asyncrat | f8569a28afa079072bf1faf79e715dda7513e382dc423fc5ee07ec2f54223d24

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	ccrr.exe

Executes dropped EXE 4 IoCs

pid	Process
2056	ccrr.exe
4300	ccrr.exe
1304	asri.exe
3520	asri.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2056 set thread context of 4300	2056	ccrr.exe	90
PID 1304 set thread context of 3520	1304	asri.exe	100

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
1960	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4176	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3504	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
4300	ccrr.exe
4300	ccrr.exe
4300	ccrr.exe
4300	ccrr.exe
4300	ccrr.exe
4300	ccrr.exe
4300	ccrr.exe
4300	ccrr.exe
4300	ccrr.exe
4300	ccrr.exe
4300	ccrr.exe
4300	ccrr.exe
4300	ccrr.exe
4300	ccrr.exe
4300	ccrr.exe
4300	ccrr.exe
4300	ccrr.exe
4300	ccrr.exe
4300	ccrr.exe
4300	ccrr.exe
4300	ccrr.exe
4300	ccrr.exe
4300	ccrr.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2056	ccrr.exe
Token: SeDebugPrivilege	4300	ccrr.exe
Token: SeDebugPrivilege	1304	asri.exe
Token: SeDebugPrivilege	3520	asri.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3504	EXCEL.EXE
3504	EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3504	EXCEL.EXE
3504	EXCEL.EXE
3504	EXCEL.EXE
3504	EXCEL.EXE
3504	EXCEL.EXE
3504	EXCEL.EXE
3504	EXCEL.EXE
3504	EXCEL.EXE
3504	EXCEL.EXE
3504	EXCEL.EXE
3504	EXCEL.EXE
3504	EXCEL.EXE

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 3504 wrote to memory of 2056	3504	EXCEL.EXE	88
PID 3504 wrote to memory of 2056	3504	EXCEL.EXE	88
PID 3504 wrote to memory of 2056	3504	EXCEL.EXE	88
PID 2056 wrote to memory of 4300	2056	ccrr.exe	90
PID 2056 wrote to memory of 4300	2056	ccrr.exe	90
PID 2056 wrote to memory of 4300	2056	ccrr.exe	90
PID 2056 wrote to memory of 4300	2056	ccrr.exe	90
PID 2056 wrote to memory of 4300	2056	ccrr.exe	90
PID 2056 wrote to memory of 4300	2056	ccrr.exe	90
PID 2056 wrote to memory of 4300	2056	ccrr.exe	90
PID 2056 wrote to memory of 4300	2056	ccrr.exe	90
PID 4300 wrote to memory of 5032	4300	ccrr.exe	93
PID 4300 wrote to memory of 5032	4300	ccrr.exe	93
PID 4300 wrote to memory of 5032	4300	ccrr.exe	93
PID 4300 wrote to memory of 4196	4300	ccrr.exe	95
PID 4300 wrote to memory of 4196	4300	ccrr.exe	95
PID 4300 wrote to memory of 4196	4300	ccrr.exe	95
PID 4196 wrote to memory of 4176	4196	cmd.exe	97
PID 4196 wrote to memory of 4176	4196	cmd.exe	97
PID 4196 wrote to memory of 4176	4196	cmd.exe	97
PID 5032 wrote to memory of 1960	5032	cmd.exe	98
PID 5032 wrote to memory of 1960	5032	cmd.exe	98
PID 5032 wrote to memory of 1960	5032	cmd.exe	98
PID 4196 wrote to memory of 1304	4196	cmd.exe	99
PID 4196 wrote to memory of 1304	4196	cmd.exe	99
PID 4196 wrote to memory of 1304	4196	cmd.exe	99
PID 1304 wrote to memory of 3520	1304	asri.exe	100
PID 1304 wrote to memory of 3520	1304	asri.exe	100
PID 1304 wrote to memory of 3520	1304	asri.exe	100
PID 1304 wrote to memory of 3520	1304	asri.exe	100
PID 1304 wrote to memory of 3520	1304	asri.exe	100
PID 1304 wrote to memory of 3520	1304	asri.exe	100
PID 1304 wrote to memory of 3520	1304	asri.exe	100
PID 1304 wrote to memory of 3520	1304	asri.exe	100

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Pago.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3504
- C:\ccrr.exe
  "C:\ccrr.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\ccrr.exe
    C:\ccrr.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4300
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "asri" /tr '"C:\Users\Admin\AppData\Roaming\asri.exe"' & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5032
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "asri" /tr '"C:\Users\Admin\AppData\Roaming\asri.exe"'
        5⤵
        Creates scheduled task(s)
        
        PID:1960
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpA964.tmp.bat""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4196
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:4176
    - - C:\Users\Admin\AppData\Roaming\asri.exe
        
        "C:\Users\Admin\AppData\Roaming\asri.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1304
      - C:\Users\Admin\AppData\Roaming\asri.exe
        
        C:\Users\Admin\AppData\Roaming\asri.exe
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3520

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery