netwire | 6e8bf76b6d1f39b8366169c0cd6dc4bee0946973b8f5c64baf7fd1bfd1846731

System Information Discovery

Processes:

Confirmation slip.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Confirmation slip.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Confirmation slip.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

Confirmation slip.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	Confirmation slip.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

Confirmation slip.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	Confirmation slip.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	Confirmation slip.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Confirmation slip.exe

description pid process target process

PID 3140 set thread context of 1656 3140 Confirmation slip.exe Confirmation slip.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

348 schtasks.exe

description	pid	process	target process
PID 3140 set thread context of 1656	3140	Confirmation slip.exe	Confirmation slip.exe

pid	process
348	schtasks.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

Confirmation slip.exe

description	pid	process	target process
PID 3140 wrote to memory of 348	3140	Confirmation slip.exe	schtasks.exe
PID 3140 wrote to memory of 348	3140	Confirmation slip.exe	schtasks.exe
PID 3140 wrote to memory of 348	3140	Confirmation slip.exe	schtasks.exe
PID 3140 wrote to memory of 1656	3140	Confirmation slip.exe	Confirmation slip.exe
PID 3140 wrote to memory of 1656	3140	Confirmation slip.exe	Confirmation slip.exe
PID 3140 wrote to memory of 1656	3140	Confirmation slip.exe	Confirmation slip.exe
PID 3140 wrote to memory of 1656	3140	Confirmation slip.exe	Confirmation slip.exe
PID 3140 wrote to memory of 1656	3140	Confirmation slip.exe	Confirmation slip.exe
PID 3140 wrote to memory of 1656	3140	Confirmation slip.exe	Confirmation slip.exe
PID 3140 wrote to memory of 1656	3140	Confirmation slip.exe	Confirmation slip.exe
PID 3140 wrote to memory of 1656	3140	Confirmation slip.exe	Confirmation slip.exe
PID 3140 wrote to memory of 1656	3140	Confirmation slip.exe	Confirmation slip.exe
PID 3140 wrote to memory of 1656	3140	Confirmation slip.exe	Confirmation slip.exe
PID 3140 wrote to memory of 1656	3140	Confirmation slip.exe	Confirmation slip.exe

C:\Users\Admin\AppData\Local\Temp\Confirmation slip.exe
"C:\Users\Admin\AppData\Local\Temp\Confirmation slip.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3140

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FmCkDaZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD3B0.tmp"
2⤵
- Creates scheduled task(s)
PID:348

C:\Users\Admin\AppData\Local\Temp\Confirmation slip.exe
"{path}"
2⤵
PID:1656

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Query Registry

5

Virtualization/Sandbox Evasion

2

T1497

System Information Discovery

4

Peripheral Device Discovery