ebf4b411dc5d29f406ce86c1a2f560b03d628582866ea59af0189a56d441d349

Change Default File Association

T1042

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "0"	ebf4b411dc5d29f406ce86c1a2f560b03d628582866ea59af0189a56d441d349.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

Hidden Files and Directories

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	ebf4b411dc5d29f406ce86c1a2f560b03d628582866ea59af0189a56d441d349.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

Hidden Files and Directories

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	ebf4b411dc5d29f406ce86c1a2f560b03d628582866ea59af0189a56d441d349.exe

Disables RegEdit via registry modification 1 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ebf4b411dc5d29f406ce86c1a2f560b03d628582866ea59af0189a56d441d349.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	ebf4b411dc5d29f406ce86c1a2f560b03d628582866ea59af0189a56d441d349.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

pid	Process
3656	taskkill.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	ebf4b411dc5d29f406ce86c1a2f560b03d628582866ea59af0189a56d441d349.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	ebf4b411dc5d29f406ce86c1a2f560b03d628582866ea59af0189a56d441d349.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "0"	ebf4b411dc5d29f406ce86c1a2f560b03d628582866ea59af0189a56d441d349.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3656	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 1384	4984	ebf4b411dc5d29f406ce86c1a2f560b03d628582866ea59af0189a56d441d349.exe	81
PID 4984 wrote to memory of 1384	4984	ebf4b411dc5d29f406ce86c1a2f560b03d628582866ea59af0189a56d441d349.exe	81
PID 4984 wrote to memory of 1384	4984	ebf4b411dc5d29f406ce86c1a2f560b03d628582866ea59af0189a56d441d349.exe	81
PID 1384 wrote to memory of 3656	1384	cmd.exe	83
PID 1384 wrote to memory of 3656	1384	cmd.exe	83
PID 1384 wrote to memory of 3656	1384	cmd.exe	83

C:\Users\Admin\AppData\Local\Temp\ebf4b411dc5d29f406ce86c1a2f560b03d628582866ea59af0189a56d441d349.exe
"C:\Users\Admin\AppData\Local\Temp\ebf4b411dc5d29f406ce86c1a2f560b03d628582866ea59af0189a56d441d349.exe"
1⤵
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c taskkill /F /IM ekrn.exe /T
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1384
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM ekrn.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3656

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Hidden Files and Directories

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry