e6e64a5a7dd78c9af2b5c537b926132ef040787c606277191b93e1b0db28254b

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Program Files (x86)\WindowsUpdate\System32.exe = "C:\\Program Files (x86)\\WindowsUpdate\\System32.exe:*:Enabled:Windows Update"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe

Executes dropped EXE 1 IoCs

pid	Process
4848	System32.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	e6e64a5a7dd78c9af2b5c537b926132ef040787c606277191b93e1b0db28254b.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Program Files (x86)\\WindowsUpdate\\System32.exe\" /update /key 833067941"	reg.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\WindowsUpdate\System32.exe	e6e64a5a7dd78c9af2b5c537b926132ef040787c606277191b93e1b0db28254b.exe
File created	C:\Program Files (x86)\WindowsUpdate\111.txt	cmd.exe
File opened for modification	C:\Program Files (x86)\3\1\Àïåë_Óõâàëà_ÁÌ_Áàíê.docx	WINWORD.EXE
File created	C:\Program Files (x86)\3\1\~$åë_Óõâàëà_ÁÌ_Áàíê.docx	WINWORD.EXE
File opened for modification	C:\Program Files (x86)\3\1\Àïåë_Óõâàëà_ÁÌ_Áàíê.docx	e6e64a5a7dd78c9af2b5c537b926132ef040787c606277191b93e1b0db28254b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4140	4848	WerFault.exe	82
3596	4848	WerFault.exe	82

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	e6e64a5a7dd78c9af2b5c537b926132ef040787c606277191b93e1b0db28254b.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

pid	Process
2892	reg.exe
884	reg.exe

Runs net.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
528	WINWORD.EXE
528	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4848	System32.exe
4848	System32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4848	System32.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
528	WINWORD.EXE
528	WINWORD.EXE
528	WINWORD.EXE
528	WINWORD.EXE
528	WINWORD.EXE
528	WINWORD.EXE
528	WINWORD.EXE
528	WINWORD.EXE
528	WINWORD.EXE
528	WINWORD.EXE
528	WINWORD.EXE

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 528	3716	e6e64a5a7dd78c9af2b5c537b926132ef040787c606277191b93e1b0db28254b.exe	81
PID 3716 wrote to memory of 528	3716	e6e64a5a7dd78c9af2b5c537b926132ef040787c606277191b93e1b0db28254b.exe	81
PID 3716 wrote to memory of 4848	3716	e6e64a5a7dd78c9af2b5c537b926132ef040787c606277191b93e1b0db28254b.exe	82
PID 3716 wrote to memory of 4848	3716	e6e64a5a7dd78c9af2b5c537b926132ef040787c606277191b93e1b0db28254b.exe	82
PID 3716 wrote to memory of 4848	3716	e6e64a5a7dd78c9af2b5c537b926132ef040787c606277191b93e1b0db28254b.exe	82
PID 4848 wrote to memory of 4800	4848	System32.exe	83
PID 4848 wrote to memory of 4800	4848	System32.exe	83
PID 4848 wrote to memory of 4800	4848	System32.exe	83
PID 4800 wrote to memory of 2308	4800	cmd.exe	85
PID 4800 wrote to memory of 2308	4800	cmd.exe	85
PID 4800 wrote to memory of 2308	4800	cmd.exe	85
PID 2308 wrote to memory of 4348	2308	net.exe	86
PID 2308 wrote to memory of 4348	2308	net.exe	86
PID 2308 wrote to memory of 4348	2308	net.exe	86
PID 4848 wrote to memory of 2892	4848	System32.exe	88
PID 4848 wrote to memory of 2892	4848	System32.exe	88
PID 4848 wrote to memory of 2892	4848	System32.exe	88
PID 4848 wrote to memory of 884	4848	System32.exe	91
PID 4848 wrote to memory of 884	4848	System32.exe	91
PID 4848 wrote to memory of 884	4848	System32.exe	91

C:\Users\Admin\AppData\Local\Temp\e6e64a5a7dd78c9af2b5c537b926132ef040787c606277191b93e1b0db28254b.exe
"C:\Users\Admin\AppData\Local\Temp\e6e64a5a7dd78c9af2b5c537b926132ef040787c606277191b93e1b0db28254b.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Program Files (x86)\3\1\Àïåë_Óõâàëà_ÁÌ_Áàíê.docx" /o ""
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:528
- C:\Program Files (x86)\WindowsUpdate\System32.exe
  "C:\Program Files (x86)\WindowsUpdate\System32.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4848
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C "net user Admin > 111.txt"
    3⤵
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:4800
  - - C:\Windows\SysWOW64\net.exe
      net user Admin
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2308
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user Admin
        5⤵
        
        PID:4348
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Program Files (x86)\WindowsUpdate\System32.exe" /t REG_SZ /d "C:\Program Files (x86)\WindowsUpdate\System32.exe:*:Enabled:Windows Update" /f
    3⤵
    - Modifies firewall policy service
    - Modifies registry key
    PID:2892
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Windows Update" /t REG_SZ /d "\"C:\Program Files (x86)\WindowsUpdate\System32.exe\" /update /key 833067941" /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:884
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 684
    3⤵
    - Program crash
    PID:4140
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 708
    3⤵
    - Program crash
    PID:3596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4848 -ip 4848
1⤵
PID:3160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4848 -ip 4848
1⤵
PID:4264

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

Credential Access

Discovery

Query Registry

4

System Information Discovery

4