63510ab06d2c663c5bdfd6e7a00b252d36945169dbe77e938cfc836a21002b2d

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "2"	Wub_x64.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WaaSMedicSvc\ImagePath = "%SystemRoot%\\system32\\svchost.exe -k wusvcs -p"	Wub_x64.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	63510ab06d2c663c5bdfd6e7a00b252d36945169dbe77e938cfc836a21002b2d.exe

Executes dropped EXE 1 IoCs

pid	Process
1492	Wub_x64.exe

Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WubBlockLists	Wub_x64.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	Wub_x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4440	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Wub_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Wub_x64.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	63510ab06d2c663c5bdfd6e7a00b252d36945169dbe77e938cfc836a21002b2d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe

Checks processor information in registry 2 TTPs 13 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	reg.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotificationUx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotificationUx.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	1492	Wub_x64.exe
Token: SeTakeOwnershipPrivilege	1492	Wub_x64.exe
Token: SeDebugPrivilege	1492	Wub_x64.exe
Token: SeSecurityPrivilege	1492	Wub_x64.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 4440	2244	63510ab06d2c663c5bdfd6e7a00b252d36945169dbe77e938cfc836a21002b2d.exe	87
PID 4440 wrote to memory of 2664	4440	cmd.exe	90
PID 4440 wrote to memory of 5068	4440	cmd.exe	91
PID 4440 wrote to memory of 3836	4440	cmd.exe	92
PID 4440 wrote to memory of 1492	4440	cmd.exe	94
PID 1492 wrote to memory of 2704	1492	Wub_x64.exe	103
PID 1492 wrote to memory of 532	1492	Wub_x64.exe	105
PID 1492 wrote to memory of 912	1492	Wub_x64.exe	107
PID 1492 wrote to memory of 2112	1492	Wub_x64.exe	109
PID 1492 wrote to memory of 3892	1492	Wub_x64.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\63510ab06d2c663c5bdfd6e7a00b252d36945169dbe77e938cfc836a21002b2d.exe
"C:\Users\Admin\AppData\Local\Temp\63510ab06d2c663c5bdfd6e7a00b252d36945169dbe77e938cfc836a21002b2d.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\on.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4440
- - C:\Windows\system32\bcdedit.exe
    bcdedit
    3⤵
    PID:2664
- - C:\Windows\SysWOW64\reg.exe
    reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"
    3⤵
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    PID:5068
- - C:\Windows\SysWOW64\find.exe
    find /i "x86"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3836
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\Wub_x64.exe
    Wub_x64.exe /E
    3⤵
    - Modifies security service
    - Sets service image path in registry
    - Executes dropped EXE
    - Indicator Removal: Clear Persistence
    - Drops file in System32 directory
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1492
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /change /tn "Microsoft\Windows\UpdateOrchestrator\Report policies" /enable
      4⤵
      PID:2704
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /change /tn "Microsoft\Windows\UpdateOrchestrator\Schedule Scan" /enable
      4⤵
      PID:532
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /change /tn "Microsoft\Windows\UpdateOrchestrator\Schedule Scan Static Task" /enable
      4⤵
      PID:912
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /change /tn "Microsoft\Windows\UpdateOrchestrator\UpdateModelTask" /enable
      4⤵
      PID:2112
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /change /tn "Microsoft\Windows\UpdateOrchestrator\USO_UxBroker" /enable
      4⤵
      PID:3892

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s PushToInstall
1⤵
PID:1980

C:\Windows\system32\MusNotificationUx.exe
%systemroot%\system32\MusNotificationUx.exe Toast_DownloadNeedUserAgreement 0
1⤵
- Checks processor information in registry
PID:4368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Defense Evasion

Indicator Removal

T1070

Clear Persistence

Modify Registry

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

3

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery