runningrat | 71f9d2b521480150670747508c2751628c5cf1a485ddf6ecca78f67f8cb9e333

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\RstMwServices\Parameters\ServiceDll = "C:\\Users\\Admin\\AppData\\Local\\Temp\\240610343.dll"	._cache_tmp.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\RstMwServices\Parameters\ServiceDll = "C:\\Users\\Admin\\AppData\\Local\\Temp\\240611156.dll"	._cache_Synaptics.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Control Panel\International\Geo\Nation	._cache_Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Control Panel\International\Geo\Nation	tmp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Control Panel\International\Geo\Nation	Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Control Panel\International\Geo\Nation	._cache_tmp.exe

Executes dropped EXE 4 IoCs

pid	Process
4428	._cache_tmp.exe
3768	Synaptics.exe
2496	._cache_Synaptics.exe
4600	RstMwServices.exe

Loads dropped DLL 4 IoCs

pid	Process
4428	._cache_tmp.exe
1792	svchost.exe
2496	._cache_Synaptics.exe
4600	RstMwServices.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	tmp.exe

Creates a Windows Service
persistence

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NCBCSZSJRSB.dat	svchost.exe
File created	C:\Windows\SysWOW64\RstMwServices.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\RstMwServices.exe	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{8338E9C8-385E-4998-B738-35B273742E05}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NCBCSZSJRSB.dat	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RstMwServices.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	RstMwServices.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	RstMwServices.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	RstMwServices.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7"	RstMwServices.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum	RstMwServices.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	RstMwServices.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	tmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
4440	PING.EXE
3336	PING.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3800	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4428	._cache_tmp.exe
4428	._cache_tmp.exe
2496	._cache_Synaptics.exe
2496	._cache_Synaptics.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4428	._cache_tmp.exe
Token: SeIncBasePriorityPrivilege	2496	._cache_Synaptics.exe
Token: SeManageVolumePrivilege	1492	svchost.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4428	._cache_tmp.exe
2496	._cache_Synaptics.exe
3800	EXCEL.EXE
3800	EXCEL.EXE
3800	EXCEL.EXE
3800	EXCEL.EXE
3800	EXCEL.EXE

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3728 wrote to memory of 4428	3728	tmp.exe	81
PID 3728 wrote to memory of 4428	3728	tmp.exe	81
PID 3728 wrote to memory of 4428	3728	tmp.exe	81
PID 3728 wrote to memory of 3768	3728	tmp.exe	84
PID 3728 wrote to memory of 3768	3728	tmp.exe	84
PID 3728 wrote to memory of 3768	3728	tmp.exe	84
PID 4428 wrote to memory of 2432	4428	._cache_tmp.exe	85
PID 4428 wrote to memory of 2432	4428	._cache_tmp.exe	85
PID 4428 wrote to memory of 2432	4428	._cache_tmp.exe	85
PID 2432 wrote to memory of 4440	2432	cmd.exe	87
PID 2432 wrote to memory of 4440	2432	cmd.exe	87
PID 2432 wrote to memory of 4440	2432	cmd.exe	87
PID 3768 wrote to memory of 2496	3768	Synaptics.exe	90
PID 3768 wrote to memory of 2496	3768	Synaptics.exe	90
PID 3768 wrote to memory of 2496	3768	Synaptics.exe	90
PID 2496 wrote to memory of 1488	2496	._cache_Synaptics.exe	93
PID 2496 wrote to memory of 1488	2496	._cache_Synaptics.exe	93
PID 2496 wrote to memory of 1488	2496	._cache_Synaptics.exe	93
PID 1488 wrote to memory of 3336	1488	cmd.exe	94
PID 1488 wrote to memory of 3336	1488	cmd.exe	94
PID 1488 wrote to memory of 3336	1488	cmd.exe	94
PID 1792 wrote to memory of 4600	1792	svchost.exe	97
PID 1792 wrote to memory of 4600	1792	svchost.exe	97
PID 1792 wrote to memory of 4600	1792	svchost.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3728
- C:\Users\Admin\AppData\Local\Temp\._cache_tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_tmp.exe"
  2⤵
  - Sets DLL path for service in the registry
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4428
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\Admin\AppData\Local\Temp\._cache_tmp.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2432
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:4440
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3768
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Sets DLL path for service in the registry
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2496
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1488
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 1
        5⤵
        Runs ping.exe
        
        PID:3336

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "RstMwServices"
1⤵
PID:1496

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "RstMwServices"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\SysWOW64\RstMwServices.exe
  C:\Windows\system32\RstMwServices.exe "c:\users\admin\appdata\local\temp\240610343.dll",MainThread
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:4600

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3800

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
PID:4832

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:1388

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

Remote System Discovery

T1018

System Information Discovery