sality | 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9

Modify Existing Service

T1031

Processes:

1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exeulxpmi.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	ulxpmi.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	ulxpmi.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	ulxpmi.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 2 IoCs

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

Processes:

1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exeulxpmi.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ulxpmi.exe

Windows security bypass 2 TTPs 12 IoCs

Disabling Security Tools

T1089

Modify Registry

Processes:

1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exeulxpmi.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	ulxpmi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	ulxpmi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	ulxpmi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	ulxpmi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	ulxpmi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	ulxpmi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe

Disables RegEdit via registry modification 2 IoCs

evasion

Processes:

1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exeulxpmi.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1"	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1"	ulxpmi.exe

Disables Task Manager via registry modification
evasion
Executes dropped EXE 1 IoCs

Processes:

ulxpmi.exe

pid process

4744 ulxpmi.exe

pid	process
4744	ulxpmi.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/432-131-0x00000000029F0000-0x0000000003A7E000-memory.dmp	upx
behavioral2/memory/432-132-0x00000000029F0000-0x0000000003A7E000-memory.dmp	upx
behavioral2/memory/432-139-0x00000000029F0000-0x0000000003A7E000-memory.dmp	upx
behavioral2/memory/4744-140-0x0000000002720000-0x00000000037AE000-memory.dmp	upx
behavioral2/memory/4744-142-0x0000000002720000-0x00000000037AE000-memory.dmp	upx
behavioral2/memory/4744-143-0x0000000002720000-0x00000000037AE000-memory.dmp	upx

Windows security modification 2 TTPs 14 IoCs

Disabling Security Tools

T1089

Modify Registry

Processes:

1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exeulxpmi.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	ulxpmi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	ulxpmi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	ulxpmi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	ulxpmi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	ulxpmi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	ulxpmi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	ulxpmi.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

ulxpmi.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\ulxpmi.exe"	ulxpmi.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

System Information Discovery

T1082

Processes:

1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exeulxpmi.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ulxpmi.exe

Drops file in Program Files directory 11 IoCs

Processes:

ulxpmi.exe

description	ioc	process
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zFM.exe	ulxpmi.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zG.exe	ulxpmi.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\Uninstall.exe	ulxpmi.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe	ulxpmi.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7z.exe	ulxpmi.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe	ulxpmi.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe	ulxpmi.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe	ulxpmi.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe	ulxpmi.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe	ulxpmi.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe	ulxpmi.exe

Drops file in Windows directory 1 IoCs

Processes:

1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe

description ioc process

File opened for modification C:\Windows\SYSTEM.INI 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\SYSTEM.INI	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

Processes:

1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exeulxpmi.exe

pid	process
432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
4744	ulxpmi.exe
4744	ulxpmi.exe
4744	ulxpmi.exe
4744	ulxpmi.exe
4744	ulxpmi.exe
4744	ulxpmi.exe
4744	ulxpmi.exe
4744	ulxpmi.exe
4744	ulxpmi.exe
4744	ulxpmi.exe
4744	ulxpmi.exe
4744	ulxpmi.exe
4744	ulxpmi.exe
4744	ulxpmi.exe
4744	ulxpmi.exe
4744	ulxpmi.exe
4744	ulxpmi.exe
4744	ulxpmi.exe
4744	ulxpmi.exe
4744	ulxpmi.exe
4744	ulxpmi.exe
4744	ulxpmi.exe
4744	ulxpmi.exe
4744	ulxpmi.exe
4744	ulxpmi.exe
4744	ulxpmi.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe

description	pid	process
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Token: SeDebugPrivilege	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exeulxpmi.exe

description	pid	process	target process
PID 432 wrote to memory of 776	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe	fontdrvhost.exe
PID 432 wrote to memory of 780	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe	fontdrvhost.exe
PID 432 wrote to memory of 328	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe	dwm.exe
PID 432 wrote to memory of 2340	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe	sihost.exe
PID 432 wrote to memory of 2352	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe	svchost.exe
PID 432 wrote to memory of 2472	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe	taskhostw.exe
PID 432 wrote to memory of 2408	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe	Explorer.EXE
PID 432 wrote to memory of 764	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe	svchost.exe
PID 432 wrote to memory of 3240	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe	DllHost.exe
PID 432 wrote to memory of 3396	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe	StartMenuExperienceHost.exe
PID 432 wrote to memory of 3464	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe	RuntimeBroker.exe
PID 432 wrote to memory of 3548	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe	SearchApp.exe
PID 432 wrote to memory of 3860	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe	RuntimeBroker.exe
PID 432 wrote to memory of 4396	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe	RuntimeBroker.exe
PID 432 wrote to memory of 4744	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe	ulxpmi.exe
PID 432 wrote to memory of 4744	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe	ulxpmi.exe
PID 432 wrote to memory of 4744	432	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe	ulxpmi.exe
PID 4744 wrote to memory of 776	4744	ulxpmi.exe	fontdrvhost.exe
PID 4744 wrote to memory of 780	4744	ulxpmi.exe	fontdrvhost.exe
PID 4744 wrote to memory of 328	4744	ulxpmi.exe	dwm.exe
PID 4744 wrote to memory of 2340	4744	ulxpmi.exe	sihost.exe
PID 4744 wrote to memory of 2352	4744	ulxpmi.exe	svchost.exe
PID 4744 wrote to memory of 2472	4744	ulxpmi.exe	taskhostw.exe
PID 4744 wrote to memory of 2408	4744	ulxpmi.exe	Explorer.EXE
PID 4744 wrote to memory of 764	4744	ulxpmi.exe	svchost.exe
PID 4744 wrote to memory of 3240	4744	ulxpmi.exe	DllHost.exe
PID 4744 wrote to memory of 3396	4744	ulxpmi.exe	StartMenuExperienceHost.exe
PID 4744 wrote to memory of 3464	4744	ulxpmi.exe	RuntimeBroker.exe
PID 4744 wrote to memory of 3548	4744	ulxpmi.exe	SearchApp.exe
PID 4744 wrote to memory of 3860	4744	ulxpmi.exe	RuntimeBroker.exe
PID 4744 wrote to memory of 4396	4744	ulxpmi.exe	RuntimeBroker.exe
PID 4744 wrote to memory of 776	4744	ulxpmi.exe	fontdrvhost.exe
PID 4744 wrote to memory of 780	4744	ulxpmi.exe	fontdrvhost.exe
PID 4744 wrote to memory of 328	4744	ulxpmi.exe	dwm.exe
PID 4744 wrote to memory of 2340	4744	ulxpmi.exe	sihost.exe
PID 4744 wrote to memory of 2352	4744	ulxpmi.exe	svchost.exe
PID 4744 wrote to memory of 2472	4744	ulxpmi.exe	taskhostw.exe
PID 4744 wrote to memory of 2408	4744	ulxpmi.exe	Explorer.EXE
PID 4744 wrote to memory of 764	4744	ulxpmi.exe	svchost.exe
PID 4744 wrote to memory of 3240	4744	ulxpmi.exe	DllHost.exe
PID 4744 wrote to memory of 3396	4744	ulxpmi.exe	StartMenuExperienceHost.exe
PID 4744 wrote to memory of 3464	4744	ulxpmi.exe	RuntimeBroker.exe
PID 4744 wrote to memory of 3548	4744	ulxpmi.exe	SearchApp.exe
PID 4744 wrote to memory of 3860	4744	ulxpmi.exe	RuntimeBroker.exe
PID 4744 wrote to memory of 4396	4744	ulxpmi.exe	RuntimeBroker.exe
PID 4744 wrote to memory of 776	4744	ulxpmi.exe	fontdrvhost.exe
PID 4744 wrote to memory of 780	4744	ulxpmi.exe	fontdrvhost.exe
PID 4744 wrote to memory of 328	4744	ulxpmi.exe	dwm.exe
PID 4744 wrote to memory of 2340	4744	ulxpmi.exe	sihost.exe
PID 4744 wrote to memory of 2352	4744	ulxpmi.exe	svchost.exe
PID 4744 wrote to memory of 2472	4744	ulxpmi.exe	taskhostw.exe
PID 4744 wrote to memory of 2408	4744	ulxpmi.exe	Explorer.EXE
PID 4744 wrote to memory of 764	4744	ulxpmi.exe	svchost.exe
PID 4744 wrote to memory of 3240	4744	ulxpmi.exe	DllHost.exe
PID 4744 wrote to memory of 3396	4744	ulxpmi.exe	StartMenuExperienceHost.exe
PID 4744 wrote to memory of 3464	4744	ulxpmi.exe	RuntimeBroker.exe
PID 4744 wrote to memory of 3548	4744	ulxpmi.exe	SearchApp.exe
PID 4744 wrote to memory of 3860	4744	ulxpmi.exe	RuntimeBroker.exe
PID 4744 wrote to memory of 4396	4744	ulxpmi.exe	RuntimeBroker.exe
PID 4744 wrote to memory of 776	4744	ulxpmi.exe	fontdrvhost.exe
PID 4744 wrote to memory of 780	4744	ulxpmi.exe	fontdrvhost.exe
PID 4744 wrote to memory of 328	4744	ulxpmi.exe	dwm.exe
PID 4744 wrote to memory of 2340	4744	ulxpmi.exe	sihost.exe
PID 4744 wrote to memory of 2352	4744	ulxpmi.exe	svchost.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

Processes:

1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exeulxpmi.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ulxpmi.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:776

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:328

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2340

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2472

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3464

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4396

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3860

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3548

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3396

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:764

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2408

C:\Users\Admin\AppData\Local\Temp\1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
"C:\Users\Admin\AppData\Local\Temp\1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe"
2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:432

C:\ProgramData\ulxpmi.exe
"C:\ProgramData\ulxpmi.exe"
3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2352

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:780

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control