f9ca96cb7a06f5aef062c233e4059201d84c27011e6bef3da291c46d118e67ba

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Program Files (x86)\\Microsoft Services\\symgr.exe"	symgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Program Files (x86)\\Microsoft Services\\symgr.exe"	symgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Program Files (x86)\\Microsoft Services\\symgr.exe"	symgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Program Files (x86)\\Microsoft Services\\symgr.exe"	symgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Program Files (x86)\\Microsoft Services\\symgr.exe"	symgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Program Files (x86)\\Microsoft Services\\symgr.exe"	symgr.exe

Executes dropped EXE 9 IoCs

pid	Process
2328	symgr.exe
4300	symgr.exe
4124	wd.exe
4900	symgr.exe
2396	symgr.exe
3452	wd.exe
4976	symgr.exe
4920	symgr.exe
4116	wd.exe

Sets service image path in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\svchost\ImagePath = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	symgr.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\svchost\ImagePath = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	symgr.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\svchost\ImagePath = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	symgr.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	f9ca96cb7a06f5aef062c233e4059201d84c27011e6bef3da291c46d118e67ba.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WindowsUpdate = "C:\\Program Files (x86)\\Microsoft Services\\symgr.exe -rundll32 /SYSTEM32 \"C:\\Windows\\System32\\taskmgr.exe\" \"C:\\Program Files\\Microsoft\\Windows\""	symgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WindowsUpdate = "C:\\Program Files (x86)\\Microsoft Services\\symgr.exe -rundll32 /SYSTEM32 \"C:\\Windows\\System32\\taskmgr.exe\" \"C:\\Program Files\\Microsoft\\Windows\""	symgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WindowsUpdate = "C:\\Program Files (x86)\\Microsoft Services\\symgr.exe -rundll32 /SYSTEM32 \"C:\\Windows\\System32\\taskmgr.exe\" \"C:\\Program Files\\Microsoft\\Windows\""	symgr.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Microsoft.com	symgr.exe
File opened for modification	C:\Windows\SysWOW64\Microsoft.com	symgr.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4928 set thread context of 3544	4928	f9ca96cb7a06f5aef062c233e4059201d84c27011e6bef3da291c46d118e67ba.exe	82
PID 2328 set thread context of 4300	2328	symgr.exe	85
PID 4900 set thread context of 2396	4900	symgr.exe	94
PID 4976 set thread context of 4920	4976	symgr.exe	103

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Services\	f9ca96cb7a06f5aef062c233e4059201d84c27011e6bef3da291c46d118e67ba.exe
File created	C:\Program Files (x86)\Microsoft Services\symgr.exe	f9ca96cb7a06f5aef062c233e4059201d84c27011e6bef3da291c46d118e67ba.exe
File opened for modification	C:\Program Files (x86)\Microsoft Services\symgr.exe	f9ca96cb7a06f5aef062c233e4059201d84c27011e6bef3da291c46d118e67ba.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	dw20.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3544	f9ca96cb7a06f5aef062c233e4059201d84c27011e6bef3da291c46d118e67ba.exe
4300	symgr.exe
4300	symgr.exe
4300	symgr.exe
4300	symgr.exe
4300	symgr.exe
4124	wd.exe
4300	symgr.exe
4300	symgr.exe
4300	symgr.exe
4300	symgr.exe
4300	symgr.exe
4300	symgr.exe
4300	symgr.exe
4300	symgr.exe
4300	symgr.exe
4300	symgr.exe
4300	symgr.exe
4300	symgr.exe
4300	symgr.exe
4300	symgr.exe
4300	symgr.exe
4300	symgr.exe
4124	wd.exe
4300	symgr.exe
4300	symgr.exe
4300	symgr.exe
4300	symgr.exe
4300	symgr.exe
4124	wd.exe
4124	wd.exe
4124	wd.exe
4124	wd.exe
4300	symgr.exe
4300	symgr.exe
4300	symgr.exe
4300	symgr.exe
4300	symgr.exe
4300	symgr.exe
4300	symgr.exe
4300	symgr.exe
4300	symgr.exe
4300	symgr.exe
4300	symgr.exe
4300	symgr.exe
4300	symgr.exe
4300	symgr.exe
4300	symgr.exe
4300	symgr.exe
4300	symgr.exe
4300	symgr.exe
4300	symgr.exe
4300	symgr.exe
4124	wd.exe
4300	symgr.exe
4300	symgr.exe
4300	symgr.exe
4300	symgr.exe
4300	symgr.exe
4300	symgr.exe
4300	symgr.exe
4300	symgr.exe
4300	symgr.exe
4300	symgr.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3544	f9ca96cb7a06f5aef062c233e4059201d84c27011e6bef3da291c46d118e67ba.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	3544	f9ca96cb7a06f5aef062c233e4059201d84c27011e6bef3da291c46d118e67ba.exe
Token: SeDebugPrivilege	4300	symgr.exe
Token: SeDebugPrivilege	4124	wd.exe
Token: SeRestorePrivilege	4320	dw20.exe
Token: SeBackupPrivilege	4320	dw20.exe
Token: SeBackupPrivilege	4320	dw20.exe
Token: SeBackupPrivilege	4320	dw20.exe
Token: SeBackupPrivilege	4320	dw20.exe
Token: SeDebugPrivilege	2396	symgr.exe
Token: SeDebugPrivilege	3452	wd.exe
Token: SeBackupPrivilege	4736	dw20.exe
Token: SeBackupPrivilege	4736	dw20.exe
Token: SeDebugPrivilege	4920	symgr.exe
Token: SeDebugPrivilege	4116	wd.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 3544	4928	f9ca96cb7a06f5aef062c233e4059201d84c27011e6bef3da291c46d118e67ba.exe	82
PID 4928 wrote to memory of 3544	4928	f9ca96cb7a06f5aef062c233e4059201d84c27011e6bef3da291c46d118e67ba.exe	82
PID 4928 wrote to memory of 3544	4928	f9ca96cb7a06f5aef062c233e4059201d84c27011e6bef3da291c46d118e67ba.exe	82
PID 4928 wrote to memory of 3544	4928	f9ca96cb7a06f5aef062c233e4059201d84c27011e6bef3da291c46d118e67ba.exe	82
PID 4928 wrote to memory of 3544	4928	f9ca96cb7a06f5aef062c233e4059201d84c27011e6bef3da291c46d118e67ba.exe	82
PID 4928 wrote to memory of 3544	4928	f9ca96cb7a06f5aef062c233e4059201d84c27011e6bef3da291c46d118e67ba.exe	82
PID 4928 wrote to memory of 3544	4928	f9ca96cb7a06f5aef062c233e4059201d84c27011e6bef3da291c46d118e67ba.exe	82
PID 4928 wrote to memory of 3544	4928	f9ca96cb7a06f5aef062c233e4059201d84c27011e6bef3da291c46d118e67ba.exe	82
PID 3544 wrote to memory of 2328	3544	f9ca96cb7a06f5aef062c233e4059201d84c27011e6bef3da291c46d118e67ba.exe	84
PID 3544 wrote to memory of 2328	3544	f9ca96cb7a06f5aef062c233e4059201d84c27011e6bef3da291c46d118e67ba.exe	84
PID 3544 wrote to memory of 2328	3544	f9ca96cb7a06f5aef062c233e4059201d84c27011e6bef3da291c46d118e67ba.exe	84
PID 2328 wrote to memory of 4300	2328	symgr.exe	85
PID 2328 wrote to memory of 4300	2328	symgr.exe	85
PID 2328 wrote to memory of 4300	2328	symgr.exe	85
PID 2328 wrote to memory of 4300	2328	symgr.exe	85
PID 2328 wrote to memory of 4300	2328	symgr.exe	85
PID 2328 wrote to memory of 4300	2328	symgr.exe	85
PID 2328 wrote to memory of 4300	2328	symgr.exe	85
PID 2328 wrote to memory of 4300	2328	symgr.exe	85
PID 4300 wrote to memory of 4124	4300	symgr.exe	86
PID 4300 wrote to memory of 4124	4300	symgr.exe	86
PID 4300 wrote to memory of 4124	4300	symgr.exe	86
PID 4300 wrote to memory of 4320	4300	symgr.exe	88
PID 4300 wrote to memory of 4320	4300	symgr.exe	88
PID 4300 wrote to memory of 4320	4300	symgr.exe	88
PID 4124 wrote to memory of 4900	4124	wd.exe	93
PID 4124 wrote to memory of 4900	4124	wd.exe	93
PID 4124 wrote to memory of 4900	4124	wd.exe	93
PID 4900 wrote to memory of 2396	4900	symgr.exe	94
PID 4900 wrote to memory of 2396	4900	symgr.exe	94
PID 4900 wrote to memory of 2396	4900	symgr.exe	94
PID 4900 wrote to memory of 2396	4900	symgr.exe	94
PID 4900 wrote to memory of 2396	4900	symgr.exe	94
PID 4900 wrote to memory of 2396	4900	symgr.exe	94
PID 4900 wrote to memory of 2396	4900	symgr.exe	94
PID 4900 wrote to memory of 2396	4900	symgr.exe	94
PID 2396 wrote to memory of 3452	2396	symgr.exe	98
PID 2396 wrote to memory of 3452	2396	symgr.exe	98
PID 2396 wrote to memory of 3452	2396	symgr.exe	98
PID 2396 wrote to memory of 4736	2396	symgr.exe	101
PID 2396 wrote to memory of 4736	2396	symgr.exe	101
PID 2396 wrote to memory of 4736	2396	symgr.exe	101
PID 3452 wrote to memory of 4976	3452	wd.exe	102
PID 3452 wrote to memory of 4976	3452	wd.exe	102
PID 3452 wrote to memory of 4976	3452	wd.exe	102
PID 4976 wrote to memory of 4920	4976	symgr.exe	103
PID 4976 wrote to memory of 4920	4976	symgr.exe	103
PID 4976 wrote to memory of 4920	4976	symgr.exe	103
PID 4976 wrote to memory of 4920	4976	symgr.exe	103
PID 4976 wrote to memory of 4920	4976	symgr.exe	103
PID 4976 wrote to memory of 4920	4976	symgr.exe	103
PID 4976 wrote to memory of 4920	4976	symgr.exe	103
PID 4976 wrote to memory of 4920	4976	symgr.exe	103
PID 4920 wrote to memory of 4116	4920	symgr.exe	108
PID 4920 wrote to memory of 4116	4920	symgr.exe	108
PID 4920 wrote to memory of 4116	4920	symgr.exe	108

C:\Users\Admin\AppData\Local\Temp\f9ca96cb7a06f5aef062c233e4059201d84c27011e6bef3da291c46d118e67ba.exe
"C:\Users\Admin\AppData\Local\Temp\f9ca96cb7a06f5aef062c233e4059201d84c27011e6bef3da291c46d118e67ba.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Users\Admin\AppData\Local\Temp\f9ca96cb7a06f5aef062c233e4059201d84c27011e6bef3da291c46d118e67ba.exe
  "C:\Users\Admin\AppData\Local\Temp\f9ca96cb7a06f5aef062c233e4059201d84c27011e6bef3da291c46d118e67ba.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3544
- - C:\Program Files (x86)\Microsoft Services\symgr.exe
    "C:\Program Files (x86)\Microsoft Services\symgr.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2328
  - - C:\Program Files (x86)\Microsoft Services\symgr.exe
      "C:\Program Files (x86)\Microsoft Services\symgr.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Sets service image path in registry
      Adds Run key to start application
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4300
    - - C:\Users\Admin\AppData\Roaming\wd.exe
        
        "C:\Users\Admin\AppData\Roaming\wd.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4124
      - C:\Program Files (x86)\Microsoft Services\symgr.exe
        
        "C:\Program Files (x86)\Microsoft Services\symgr.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4900
        
        C:\Program Files (x86)\Microsoft Services\symgr.exe
        
        "C:\Program Files (x86)\Microsoft Services\symgr.exe"
        7⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Sets service image path in registry
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2396
        
        C:\Users\Admin\AppData\Roaming\wd.exe
        
        "C:\Users\Admin\AppData\Roaming\wd.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3452
        
        C:\Program Files (x86)\Microsoft Services\symgr.exe
        
        "C:\Program Files (x86)\Microsoft Services\symgr.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4976
        
        C:\Program Files (x86)\Microsoft Services\symgr.exe
        
        "C:\Program Files (x86)\Microsoft Services\symgr.exe"
        10⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Sets service image path in registry
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4920
        
        C:\Users\Admin\AppData\Roaming\wd.exe
        
        "C:\Users\Admin\AppData\Roaming\wd.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4116
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
        
        dw20.exe -x -s 1784
        8⤵
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious use of AdjustPrivilegeToken
        
        PID:4736
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
        
        dw20.exe -x -s 1728
        5⤵
        Drops file in Windows directory
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious use of AdjustPrivilegeToken
        
        PID:4320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery