1785a83cac260a165351dc1580cbb67a926411f0fe3688730350464cf04b73a4

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\sembako-dezjkkg.exe\""	1785a83cac260a165351dc1580cbb67a926411f0fe3688730350464cf04b73a4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\sembako-dezjkkg.exe\""	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\sembako-dezjkkg.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\sembako-dezjkkg.exe\""	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\sembako-dezjkkg.exe\""	lsass.exe

Modifies visibility of file extensions in Explorer 2 TTPs 5 IoCs

Hidden Files and Directories

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	1785a83cac260a165351dc1580cbb67a926411f0fe3688730350464cf04b73a4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	services.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	lsass.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 5 IoCs

Hidden Files and Directories

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	1785a83cac260a165351dc1580cbb67a926411f0fe3688730350464cf04b73a4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	services.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	lsass.exe

Disables RegEdit via registry modification 10 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "0"	1785a83cac260a165351dc1580cbb67a926411f0fe3688730350464cf04b73a4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	1785a83cac260a165351dc1580cbb67a926411f0fe3688730350464cf04b73a4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "0"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "0"	services.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	services.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "0"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "0"	lsass.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	lsass.exe

Disables cmd.exe use via registry modification 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "0"	1785a83cac260a165351dc1580cbb67a926411f0fe3688730350464cf04b73a4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "0"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "0"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "0"	services.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "0"	lsass.exe

Executes dropped EXE 4 IoCs

pid	Process
2416	smss.exe
212	winlogon.exe
4384	services.exe
3644	lsass.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Empty.pif	smss.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Empty.pif	smss.exe

Adds Run key to start application 2 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Bron-Spizaetus-degkknry = "\"C:\\Windows\\ShellNew\\bbm-yrnkkged.exe\""	services.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tok-Cirrhatus	services.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tok-Cirrhatus	1785a83cac260a165351dc1580cbb67a926411f0fe3688730350464cf04b73a4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tok-Cirrhatus	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Bron-Spizaetus	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Bron-Spizaetus-degkknry = "\"C:\\Windows\\ShellNew\\bbm-yrnkkged.exe\""	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tok-Cirrhatus-1464 = "\"C:\\Users\\Admin\\AppData\\Local\\br3951on.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Bron-Spizaetus	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Bron-Spizaetus	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Bron-Spizaetus-degkknry = "\"C:\\Windows\\ShellNew\\bbm-yrnkkged.exe\""	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tok-Cirrhatus	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Bron-Spizaetus	1785a83cac260a165351dc1580cbb67a926411f0fe3688730350464cf04b73a4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Bron-Spizaetus-degkknry = "\"C:\\Windows\\ShellNew\\bbm-yrnkkged.exe\""	1785a83cac260a165351dc1580cbb67a926411f0fe3688730350464cf04b73a4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Bron-Spizaetus	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tok-Cirrhatus-1464 = "\"C:\\Users\\Admin\\AppData\\Local\\br3951on.exe\""	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tok-Cirrhatus-1464 = "\"C:\\Users\\Admin\\AppData\\Local\\br3951on.exe\""	services.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tok-Cirrhatus-1464 = "\"C:\\Users\\Admin\\AppData\\Local\\br3951on.exe\""	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tok-Cirrhatus	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tok-Cirrhatus-1464 = "\"C:\\Users\\Admin\\AppData\\Local\\br3951on.exe\""	1785a83cac260a165351dc1580cbb67a926411f0fe3688730350464cf04b73a4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Bron-Spizaetus-degkknry = "\"C:\\Windows\\ShellNew\\bbm-yrnkkged.exe\""	smss.exe

Drops file in System32 directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	winlogon.exe
File created	C:\Windows\SysWOW64\Admin's Setting.scr	smss.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	services.exe
File opened for modification	C:\Windows\SysWOW64\sistem.sys	1785a83cac260a165351dc1580cbb67a926411f0fe3688730350464cf04b73a4.exe
File opened for modification	C:\Windows\SysWOW64\cmd-bro-kkx.exe	1785a83cac260a165351dc1580cbb67a926411f0fe3688730350464cf04b73a4.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	1785a83cac260a165351dc1580cbb67a926411f0fe3688730350464cf04b73a4.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\SysWOW64\cmd-bro-kkx.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\DXBLBM.exe	smss.exe
File created	C:\Windows\SysWOW64\cmd-bro-kkx.exe	1785a83cac260a165351dc1580cbb67a926411f0fe3688730350464cf04b73a4.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	lsass.exe
File created	C:\Windows\SysWOW64\DXBLBM.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\cmd-bro-kkx.exe	services.exe
File opened for modification	C:\Windows\SysWOW64\cmd-bro-kkx.exe	lsass.exe
File created	C:\Windows\SysWOW64\sistem.sys	1785a83cac260a165351dc1580cbb67a926411f0fe3688730350464cf04b73a4.exe
File opened for modification	C:\Windows\SysWOW64\cmd-bro-kkx.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\Admin's Setting.scr	smss.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\sembako-dezjkkg.exe	smss.exe
File opened for modification	C:\Windows\ShellNew\bbm-yrnkkged.exe	winlogon.exe
File opened for modification	C:\Windows\ShellNew\bbm-yrnkkged.exe	services.exe
File opened for modification	C:\Windows\ShellNew\bbm-yrnkkged.exe	1785a83cac260a165351dc1580cbb67a926411f0fe3688730350464cf04b73a4.exe
File created	C:\Windows\sembako-dezjkkg.exe	1785a83cac260a165351dc1580cbb67a926411f0fe3688730350464cf04b73a4.exe
File opened for modification	C:\Windows\sembako-dezjkkg.exe	1785a83cac260a165351dc1580cbb67a926411f0fe3688730350464cf04b73a4.exe
File opened for modification	C:\Windows\sembako-dezjkkg.exe	services.exe
File opened for modification	C:\Windows\ShellNew\bbm-yrnkkged.exe	lsass.exe
File opened for modification	C:\Windows\sembako-dezjkkg.exe	lsass.exe
File created	C:\Windows\ShellNew\bbm-yrnkkged.exe	1785a83cac260a165351dc1580cbb67a926411f0fe3688730350464cf04b73a4.exe
File opened for modification	C:\Windows\ShellNew\bbm-yrnkkged.exe	smss.exe
File opened for modification	C:\Windows\sembako-dezjkkg.exe	winlogon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	explorer.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4196	1785a83cac260a165351dc1580cbb67a926411f0fe3688730350464cf04b73a4.exe
2416	smss.exe
212	winlogon.exe
4384	services.exe
3644	lsass.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 4480	4196	1785a83cac260a165351dc1580cbb67a926411f0fe3688730350464cf04b73a4.exe	83
PID 4196 wrote to memory of 4480	4196	1785a83cac260a165351dc1580cbb67a926411f0fe3688730350464cf04b73a4.exe	83
PID 4196 wrote to memory of 4480	4196	1785a83cac260a165351dc1580cbb67a926411f0fe3688730350464cf04b73a4.exe	83
PID 4196 wrote to memory of 2416	4196	1785a83cac260a165351dc1580cbb67a926411f0fe3688730350464cf04b73a4.exe	84
PID 4196 wrote to memory of 2416	4196	1785a83cac260a165351dc1580cbb67a926411f0fe3688730350464cf04b73a4.exe	84
PID 4196 wrote to memory of 2416	4196	1785a83cac260a165351dc1580cbb67a926411f0fe3688730350464cf04b73a4.exe	84
PID 2416 wrote to memory of 212	2416	smss.exe	85
PID 2416 wrote to memory of 212	2416	smss.exe	85
PID 2416 wrote to memory of 212	2416	smss.exe	85
PID 2416 wrote to memory of 3708	2416	smss.exe	86
PID 2416 wrote to memory of 3708	2416	smss.exe	86
PID 2416 wrote to memory of 3708	2416	smss.exe	86
PID 2416 wrote to memory of 3556	2416	smss.exe	87
PID 2416 wrote to memory of 3556	2416	smss.exe	87
PID 2416 wrote to memory of 3556	2416	smss.exe	87
PID 2416 wrote to memory of 4060	2416	smss.exe	90
PID 2416 wrote to memory of 4060	2416	smss.exe	90
PID 2416 wrote to memory of 4060	2416	smss.exe	90
PID 2416 wrote to memory of 4384	2416	smss.exe	92
PID 2416 wrote to memory of 4384	2416	smss.exe	92
PID 2416 wrote to memory of 4384	2416	smss.exe	92
PID 2416 wrote to memory of 3644	2416	smss.exe	94
PID 2416 wrote to memory of 3644	2416	smss.exe	94
PID 2416 wrote to memory of 3644	2416	smss.exe	94

C:\Users\Admin\AppData\Local\Temp\1785a83cac260a165351dc1580cbb67a926411f0fe3688730350464cf04b73a4.exe
"C:\Users\Admin\AppData\Local\Temp\1785a83cac260a165351dc1580cbb67a926411f0fe3688730350464cf04b73a4.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  - Modifies registry class
  PID:4480
- C:\Users\Admin\AppData\Local\smss.exe
  C:\Users\Admin\AppData\Local\smss.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Drops startup file
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Users\Admin\AppData\Local\winlogon.exe
    C:\Users\Admin\AppData\Local\winlogon.exe
    3⤵
    - Modifies WinLogon for persistence
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - Disables RegEdit via registry modification
    - Disables cmd.exe use via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:212
- - C:\Windows\SysWOW64\at.exe
    at /delete /y
    3⤵
    PID:3708
- - C:\Windows\SysWOW64\at.exe
    at 17:08 /every:M,T,W,Th,F,S,Su "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\6084-NendangBro.com"
    3⤵
    PID:3556
- - C:\Windows\SysWOW64\at.exe
    at 11:03 /every:M,T,W,Th,F,S,Su "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\6084-NendangBro.com"
    3⤵
    PID:4060
- - C:\Users\Admin\AppData\Local\services.exe
    C:\Users\Admin\AppData\Local\services.exe
    3⤵
    - Modifies WinLogon for persistence
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - Disables RegEdit via registry modification
    - Disables cmd.exe use via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:4384
- - C:\Users\Admin\AppData\Local\lsass.exe
    C:\Users\Admin\AppData\Local\lsass.exe
    3⤵
    - Modifies WinLogon for persistence
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - Disables RegEdit via registry modification
    - Disables cmd.exe use via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:3644

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry