c954ca3d7e795d323b1d79a7032f6e3db74bd8c0d458299acdc3d6357e65af20

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	lncom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Windows Reg Services = "C:\\Windows\\system32\\ffservice.exe"	lncom.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{a75aed00-d7bf-11d1-9947-00c0Cf98bbc9}\StubPath = "C:\\Windows\\system32\\lservice.exe"	lncom.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{a75aed00-d7bf-11d1-9947-00c0Cf98bbc9}	lncom.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	bcee4702f35994eb8cf906876a26f77c.exe

Executes dropped EXE 2 IoCs

pid	Process
640	lncom.exe
2404	wservice.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Reg Services = "C:\\Windows\\system32\\ffservice.exe"	lncom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Reg Services = "C:\\Windows\\system32\\ffservice.exe"	lncom.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wservice.exe	lncom.exe
File opened for modification	C:\Windows\SysWOW64\wservice.exe	lncom.exe
File created	C:\Windows\SysWOW64\lservice.exe	lncom.exe
File opened for modification	C:\Windows\SysWOW64\lservice.exe	lncom.exe
File created	C:\Windows\SysWOW64\ffservice.exe	lncom.exe
File opened for modification	C:\Windows\SysWOW64\ffservice.exe	lncom.exe
File created	C:\Windows\SysWOW64\lncom.exe	bcee4702f35994eb8cf906876a26f77c.exe
File created	C:\Windows\SysWOW64\lncom_.ram	bcee4702f35994eb8cf906876a26f77c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings	bcee4702f35994eb8cf906876a26f77c.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4896	vlc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
640	lncom.exe
640	lncom.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4896	vlc.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4896	vlc.exe
4896	vlc.exe
4896	vlc.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4896	vlc.exe
4896	vlc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4896	vlc.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 4896	1180	bcee4702f35994eb8cf906876a26f77c.exe	85
PID 1180 wrote to memory of 4896	1180	bcee4702f35994eb8cf906876a26f77c.exe	85
PID 1180 wrote to memory of 640	1180	bcee4702f35994eb8cf906876a26f77c.exe	86
PID 1180 wrote to memory of 640	1180	bcee4702f35994eb8cf906876a26f77c.exe	86
PID 1180 wrote to memory of 640	1180	bcee4702f35994eb8cf906876a26f77c.exe	86
PID 1180 wrote to memory of 3580	1180	bcee4702f35994eb8cf906876a26f77c.exe	87
PID 1180 wrote to memory of 3580	1180	bcee4702f35994eb8cf906876a26f77c.exe	87
PID 1180 wrote to memory of 3580	1180	bcee4702f35994eb8cf906876a26f77c.exe	87
PID 640 wrote to memory of 2404	640	lncom.exe	89
PID 640 wrote to memory of 2404	640	lncom.exe	89
PID 640 wrote to memory of 2404	640	lncom.exe	89

C:\Users\Admin\AppData\Local\Temp\bcee4702f35994eb8cf906876a26f77c.exe
"C:\Users\Admin\AppData\Local\Temp\bcee4702f35994eb8cf906876a26f77c.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Windows\system32\lncom_.ram"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4896
- C:\Windows\SysWOW64\lncom.exe
  "C:\Windows\system32\lncom.exe"
  2⤵
  - Adds policy Run key to start application
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:640
- - C:\Windows\SysWOW64\wservice.exe
    C:\Windows\system32\wservice.exe -s
    3⤵
    - Executes dropped EXE
    PID:2404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\BCEE47~1.EXE.bat
  2⤵
  PID:3580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry