cc766424b7aa2d9fa11934dabb9be55f8938b001eb72692d447fd696d8eaef1e

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\Session manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000000000	reg.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000000000	reg.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000000000	reg.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\csrss = "C:\\Arquivos de programas\\csrss.exe"	a9f3273080e0da16806650602141d883.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchosts.exe = "C:\\Windows\\System32\\svchosts.exe"	a9f3273080e0da16806650602141d883.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\svchosts.exe	a9f3273080e0da16806650602141d883.exe
File opened for modification	C:\Windows\SysWOW64\svchosts.exe	a9f3273080e0da16806650602141d883.exe
File created	C:\Windows\SysWOW64\reg_Seam.txt	a9f3273080e0da16806650602141d883.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\Seam_inf	a9f3273080e0da16806650602141d883.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3368	sc.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3264	schtasks.exe
2304	schtasks.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2360	a9f3273080e0da16806650602141d883.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 3264	2360	a9f3273080e0da16806650602141d883.exe	97
PID 2360 wrote to memory of 3264	2360	a9f3273080e0da16806650602141d883.exe	97
PID 2360 wrote to memory of 3264	2360	a9f3273080e0da16806650602141d883.exe	97
PID 2360 wrote to memory of 2304	2360	a9f3273080e0da16806650602141d883.exe	98
PID 2360 wrote to memory of 2304	2360	a9f3273080e0da16806650602141d883.exe	98
PID 2360 wrote to memory of 2304	2360	a9f3273080e0da16806650602141d883.exe	98
PID 2360 wrote to memory of 3368	2360	a9f3273080e0da16806650602141d883.exe	99
PID 2360 wrote to memory of 3368	2360	a9f3273080e0da16806650602141d883.exe	99
PID 2360 wrote to memory of 3368	2360	a9f3273080e0da16806650602141d883.exe	99
PID 2360 wrote to memory of 1404	2360	a9f3273080e0da16806650602141d883.exe	103
PID 2360 wrote to memory of 1404	2360	a9f3273080e0da16806650602141d883.exe	103
PID 2360 wrote to memory of 1404	2360	a9f3273080e0da16806650602141d883.exe	103
PID 2360 wrote to memory of 2496	2360	a9f3273080e0da16806650602141d883.exe	104
PID 2360 wrote to memory of 2496	2360	a9f3273080e0da16806650602141d883.exe	104
PID 2360 wrote to memory of 2496	2360	a9f3273080e0da16806650602141d883.exe	104
PID 2360 wrote to memory of 4500	2360	a9f3273080e0da16806650602141d883.exe	105
PID 2360 wrote to memory of 4500	2360	a9f3273080e0da16806650602141d883.exe	105
PID 2360 wrote to memory of 4500	2360	a9f3273080e0da16806650602141d883.exe	105

C:\Users\Admin\AppData\Local\Temp\a9f3273080e0da16806650602141d883.exe
"C:\Users\Admin\AppData\Local\Temp\a9f3273080e0da16806650602141d883.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn startt /tr c:\autoexec.bat /sc onstart /ru system
  2⤵
  - Creates scheduled task(s)
  PID:3264
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn startt /tr c:\autoexec.bat /sc onstart /ru system
  2⤵
  - Creates scheduled task(s)
  PID:2304
- C:\Windows\SysWOW64\sc.exe
  sc delete GbpSv
  2⤵
  - Launches sc.exe
  PID:3368
- C:\Windows\SysWOW64\reg.exe
  reg add "HKLM\SYSTEM\ControlSet001\Control\Session manager" /v BootExecute /t REG_MULTI_SZ /d "autocheck autochk *" /f
  2⤵
  - Uses Session Manager for persistence
  PID:1404
- C:\Windows\SysWOW64\reg.exe
  reg add "HKLM\SYSTEM\ControlSet002\Control\Session manager" /v BootExecute /t REG_MULTI_SZ /d "autocheck autochk *" /f
  2⤵
  - Uses Session Manager for persistence
  PID:2496
- C:\Windows\SysWOW64\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session manager" /v BootExecute /t REG_MULTI_SZ /d "autocheck autochk *" /f
  2⤵
  - Uses Session Manager for persistence
  PID:4500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3688 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:3192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

Defense Evasion

Impair Defenses

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop