0da5ba0bc2bc6e77fb7c69598730e88c63e4a9e9b2ae3e726541448bec596dc3

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	9f27073a4dde7bca3158fe1964c2602e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	shst.dat.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
54	ipapi.co
55	ipapi.co

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{BF4E4E31-E5DA-4499-9F66-7066FA62DBA3}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{93113B1C-51E0-4CAB-BA80-953BFAF408F4}.catalogItem	svchost.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\svchost.exe	shst.dat.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	9f27073a4dde7bca3158fe1964c2602e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	9f27073a4dde7bca3158fe1964c2602e.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
2868	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1492	timeout.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
1544	9f27073a4dde7bca3158fe1964c2602e.exe
1544	9f27073a4dde7bca3158fe1964c2602e.exe
3112	shst.dat.exe
3112	shst.dat.exe
3112	shst.dat.exe
3112	shst.dat.exe
3112	shst.dat.exe
3112	shst.dat.exe
3112	shst.dat.exe
3112	shst.dat.exe
3112	shst.dat.exe
3112	shst.dat.exe
3112	shst.dat.exe
3112	shst.dat.exe
3112	shst.dat.exe
3112	shst.dat.exe
3112	shst.dat.exe
3112	shst.dat.exe
3112	shst.dat.exe
3112	shst.dat.exe
3112	shst.dat.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1544	9f27073a4dde7bca3158fe1964c2602e.exe
Token: SeDebugPrivilege	3112	shst.dat.exe
Token: SeDebugPrivilege	2704	svchost.exe
Token: SeDebugPrivilege	2704	svchost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1544	9f27073a4dde7bca3158fe1964c2602e.exe
1544	9f27073a4dde7bca3158fe1964c2602e.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 3112	1544	9f27073a4dde7bca3158fe1964c2602e.exe	85
PID 1544 wrote to memory of 3112	1544	9f27073a4dde7bca3158fe1964c2602e.exe	85
PID 1544 wrote to memory of 3112	1544	9f27073a4dde7bca3158fe1964c2602e.exe	85
PID 1544 wrote to memory of 804	1544	9f27073a4dde7bca3158fe1964c2602e.exe	86
PID 1544 wrote to memory of 804	1544	9f27073a4dde7bca3158fe1964c2602e.exe	86
PID 1544 wrote to memory of 804	1544	9f27073a4dde7bca3158fe1964c2602e.exe	86
PID 804 wrote to memory of 4360	804	cmd.exe	88
PID 804 wrote to memory of 4360	804	cmd.exe	88
PID 804 wrote to memory of 4360	804	cmd.exe	88
PID 3112 wrote to memory of 2280	3112	shst.dat.exe	91
PID 3112 wrote to memory of 2280	3112	shst.dat.exe	91
PID 3112 wrote to memory of 2280	3112	shst.dat.exe	91
PID 3112 wrote to memory of 2172	3112	shst.dat.exe	93
PID 3112 wrote to memory of 2172	3112	shst.dat.exe	93
PID 3112 wrote to memory of 2172	3112	shst.dat.exe	93
PID 2280 wrote to memory of 2868	2280	cmd.exe	96
PID 2280 wrote to memory of 2868	2280	cmd.exe	96
PID 2280 wrote to memory of 2868	2280	cmd.exe	96
PID 2172 wrote to memory of 1492	2172	cmd.exe	95
PID 2172 wrote to memory of 1492	2172	cmd.exe	95
PID 2172 wrote to memory of 1492	2172	cmd.exe	95
PID 2172 wrote to memory of 2704	2172	cmd.exe	97
PID 2172 wrote to memory of 2704	2172	cmd.exe	97
PID 2172 wrote to memory of 2704	2172	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\9f27073a4dde7bca3158fe1964c2602e.exe
"C:\Users\Admin\AppData\Local\Temp\9f27073a4dde7bca3158fe1964c2602e.exe"
1⤵
- Checks computer location settings
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Users\Admin\AppData\Local\Temp\shst.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\shst.dat.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3112
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Windows\svchost.exe"' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2280
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Windows\svchost.exe"'
      4⤵
      Creates scheduled task(s)
      PID:2868
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp4602.tmp.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2172
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:1492
  - - C:\Windows\svchost.exe
      "C:\Windows\svchost.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2704
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "C:\Users\Admin\AppData\Local\Temp\shst.dat.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:804
- - C:\Windows\SysWOW64\choice.exe
    choice /C Y /N /D Y /T 5
    3⤵
    PID:4360

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:4964

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

System Information Discovery