\ehome\ASCON\drv_set.reg	3c2c66b88b34ee69f3d8fe88171b0f4661765b99586c3780ed27ba8098deaa3f.exe
File created	C:\Windows\ehome\ASCON\vp8decoder.dll	3c2c66b88b34ee69f3d8fe88171b0f4661765b99586c3780ed27ba8098deaa3f.exe
File opened for modification	C:\Windows\ehome\ASCON	attrib.exe
File opened for modification	C:\Windows\ehome\ASCON\webmvorbisdecoder.dll	3c2c66b88b34ee69f3d8fe88171b0f4661765b99586c3780ed27ba8098deaa3f.exe
File opened for modification	C:\Windows\ehome\ASCON\xpsrchv.pdb	xpsrchv.exe
File created	C:\Windows\ehome\ASCON\SystemInstall.bat	3c2c66b88b34ee69f3d8fe88171b0f4661765b99586c3780ed27ba8098deaa3f.exe
File opened for modification	C:\Windows\ehome\ASCON\webmmux.dll	3c2c66b88b34ee69f3d8fe88171b0f4661765b99586c3780ed27ba8098deaa3f.exe
File opened for modification	C:\Windows\ehome	3c2c66b88b34ee69f3d8fe88171b0f4661765b99586c3780ed27ba8098deaa3f.exe
File created	C:\Windows\ehome\ASCON\Russian.lg	3c2c66b88b34ee69f3d8fe88171b0f4661765b99586c3780ed27ba8098deaa3f.exe
File created	C:\Windows\ehome\ASCON\WUDLicense.exe	3c2c66b88b34ee69f3d8fe88171b0f4661765b99586c3780ed27ba8098deaa3f.exe
File created	C:\Windows\ehome\ASCON\xpsrchv.exe	3c2c66b88b34ee69f3d8fe88171b0f4661765b99586c3780ed27ba8098deaa3f.exe
File created	C:\Windows\ehome\ASCON\drv_install(x86).exe	3c2c66b88b34ee69f3d8fe88171b0f4661765b99586c3780ed27ba8098deaa3f.exe
File opened for modification	C:\Windows\ehome\ASCON\drv_install(x86).exe	3c2c66b88b34ee69f3d8fe88171b0f4661765b99586c3780ed27ba8098deaa3f.exe
File opened for modification	C:\Windows\ehome\ASCON\SystemInstall.bat	3c2c66b88b34ee69f3d8fe88171b0f4661765b99586c3780ed27ba8098deaa3f.exe
File opened for modification	C:\Windows\ehome\ASCON\vp8decoder.dll	3c2c66b88b34ee69f3d8fe88171b0f4661765b99586c3780ed27ba8098deaa3f.exe
File created	C:\Windows\ehome\ASCON\webmvorbisdecoder.dll	3c2c66b88b34ee69f3d8fe88171b0f4661765b99586c3780ed27ba8098deaa3f.exe
File opened for modification	C:\Windows\ehome\ASCON\xpsrchv.exe	3c2c66b88b34ee69f3d8fe88171b0f4661765b99586c3780ed27ba8098deaa3f.exe
File created	C:\Windows\ehome\ASCON\SystemAPI.dat	drv_install(x86).exe
File created	C:\Windows\ehome\ASCON\__tmp_rar_sfx_access_check_240567109	3c2c66b88b34ee69f3d8fe88171b0f4661765b99586c3780ed27ba8098deaa3f.exe
File opened for modification	C:\Windows\ehome\ASCON\Russian.lg	3c2c66b88b34ee69f3d8fe88171b0f4661765b99586c3780ed27ba8098deaa3f.exe
File created	C:\Windows\ehome\ASCON\vp8encoder.dll	3c2c66b88b34ee69f3d8fe88171b0f4661765b99586c3780ed27ba8098deaa3f.exe
File created	C:\Windows\ehome\ASCON\webmmux.dll	3c2c66b88b34ee69f3d8fe88171b0f4661765b99586c3780ed27ba8098deaa3f.exe
File opened for modification	C:\Windows\ehome\ASCON\webmvorbisencoder.dll	3c2c66b88b34ee69f3d8fe88171b0f4661765b99586c3780ed27ba8098deaa3f.exe
File opened for modification	C:\Windows\ehome\ASCON\WUDLicense.exe	3c2c66b88b34ee69f3d8fe88171b0f4661765b99586c3780ed27ba8098deaa3f.exe

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1528	sc.exe
4452	sc.exe
2680	sc.exe
1924	sc.exe
4888	sc.exe
5048	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
4060	taskkill.exe
5084	taskkill.exe
1172	taskkill.exe
4132	taskkill.exe

Runs .reg file with regedit 1 IoCs

pid	Process
1720	regedit.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1492	xpsrchv.exe
1492	xpsrchv.exe
1492	xpsrchv.exe
1492	xpsrchv.exe
1492	xpsrchv.exe
1492	xpsrchv.exe
4712	xpsrchv.exe
4712	xpsrchv.exe
3424	xpsrchv.exe
3424	xpsrchv.exe
1200	xpsrchv.exe
1200	xpsrchv.exe
1200	xpsrchv.exe
1200	xpsrchv.exe
1200	xpsrchv.exe
1200	xpsrchv.exe
4384	WUDLicense.exe
4384	WUDLicense.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

pid	Process
1156	WUDLicense.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	4060	taskkill.exe
Token: SeDebugPrivilege	5084	taskkill.exe
Token: SeDebugPrivilege	1172	taskkill.exe
Token: SeDebugPrivilege	4132	taskkill.exe
Token: SeDebugPrivilege	1492	xpsrchv.exe
Token: SeDebugPrivilege	3424	xpsrchv.exe
Token: SeTakeOwnershipPrivilege	1200	xpsrchv.exe
Token: SeTcbPrivilege	1200	xpsrchv.exe
Token: SeTcbPrivilege	1200	xpsrchv.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1492	xpsrchv.exe
4712	xpsrchv.exe
3424	xpsrchv.exe
1200	xpsrchv.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 548	4784	3c2c66b88b34ee69f3d8fe88171b0f4661765b99586c3780ed27ba8098deaa3f.exe	77
PID 4784 wrote to memory of 548	4784	3c2c66b88b34ee69f3d8fe88171b0f4661765b99586c3780ed27ba8098deaa3f.exe	77
PID 4784 wrote to memory of 548	4784	3c2c66b88b34ee69f3d8fe88171b0f4661765b99586c3780ed27ba8098deaa3f.exe	77
PID 548 wrote to memory of 4508	548	drv_install(x86).exe	79
PID 548 wrote to memory of 4508	548	drv_install(x86).exe	79
PID 548 wrote to memory of 4508	548	drv_install(x86).exe	79
PID 4508 wrote to memory of 4044	4508	cmd.exe	81
PID 4508 wrote to memory of 4044	4508	cmd.exe	81
PID 4508 wrote to memory of 4044	4508	cmd.exe	81
PID 4508 wrote to memory of 5048	4508	cmd.exe	82
PID 4508 wrote to memory of 5048	4508	cmd.exe	82
PID 4508 wrote to memory of 5048	4508	cmd.exe	82
PID 4508 wrote to memory of 1528	4508	cmd.exe	83
PID 4508 wrote to memory of 1528	4508	cmd.exe	83
PID 4508 wrote to memory of 1528	4508	cmd.exe	83
PID 4508 wrote to memory of 4452	4508	cmd.exe	84
PID 4508 wrote to memory of 4452	4508	cmd.exe	84
PID 4508 wrote to memory of 4452	4508	cmd.exe	84
PID 4508 wrote to memory of 2680	4508	cmd.exe	85
PID 4508 wrote to memory of 2680	4508	cmd.exe	85
PID 4508 wrote to memory of 2680	4508	cmd.exe	85
PID 4508 wrote to memory of 4060	4508	cmd.exe	86
PID 4508 wrote to memory of 4060	4508	cmd.exe	86
PID 4508 wrote to memory of 4060	4508	cmd.exe	86
PID 4508 wrote to memory of 5084	4508	cmd.exe	88
PID 4508 wrote to memory of 5084	4508	cmd.exe	88
PID 4508 wrote to memory of 5084	4508	cmd.exe	88
PID 4508 wrote to memory of 1172	4508	cmd.exe	89
PID 4508 wrote to memory of 1172	4508	cmd.exe	89
PID 4508 wrote to memory of 1172	4508	cmd.exe	89
PID 4508 wrote to memory of 4132	4508	cmd.exe	90
PID 4508 wrote to memory of 4132	4508	cmd.exe	90
PID 4508 wrote to memory of 4132	4508	cmd.exe	90
PID 4508 wrote to memory of 4340	4508	cmd.exe	91
PID 4508 wrote to memory of 4340	4508	cmd.exe	91
PID 4508 wrote to memory of 4340	4508	cmd.exe	91
PID 4508 wrote to memory of 1492	4508	cmd.exe	92
PID 4508 wrote to memory of 1492	4508	cmd.exe	92
PID 4508 wrote to memory of 1492	4508	cmd.exe	92
PID 4508 wrote to memory of 4712	4508	cmd.exe	93
PID 4508 wrote to memory of 4712	4508	cmd.exe	93
PID 4508 wrote to memory of 4712	4508	cmd.exe	93
PID 4508 wrote to memory of 1720	4508	cmd.exe	94
PID 4508 wrote to memory of 1720	4508	cmd.exe	94
PID 4508 wrote to memory of 1720	4508	cmd.exe	94
PID 4508 wrote to memory of 1924	4508	cmd.exe	95
PID 4508 wrote to memory of 1924	4508	cmd.exe	95
PID 4508 wrote to memory of 1924	4508	cmd.exe	95
PID 4508 wrote to memory of 4888	4508	cmd.exe	96
PID 4508 wrote to memory of 4888	4508	cmd.exe	96
PID 4508 wrote to memory of 4888	4508	cmd.exe	96
PID 4508 wrote to memory of 3424	4508	cmd.exe	97
PID 4508 wrote to memory of 3424	4508	cmd.exe	97
PID 4508 wrote to memory of 3424	4508	cmd.exe	97
PID 1200 wrote to memory of 1432	1200	xpsrchv.exe	99
PID 1200 wrote to memory of 1432	1200	xpsrchv.exe	99
PID 1200 wrote to memory of 1432	1200	xpsrchv.exe	99
PID 1200 wrote to memory of 4384	1200	xpsrchv.exe	100
PID 1200 wrote to memory of 4384	1200	xpsrchv.exe	100
PID 1200 wrote to memory of 4384	1200	xpsrchv.exe	100
PID 4384 wrote to memory of 1156	4384	WUDLicense.exe	101
PID 4384 wrote to memory of 1156	4384	WUDLicense.exe	101
PID 4384 wrote to memory of 1156	4384	WUDLicense.exe	101

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

pid	Process
4044	attrib.exe

C:\Users\Admin\AppData\Local\Temp\3c2c66b88b34ee69f3d8fe88171b0f4661765b99586c3780ed27ba8098deaa3f.exe
"C:\Users\Admin\AppData\Local\Temp\3c2c66b88b34ee69f3d8fe88171b0f4661765b99586c3780ed27ba8098deaa3f.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Windows\ehome\ASCON\drv_install(x86).exe
  "C:\Windows\ehome\ASCON\drv_install(x86).exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:548
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Windows\ehome\ASCON\SystemInstall.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4508
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h "C:\Windows\ehome\ASCON"
      4⤵
      Sets file to hidden
      Drops file in Windows directory
      Views/modifies file attributes
      PID:4044
  - - C:\Windows\SysWOW64\sc.exe
      sc stop AdobeReader
      4⤵
      Launches sc.exe
      PID:5048
  - - C:\Windows\SysWOW64\sc.exe
      sc stop RManService
      4⤵
      Launches sc.exe
      PID:1528
  - - C:\Windows\SysWOW64\sc.exe
      sc delete AdobeReader
      4⤵
      Launches sc.exe
      PID:4452
  - - C:\Windows\SysWOW64\sc.exe
      sc delete RManService
      4⤵
      Launches sc.exe
      PID:2680
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im rfusclient.exe /f
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4060
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im rutserv.exe /f
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5084
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im WUDLicense.exe /f
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1172
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im xpsrchv.exe /f
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4132
  - - C:\Windows\SysWOW64\reg.exe
      reg delete "HKLM\SYSTEM\Hardware System\DeviceXPS" /f
      4⤵
      PID:4340
  - - C:\Windows\ehome\ASCON\xpsrchv.exe
      "C:\Windows\ehome\ASCON\xpsrchv.exe" /silentinstall
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1492
  - - C:\Windows\ehome\ASCON\xpsrchv.exe
      "C:\Windows\ehome\ASCON\xpsrchv.exe" /firewall
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:4712
  - - C:\Windows\SysWOW64\regedit.exe
      regedit /s "C:\Windows\ehome\ASCON\drv_set.reg"
      4⤵
      Runs .reg file with regedit
      PID:1720
  - - C:\Windows\SysWOW64\sc.exe
      sc failure WUDLicense reset= 0 actions= restart/1000/restart/1000/restart/1000
      4⤵
      Launches sc.exe
      PID:1924
  - - C:\Windows\SysWOW64\sc.exe
      sc config WUDLicense obj= LocalSystem type= interact type= own
      4⤵
      Launches sc.exe
      PID:4888
  - - C:\Windows\ehome\ASCON\xpsrchv.exe
      "C:\Windows\ehome\ASCON\xpsrchv.exe" /start
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:3424

C:\Windows\ehome\ASCON\xpsrchv.exe
C:\Windows\ehome\ASCON\xpsrchv.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\ehome\ASCON\WUDLicense.exe
  C:\Windows\ehome\ASCON\WUDLicense.exe /tray
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\ehome\ASCON\WUDLicense.exe
  C:\Windows\ehome\ASCON\WUDLicense.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4384
- - C:\Windows\ehome\ASCON\WUDLicense.exe
    C:\Windows\ehome\ASCON\WUDLicense.exe /tray
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: SetClipboardViewer
    PID:1156

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:1236

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

System Information Discovery