r77 | 108a8be5260047a10d49105e7f5c22f949bae4e866278b169b66358ea43145ff

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	setup-w8.1-1.4.6.tmp

Executes dropped EXE 2 IoCs

pid	Process
4308	setup-w8.1-1.4.6.tmp
2264	aerohost.exe

Loads dropped DLL 3 IoCs

pid	Process
2264	aerohost.exe
1680	dwm.exe
1680	dwm.exe

Modifies file permissions 1 TTPs 7 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1840	icacls.exe
5076	icacls.exe
2448	icacls.exe
2220	icacls.exe
708	icacls.exe
4788	icacls.exe
1404	icacls.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2264	aerohost.exe
1680	dwm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup-w8.1-1.4.6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup-w8.1-1.4.6.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
3680	taskkill.exe
3956	taskkill.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2412	schtasks.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
4308	setup-w8.1-1.4.6.tmp
4308	setup-w8.1-1.4.6.tmp
2264	aerohost.exe
2264	aerohost.exe
2264	aerohost.exe
2264	aerohost.exe
2264	aerohost.exe
2264	aerohost.exe
2264	aerohost.exe
2264	aerohost.exe
2264	aerohost.exe
2264	aerohost.exe
2264	aerohost.exe
2264	aerohost.exe
2264	aerohost.exe
2264	aerohost.exe
2264	aerohost.exe
2264	aerohost.exe
2264	aerohost.exe
2264	aerohost.exe
2264	aerohost.exe
2264	aerohost.exe
2264	aerohost.exe
2264	aerohost.exe
2264	aerohost.exe
2264	aerohost.exe
2264	aerohost.exe
2264	aerohost.exe
2264	aerohost.exe
2264	aerohost.exe
2264	aerohost.exe
2264	aerohost.exe
2264	aerohost.exe
2264	aerohost.exe
2264	aerohost.exe
2264	aerohost.exe
2264	aerohost.exe
2264	aerohost.exe
2264	aerohost.exe
2264	aerohost.exe
2264	aerohost.exe
2264	aerohost.exe
2264	aerohost.exe
2264	aerohost.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	3680	taskkill.exe
Token: SeDebugPrivilege	3956	taskkill.exe
Token: SeCreateGlobalPrivilege	1680	dwm.exe
Token: SeChangeNotifyPrivilege	1680	dwm.exe
Token: 33	1680	dwm.exe
Token: SeIncBasePriorityPrivilege	1680	dwm.exe
Token: SeRestorePrivilege	708	icacls.exe
Token: SeRestorePrivilege	4788	icacls.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4308	setup-w8.1-1.4.6.tmp

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 4308	4492	setup-w8.1-1.4.6.exe	86
PID 4492 wrote to memory of 4308	4492	setup-w8.1-1.4.6.exe	86
PID 4492 wrote to memory of 4308	4492	setup-w8.1-1.4.6.exe	86
PID 4308 wrote to memory of 3680	4308	setup-w8.1-1.4.6.tmp	95
PID 4308 wrote to memory of 3680	4308	setup-w8.1-1.4.6.tmp	95
PID 4308 wrote to memory of 3680	4308	setup-w8.1-1.4.6.tmp	95
PID 4308 wrote to memory of 3956	4308	setup-w8.1-1.4.6.tmp	97
PID 4308 wrote to memory of 3956	4308	setup-w8.1-1.4.6.tmp	97
PID 4308 wrote to memory of 3956	4308	setup-w8.1-1.4.6.tmp	97
PID 4308 wrote to memory of 1848	4308	setup-w8.1-1.4.6.tmp	101
PID 4308 wrote to memory of 1848	4308	setup-w8.1-1.4.6.tmp	101
PID 1848 wrote to memory of 3452	1848	cmd.exe	103
PID 1848 wrote to memory of 3452	1848	cmd.exe	103
PID 1848 wrote to memory of 2412	1848	cmd.exe	104
PID 1848 wrote to memory of 2412	1848	cmd.exe	104
PID 1848 wrote to memory of 1220	1848	cmd.exe	105
PID 1848 wrote to memory of 1220	1848	cmd.exe	105
PID 4308 wrote to memory of 4372	4308	setup-w8.1-1.4.6.tmp	107
PID 4308 wrote to memory of 4372	4308	setup-w8.1-1.4.6.tmp	107
PID 2264 wrote to memory of 1680	2264	aerohost.exe	100
PID 4372 wrote to memory of 1404	4372	cmd.exe	109
PID 4372 wrote to memory of 1404	4372	cmd.exe	109
PID 4372 wrote to memory of 1840	4372	cmd.exe	110
PID 4372 wrote to memory of 1840	4372	cmd.exe	110
PID 4372 wrote to memory of 5076	4372	cmd.exe	111
PID 4372 wrote to memory of 5076	4372	cmd.exe	111
PID 4372 wrote to memory of 2448	4372	cmd.exe	112
PID 4372 wrote to memory of 2448	4372	cmd.exe	112
PID 4372 wrote to memory of 2220	4372	cmd.exe	113
PID 4372 wrote to memory of 2220	4372	cmd.exe	113
PID 4372 wrote to memory of 708	4372	cmd.exe	114
PID 4372 wrote to memory of 708	4372	cmd.exe	114
PID 4372 wrote to memory of 4788	4372	cmd.exe	115
PID 4372 wrote to memory of 4788	4372	cmd.exe	115

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\setup-w8.1-1.4.6.exe
"C:\Users\Admin\AppData\Local\Temp\setup-w8.1-1.4.6.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Users\Admin\AppData\Local\Temp\is-S4SPJ.tmp\setup-w8.1-1.4.6.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-S4SPJ.tmp\setup-w8.1-1.4.6.tmp" /SL5="$A0050,1784034,121344,C:\Users\Admin\AppData\Local\Temp\setup-w8.1-1.4.6.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4308
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im aerohost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3680
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im dwm.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3956
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""C:\AeroGlass\install.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1848
  - - C:\Windows\system32\schtasks.exe
      schtasks /Delete /TN "Aero Glass" /F
      4⤵
      PID:3452
  - - C:\Windows\system32\schtasks.exe
      schtasks /Create /RU SYSTEM /TN "Aero Glass" /XML task.xml
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2412
  - - C:\Windows\system32\schtasks.exe
      schtasks /Run /TN "Aero Glass"
      4⤵
      PID:1220
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""C:\AeroGlass\permissions.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4372
  - - C:\Windows\system32\icacls.exe
      icacls . /grant:r *S-1-5-90-0:(CI)(OI)F
      4⤵
      Modifies file permissions
      PID:1404
  - - C:\Windows\system32\icacls.exe
      icacls aerohost.exe /reset
      4⤵
      Modifies file permissions
      PID:1840
  - - C:\Windows\system32\icacls.exe
      icacls dwmglass.dll /reset
      4⤵
      Modifies file permissions
      PID:5076
  - - C:\Windows\system32\icacls.exe
      icacls aerohost.exe /inheritance:r /grant:r *S-1-5-32-544:F
      4⤵
      Modifies file permissions
      PID:2448
  - - C:\Windows\system32\icacls.exe
      icacls dwmglass.dll /inheritance:r /grant:r *S-1-5-32-544:F /grant:r *S-1-5-90-0:RX
      4⤵
      Modifies file permissions
      PID:2220
  - - C:\Windows\system32\icacls.exe
      icacls aerohost.exe /setowner *S-1-5-32-544
      4⤵
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:708
  - - C:\Windows\system32\icacls.exe
      icacls dwmglass.dll /setowner *S-1-5-32-544
      4⤵
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:4788

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1680

C:\AeroGlass\aerohost.exe
C:\AeroGlass\aerohost.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery