d40dc9ec509ed5d6e1a4b3eb9e27205ad87f88ec24720c0ca8d82337c0e8bb70

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000\Control Panel\International\Geo\Nation	Spoofer.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
4128	4444.sys
5856	55555.sys

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
5456	cmd.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\System32\4444.sys	cmd.exe
File opened for modification	C:\Windows\System32\4444.sys	cmd.exe
File created	C:\Windows\System32\55555.sys	cmd.exe
File opened for modification	C:\Windows\System32\55555.sys	cmd.exe
File opened for modification	C:\Windows\System32\4444.sys	attrib.exe
File opened for modification	C:\Windows\System32\55555.sys	attrib.exe
File created	C:\Windows\System32\c.vbs	cmd.exe
File opened for modification	C:\Windows\System32\c.vbs	cmd.exe

Launches sc.exe 9 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5016	sc.exe
756	sc.exe
4960	sc.exe
6128	sc.exe
2600	sc.exe
1208	sc.exe
5000	sc.exe
4952	sc.exe
4940	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Spoofer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Spoofer.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	Spoofer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	Spoofer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	Spoofer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Spoofer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4980	schtasks.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
5800	powershell.exe
5800	powershell.exe
5376	powershell.exe
5376	powershell.exe
3908	powershell.exe
3908	powershell.exe
1840	powershell.exe
1840	powershell.exe
5712	powershell.exe
5712	powershell.exe
2804	powershell.exe
2804	powershell.exe
5340	powershell.exe
5340	powershell.exe
116	powershell.exe
116	powershell.exe
2136	powershell.exe
2136	powershell.exe
5204	powershell.exe
5204	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4668	Spoofer.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	5800	powershell.exe
Token: SeDebugPrivilege	5376	powershell.exe
Token: SeDebugPrivilege	3908	powershell.exe
Token: SeDebugPrivilege	1840	powershell.exe
Token: SeDebugPrivilege	5712	powershell.exe
Token: SeDebugPrivilege	2804	powershell.exe
Token: SeDebugPrivilege	5340	powershell.exe
Token: SeDebugPrivilege	116	powershell.exe
Token: SeDebugPrivilege	2136	powershell.exe
Token: SeDebugPrivilege	5204	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4668	Spoofer.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 4668 wrote to memory of 5456	4668	Spoofer.exe	82
PID 5456 wrote to memory of 4952	5456	cmd.exe	84
PID 5456 wrote to memory of 4940	5456	cmd.exe	85
PID 5456 wrote to memory of 5000	5456	cmd.exe	86
PID 5456 wrote to memory of 5016	5456	cmd.exe	87
PID 5456 wrote to memory of 756	5456	cmd.exe	88
PID 5456 wrote to memory of 4960	5456	cmd.exe	89
PID 5456 wrote to memory of 4924	5456	cmd.exe	90
PID 4668 wrote to memory of 5372	4668	Spoofer.exe	91
PID 5372 wrote to memory of 6140	5372	cmd.exe	93
PID 5372 wrote to memory of 1912	5372	cmd.exe	94
PID 5372 wrote to memory of 1948	5372	cmd.exe	95
PID 5372 wrote to memory of 3264	5372	cmd.exe	96
PID 5372 wrote to memory of 4408	5372	cmd.exe	97
PID 5372 wrote to memory of 1660	5372	cmd.exe	98
PID 5372 wrote to memory of 4336	5372	cmd.exe	99
PID 5372 wrote to memory of 3188	5372	cmd.exe	100
PID 5372 wrote to memory of 780	5372	cmd.exe	101
PID 5372 wrote to memory of 4944	5372	cmd.exe	102
PID 5372 wrote to memory of 3900	5372	cmd.exe	103
PID 5372 wrote to memory of 2640	5372	cmd.exe	104
PID 5372 wrote to memory of 568	5372	cmd.exe	105
PID 5372 wrote to memory of 3148	5372	cmd.exe	106
PID 5372 wrote to memory of 5620	5372	cmd.exe	107
PID 5372 wrote to memory of 4260	5372	cmd.exe	108
PID 5372 wrote to memory of 5644	5372	cmd.exe	109
PID 5372 wrote to memory of 1696	5372	cmd.exe	110
PID 5372 wrote to memory of 3788	5372	cmd.exe	111
PID 5372 wrote to memory of 2528	5372	cmd.exe	112
PID 5372 wrote to memory of 632	5372	cmd.exe	113
PID 632 wrote to memory of 6128	632	cmd.exe	114
PID 5372 wrote to memory of 6132	5372	cmd.exe	115
PID 6132 wrote to memory of 2600	6132	cmd.exe	116
PID 5372 wrote to memory of 3484	5372	cmd.exe	117
PID 3484 wrote to memory of 1208	3484	cmd.exe	118
PID 5372 wrote to memory of 5800	5372	cmd.exe	121
PID 5800 wrote to memory of 5376	5800	powershell.exe	124
PID 5372 wrote to memory of 3908	5372	cmd.exe	127
PID 3908 wrote to memory of 1840	3908	powershell.exe	128
PID 5372 wrote to memory of 5712	5372	cmd.exe	130
PID 5712 wrote to memory of 2804	5712	powershell.exe	131
PID 5372 wrote to memory of 4980	5372	cmd.exe	133
PID 5372 wrote to memory of 5340	5372	cmd.exe	135
PID 5372 wrote to memory of 116	5372	cmd.exe	137
PID 5372 wrote to memory of 944	5372	cmd.exe	138
PID 5372 wrote to memory of 5704	5372	cmd.exe	139
PID 5372 wrote to memory of 6096	5372	cmd.exe	140
PID 5372 wrote to memory of 5228	5372	cmd.exe	141
PID 5372 wrote to memory of 2136	5372	cmd.exe	142
PID 5372 wrote to memory of 5204	5372	cmd.exe	143

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1696	attrib.exe
3788	attrib.exe
2528	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Spoofer.exe
"C:\Users\Admin\AppData\Local\Temp\Spoofer.exe"
1⤵
- Checks computer location settings
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4668
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop 4444 & sc stop 55555 & sc stop vcsass & sc delete 4444 & sc delete 55555 & sc delete vcsass & schtasks /Delete /TN "cvbs" /F & del /F /Q C:\Windows\System32\4444.sys & del /F /Q C:\Windows\System32\55555.sys & del /F /Q C:\Windows\System32\vcsass.sys
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5456
- - C:\Windows\system32\sc.exe
    sc stop 4444
    3⤵
    - Launches sc.exe
    PID:4952
- - C:\Windows\system32\sc.exe
    sc stop 55555
    3⤵
    - Launches sc.exe
    PID:4940
- - C:\Windows\system32\sc.exe
    sc stop vcsass
    3⤵
    - Launches sc.exe
    PID:5000
- - C:\Windows\system32\sc.exe
    sc delete 4444
    3⤵
    - Launches sc.exe
    PID:5016
- - C:\Windows\system32\sc.exe
    sc delete 55555
    3⤵
    - Launches sc.exe
    PID:756
- - C:\Windows\system32\sc.exe
    sc delete vcsass
    3⤵
    - Launches sc.exe
    PID:4960
- - C:\Windows\system32\schtasks.exe
    schtasks /Delete /TN "cvbs" /F
    3⤵
    PID:4924
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\SaturnSpoofer_4668\start.bat"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:5372
- - C:\Windows\system32\openfiles.exe
    openfiles
    3⤵
    PID:6140
- - C:\Windows\system32\reg.exe
    reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TPM\WMI" /v "WindowsAIKHash" /f
    3⤵
    PID:1912
- - C:\Windows\system32\reg.exe
    reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TPM\WMI" /v "TaskManufacturerId" /f
    3⤵
    PID:1948
- - C:\Windows\system32\reg.exe
    reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TPM\WMI" /v "TaskInformationFlags" /f
    3⤵
    PID:3264
- - C:\Windows\system32\reg.exe
    reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TPM\WMI\TaskStates" /f
    3⤵
    PID:4408
- - C:\Windows\system32\reg.exe
    reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TPM\WMI\PlatformQuoteKeys" /f
    3⤵
    PID:1660
- - C:\Windows\system32\reg.exe
    reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TPM\WMI\Endorsement\EKCertStoreECC\Certificates" /f
    3⤵
    PID:4336
- - C:\Windows\system32\reg.exe
    reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TPM\WMI\Endorsement" /v "EkRetryLast" /f
    3⤵
    PID:3188
- - C:\Windows\system32\reg.exe
    reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TPM\WMI\Endorsement" /v "EKPub" /f
    3⤵
    PID:780
- - C:\Windows\system32\reg.exe
    reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TPM\WMI\Endorsement" /v "EkNoFetch" /f
    3⤵
    PID:4944
- - C:\Windows\system32\reg.exe
    reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TPM\WMI\Endorsement" /v "EkTries" /f
    3⤵
    PID:3900
- - C:\Windows\system32\reg.exe
    reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TPM\Parameters\Wdf" /v "TimeOfLastTelemetry" /f
    3⤵
    PID:2640
- - C:\Windows\system32\reg.exe
    reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TPM\WMI\Admin" /v "SRKPub" /f
    3⤵
    PID:568
- - C:\Windows\system32\reg.exe
    reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TPM\WMI\User" /f
    3⤵
    PID:3148
- - C:\Windows\system32\reg.exe
    reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TPM\KeyAttestationKeys" /f
    3⤵
    PID:5620
- - C:\Windows\system32\reg.exe
    reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TPM\Enum" /f
    3⤵
    PID:4260
- - C:\Windows\system32\reg.exe
    reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TPM\ODUID" /f
    3⤵
    PID:5644
- - C:\Windows\system32\attrib.exe
    attrib +s +h "C:\Windows\System32\4444.sys"
    3⤵
    - Sets file to hidden
    - Drops file in System32 directory
    - Views/modifies file attributes
    PID:1696
- - C:\Windows\system32\attrib.exe
    attrib +s +h "C:\Windows\System32\55555.sys"
    3⤵
    - Sets file to hidden
    - Drops file in System32 directory
    - Views/modifies file attributes
    PID:3788
- - C:\Windows\system32\attrib.exe
    attrib +s +h "C:\Windows\System32\vcsass.sys"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:2528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc create 4444 binPath= "C:\Windows\System32\4444.sys" DisplayName= "UPDATEService" start= boot tag= 2 type= kernel group="System Reserved"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:632
  - - C:\Windows\system32\sc.exe
      sc create 4444 binPath= "C:\Windows\System32\4444.sys" DisplayName= "UPDATEService" start= boot tag= 2 type= kernel group="System Reserved"
      4⤵
      Launches sc.exe
      PID:6128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc create 55555 binPath= "C:\Windows\System32\55555.sys" DisplayName= "UPDATEService5" start= boot tag= 2 type= kernel group="System Reserved"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6132
  - - C:\Windows\system32\sc.exe
      sc create 55555 binPath= "C:\Windows\System32\55555.sys" DisplayName= "UPDATEService5" start= boot tag= 2 type= kernel group="System Reserved"
      4⤵
      Launches sc.exe
      PID:2600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc create vcsass binPath= "C:\Windows\System32\vcsass.sys" DisplayName= "vcsass" start= boot tag= 2 type= kernel group="System Reserved"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3484
  - - C:\Windows\system32\sc.exe
      sc create vcsass binPath= "C:\Windows\System32\vcsass.sys" DisplayName= "vcsass" start= boot tag= 2 type= kernel group="System Reserved"
      4⤵
      Launches sc.exe
      PID:1208
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Start-Process powershell -WindowStyle Hidden -Verb RunAs -Wait -ArgumentList '-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command Initialize-Tpm'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5800
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command Initialize-Tpm
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5376
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Start-Process powershell -WindowStyle Hidden -Verb RunAs -Wait -ArgumentList '-NoProfile -ExecutionPolicy Bypass -Command Clear-Tpm'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3908
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Clear-Tpm
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1840
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Start-Process powershell -WindowStyle Hidden -Verb RunAs -Wait -ArgumentList '-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command Initialize-Tpm -AllowClear -AllowPhysicalPresence'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5712
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command Initialize-Tpm -AllowClear -AllowPhysicalPresence
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2804
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "cvbs" /tr "C:\Windows\system32\c.vbs" /sc ONLOGON /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4980
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command $hostsPath = 'C:\Windows\System32\drivers\etc\hosts'; $hostsEntries = @' 127.0.0.1 ftpm.amd.com
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5340
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Disable-TpmAutoProvisioning"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:116
- - C:\Windows\system32\cscript.exe
    cscript //nologo reg.vbs
    3⤵
    PID:944
- - C:\Windows\system32\cscript.exe
    cscript //nologo disk.vbs
    3⤵
    PID:5704
- - C:\Windows\system32\cscript.exe
    cscript //nologo a.vbs
    3⤵
    PID:6096
- - C:\Windows\system32\cscript.exe
    cscript //nologo b.vbs
    3⤵
    PID:5228
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Clear-Tpm"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2136
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Disable-TpmAutoProvisioning"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5204

C:\Windows\System32\4444.sys
C:\Windows\System32\4444.sys
1⤵
- Executes dropped EXE
PID:4128

C:\Windows\System32\55555.sys
C:\Windows\System32\55555.sys
1⤵
- Executes dropped EXE
PID:5856

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\system32\c.vbs"
1⤵
PID:3948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Indicator Removal

T1070

Clear Persistence

T1070.009

Credential Access

Discovery

Query Registry

System Information Discovery