sality | 25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890

Modify Existing Service

T1031

Processes:

25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 1 IoCs

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

Processes:

25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe

Windows security bypass 2 TTPs 6 IoCs

Disabling Security Tools

T1089

Modify Registry

Processes:

25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\AppDataLow = "C:\\Users\\Admin\\AppData\\Roaming\\92B0EA.exe"	svchost.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3244-130-0x0000000000870000-0x00000000018FE000-memory.dmp	upx
behavioral2/memory/3244-132-0x0000000000870000-0x00000000018FE000-memory.dmp	upx
behavioral2/memory/3244-135-0x0000000000870000-0x00000000018FE000-memory.dmp	upx

Windows security modification 2 TTPs 7 IoCs

Disabling Security Tools

T1089

Modify Registry

Processes:

25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

System Information Discovery

Processes:

25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe

Enumerates connected drives 3 TTPs 5 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe

description	ioc	process
File opened (read-only)	\??\H:	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
File opened (read-only)	\??\I:	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
File opened (read-only)	\??\E:	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
File opened (read-only)	\??\F:	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
File opened (read-only)	\??\G:	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe

Drops file in Windows directory 1 IoCs

Processes:

25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe

description ioc process

File opened for modification C:\Windows\SYSTEM.INI 25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe

description	ioc	process
File opened for modification	C:\Windows\SYSTEM.INI	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe

pid	process
3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe

pid	process
3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe

description	pid	process
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
Token: SeDebugPrivilege	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe

description	pid	process	target process
PID 3244 wrote to memory of 808	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe	fontdrvhost.exe
PID 3244 wrote to memory of 816	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe	fontdrvhost.exe
PID 3244 wrote to memory of 312	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe	dwm.exe
PID 3244 wrote to memory of 2708	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe	sihost.exe
PID 3244 wrote to memory of 2812	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe	svchost.exe
PID 3244 wrote to memory of 2924	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe	taskhostw.exe
PID 3244 wrote to memory of 2952	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe	Explorer.EXE
PID 3244 wrote to memory of 3212	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe	svchost.exe
PID 3244 wrote to memory of 3400	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe	DllHost.exe
PID 3244 wrote to memory of 3488	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe	StartMenuExperienceHost.exe
PID 3244 wrote to memory of 3556	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe	RuntimeBroker.exe
PID 3244 wrote to memory of 3640	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe	SearchApp.exe
PID 3244 wrote to memory of 3872	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe	RuntimeBroker.exe
PID 3244 wrote to memory of 3992	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe	svchost.exe
PID 3244 wrote to memory of 3992	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe	svchost.exe
PID 3244 wrote to memory of 3992	3244	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe	svchost.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

Processes:

25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:808

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:312

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:816

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2812

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2924

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2952

C:\Users\Admin\AppData\Local\Temp\25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe
"C:\Users\Admin\AppData\Local\Temp\25aaeb30fb9b9eb36b042d44680a61b0513baf2a07021d3e04b73c2d0b5a4890.exe"
2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Maps connected drives based on registry
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3244

C:\Windows\SysWOW64\svchost.exe
svchost.exe
3⤵
- Adds policy Run key to start application
PID:3992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3212

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3400

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3488

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3556

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3640

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3872

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3