limerat | 61c5f76ed94eb63ad3a50b8225f2e795c7c6461e5f40bacb4ad8cadab276748e

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Roaming\\Branding\\svchost.exe\""	ccc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Roaming\\Branding\\svchost.exe\""	svchost.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	ccc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	ccc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	ccc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	ccc.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

Windows Service

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	ccc.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	ccc.exe

Executes dropped EXE 1 IoCs

pid	Process
984	svchost.exe

Enumerates connected drives 3 TTPs 15 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\g:	vssadmin.exe
File opened (read-only)	\??\e:	vssadmin.exe
File opened (read-only)	\??\D:	vssadmin.exe
File opened (read-only)	\??\E:	vssadmin.exe
File opened (read-only)	\??\G:	vssadmin.exe
File opened (read-only)	\??\h:	vssadmin.exe
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\E:	vssadmin.exe
File opened (read-only)	\??\h:	vssadmin.exe
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\e:	vssadmin.exe
File opened (read-only)	\??\G:	vssadmin.exe
File opened (read-only)	\??\H:	vssadmin.exe
File opened (read-only)	\??\H:	vssadmin.exe
File opened (read-only)	\??\g:	vssadmin.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 64 IoCs

Web Service

T1102

flow	ioc
75	pastebin.com
101	pastebin.com
106	pastebin.com
112	pastebin.com
72	pastebin.com
76	pastebin.com
77	pastebin.com
90	pastebin.com
94	pastebin.com
67	pastebin.com
98	pastebin.com
100	pastebin.com
29	pastebin.com
109	pastebin.com
118	pastebin.com
122	pastebin.com
64	pastebin.com
88	pastebin.com
93	pastebin.com
96	pastebin.com
97	pastebin.com
121	pastebin.com
18	iplogger.org
57	pastebin.com
83	pastebin.com
58	pastebin.com
79	pastebin.com
95	pastebin.com
99	pastebin.com
92	pastebin.com
107	pastebin.com
111	pastebin.com
123	pastebin.com
124	pastebin.com
125	pastebin.com
60	pastebin.com
73	pastebin.com
84	pastebin.com
110	pastebin.com
115	pastebin.com
126	pastebin.com
59	pastebin.com
68	pastebin.com
70	pastebin.com
86	pastebin.com
74	pastebin.com
91	pastebin.com
104	pastebin.com
102	pastebin.com
30	pastebin.com
56	pastebin.com
69	pastebin.com
71	pastebin.com
78	pastebin.com
80	pastebin.com
85	pastebin.com
103	pastebin.com
120	pastebin.com
17	iplogger.org
81	pastebin.com
82	pastebin.com
89	pastebin.com
61	pastebin.com
65	pastebin.com

Hide Artifacts: Hidden Files and Directories 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4644	cmd.exe
3680	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Disables Windows logging functionality 2 TTPs
Changes registry settings to disable Windows Event logging.

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Interacts with shadow copies 3 TTPs 12 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4796	vssadmin.exe
1528	vssadmin.exe
2768	vssadmin.exe
896	vssadmin.exe
4676	vssadmin.exe
2004	vssadmin.exe
2196	vssadmin.exe
2060	vssadmin.exe
1176	vssadmin.exe
740	vssadmin.exe
4036	vssadmin.exe
3860	vssadmin.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
5044	schtasks.exe
2428	schtasks.exe
2320	schtasks.exe
3748	schtasks.exe
4520	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3336	ccc.exe
3336	ccc.exe
3336	ccc.exe
2420	powershell.exe
2420	powershell.exe
984	svchost.exe
984	svchost.exe
984	svchost.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	3336	ccc.exe
Token: SeDebugPrivilege	2420	powershell.exe
Token: SeBackupPrivilege	2400	vssvc.exe
Token: SeRestorePrivilege	2400	vssvc.exe
Token: SeAuditPrivilege	2400	vssvc.exe
Token: SeBackupPrivilege	3336	ccc.exe
Token: SeSecurityPrivilege	3336	ccc.exe
Token: SeBackupPrivilege	3336	ccc.exe
Token: SeDebugPrivilege	984	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3336 wrote to memory of 4644	3336	ccc.exe	85
PID 3336 wrote to memory of 4644	3336	ccc.exe	85
PID 4644 wrote to memory of 2764	4644	cmd.exe	87
PID 4644 wrote to memory of 2764	4644	cmd.exe	87
PID 4644 wrote to memory of 744	4644	cmd.exe	88
PID 4644 wrote to memory of 744	4644	cmd.exe	88
PID 3336 wrote to memory of 2420	3336	ccc.exe	89
PID 3336 wrote to memory of 2420	3336	ccc.exe	89
PID 3336 wrote to memory of 2016	3336	ccc.exe	91
PID 3336 wrote to memory of 2016	3336	ccc.exe	91
PID 3336 wrote to memory of 1200	3336	ccc.exe	92
PID 3336 wrote to memory of 1200	3336	ccc.exe	92
PID 3336 wrote to memory of 5020	3336	ccc.exe	93
PID 3336 wrote to memory of 5020	3336	ccc.exe	93
PID 3336 wrote to memory of 4920	3336	ccc.exe	94
PID 3336 wrote to memory of 4920	3336	ccc.exe	94
PID 3336 wrote to memory of 4116	3336	ccc.exe	95
PID 3336 wrote to memory of 4116	3336	ccc.exe	95
PID 3336 wrote to memory of 4656	3336	ccc.exe	96
PID 3336 wrote to memory of 4656	3336	ccc.exe	96
PID 3336 wrote to memory of 972	3336	ccc.exe	97
PID 3336 wrote to memory of 972	3336	ccc.exe	97
PID 3336 wrote to memory of 4228	3336	ccc.exe	98
PID 3336 wrote to memory of 4228	3336	ccc.exe	98
PID 3336 wrote to memory of 1608	3336	ccc.exe	99
PID 3336 wrote to memory of 1608	3336	ccc.exe	99
PID 3336 wrote to memory of 2924	3336	ccc.exe	100
PID 3336 wrote to memory of 2924	3336	ccc.exe	100
PID 3336 wrote to memory of 4368	3336	ccc.exe	101
PID 3336 wrote to memory of 4368	3336	ccc.exe	101
PID 3336 wrote to memory of 4896	3336	ccc.exe	102
PID 3336 wrote to memory of 4896	3336	ccc.exe	102
PID 3336 wrote to memory of 5100	3336	ccc.exe	103
PID 3336 wrote to memory of 5100	3336	ccc.exe	103
PID 1608 wrote to memory of 2060	1608	cmd.exe	117
PID 1608 wrote to memory of 2060	1608	cmd.exe	117
PID 2016 wrote to memory of 1528	2016	cmd.exe	118
PID 2016 wrote to memory of 1528	2016	cmd.exe	118
PID 4116 wrote to memory of 4796	4116	cmd.exe	119
PID 4116 wrote to memory of 4796	4116	cmd.exe	119
PID 4920 wrote to memory of 4676	4920	cmd.exe	120
PID 4920 wrote to memory of 4676	4920	cmd.exe	120
PID 4896 wrote to memory of 2196	4896	cmd.exe	121
PID 4896 wrote to memory of 2196	4896	cmd.exe	121
PID 5100 wrote to memory of 2004	5100	cmd.exe	122
PID 5100 wrote to memory of 2004	5100	cmd.exe	122
PID 972 wrote to memory of 1176	972	cmd.exe	123
PID 972 wrote to memory of 1176	972	cmd.exe	123
PID 4368 wrote to memory of 2768	4368	cmd.exe	125
PID 4368 wrote to memory of 2768	4368	cmd.exe	125
PID 1200 wrote to memory of 2736	1200	cmd.exe	126
PID 1200 wrote to memory of 2736	1200	cmd.exe	126
PID 2924 wrote to memory of 3860	2924	cmd.exe	128
PID 2924 wrote to memory of 3860	2924	cmd.exe	128
PID 4228 wrote to memory of 896	4228	cmd.exe	127
PID 4228 wrote to memory of 896	4228	cmd.exe	127
PID 5020 wrote to memory of 4036	5020	cmd.exe	129
PID 5020 wrote to memory of 4036	5020	cmd.exe	129
PID 4656 wrote to memory of 740	4656	cmd.exe	130
PID 4656 wrote to memory of 740	4656	cmd.exe	130
PID 3336 wrote to memory of 3748	3336	ccc.exe	132
PID 3336 wrote to memory of 3748	3336	ccc.exe	132
PID 3336 wrote to memory of 2320	3336	ccc.exe	133
PID 3336 wrote to memory of 2320	3336	ccc.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 4 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2764	attrib.exe
744	attrib.exe
2832	attrib.exe
2120	attrib.exe

C:\Users\Admin\AppData\Local\Temp\ccc.exe
"C:\Users\Admin\AppData\Local\Temp\ccc.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender Real-time Protection settings
- Modifies security service
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c attrib +H +S "C:\Users\Admin\AppData\Roaming\\Branding" & attrib +H +S "C:\Users\Admin\AppData\Roaming\\Branding\*" /S /D
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4644
- - C:\Windows\system32\attrib.exe
    attrib +H +S "C:\Users\Admin\AppData\Roaming\\Branding"
    3⤵
    - Views/modifies file attributes
    PID:2764
- - C:\Windows\system32\attrib.exe
    attrib +H +S "C:\Users\Admin\AppData\Roaming\\Branding\*" /S /D
    3⤵
    - Views/modifies file attributes
    PID:744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Get-MpPreference -verbose
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2420
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin Delete Shadows /all /quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Windows\system32\vssadmin.exe
    vssadmin Delete Shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1528
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin resize shadow /for=c: /on=c: /maxsize=401MB
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1200
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadow /for=c: /on=c: /maxsize=401MB
    3⤵
    PID:2736
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded
    3⤵
    - Interacts with shadow copies
    PID:4036
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4920
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:4676
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4116
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:4796
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:740
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:972
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:1176
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4228
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:896
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1608
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:2060
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:3860
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4368
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:2768
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:2196
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c Vssadmin delete shadowstorage /all /quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5100
- - C:\Windows\system32\vssadmin.exe
    Vssadmin delete shadowstorage /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:2004
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /f /st "06:39" /sc daily /mo "2" /tn "MNO Metadata Parser" /tr "'explorer'https://bit.ly/3iVN7Vd"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3748
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /f /st "07:55" /sc daily /mo "4" /tn "MNO Metadata Parser" /tr "'explorer'https://bit.ly/3iVN7Vd"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2320
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /f /st "17:29" /sc daily /mo "5" /tn "MNO Metadata Parser" /tr "'explorer'https://bit.ly/3iVN7Vd"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4520
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /f /st "15:00" /sc weekly /mo "3" /d "Tue" /tn "MNO Metadata Parser" /tr "'explorer'https://bit.ly/3iVN7Vd"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2428
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /f /st "06:57" /sc monthly /m "may" /tn "MNO Metadata Parser" /tr "'explorer'https://bit.ly/3iVN7Vd"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5044
- C:\Users\Admin\AppData\Roaming\Branding\svchost.exe
  "C:\Users\Admin\AppData\Roaming\Branding\svchost.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:984
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c attrib +H +S "C:\Users\Admin\AppData\Roaming\\Branding" & attrib +H +S "C:\Users\Admin\AppData\Roaming\\Branding\*" /S /D
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3680
  - - C:\Windows\system32\attrib.exe
      attrib +H +S "C:\Users\Admin\AppData\Roaming\\Branding"
      4⤵
      Views/modifies file attributes
      PID:2832
  - - C:\Windows\system32\attrib.exe
      attrib +H +S "C:\Users\Admin\AppData\Roaming\\Branding\*" /S /D
      4⤵
      Views/modifies file attributes
      PID:2120

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Direct Volume Access

T1006

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry