adwind | 2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35

Modify Existing Service

T1031

Processes:

2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 1 IoCs

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry

Processes:

2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe

Windows security bypass 2 TTPs 6 IoCs

Disabling Security Tools

Modify Registry

Processes:

2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1"	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe

Disables Task Manager via registry modification
evasion
Executes dropped EXE 2 IoCs

Processes:

server.exe925build.exe

pid process

1788 server.exe
556 925build.exe

pid	process
1788	server.exe
556	925build.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

server.exesvchost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{0L8DLR46-D5LC-R160-XP8P-0D5C066657D0}	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0L8DLR46-D5LC-R160-XP8P-0D5C066657D0}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{0L8DLR46-D5LC-R160-XP8P-0D5C066657D0}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0L8DLR46-D5LC-R160-XP8P-0D5C066657D0}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	svchost.exe

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1680-55-0x0000000000400000-0x0000000000728000-memory.dmp	upx
behavioral1/memory/1680-61-0x0000000000400000-0x0000000000728000-memory.dmp	upx
behavioral1/memory/1440-63-0x00000000005C0000-0x000000000164E000-memory.dmp	upx
behavioral1/memory/1440-64-0x00000000005C0000-0x000000000164E000-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\server.exe	upx
\Users\Admin\AppData\Local\Temp\server.exe	upx
\Users\Admin\AppData\Local\Temp\server.exe	upx
\Users\Admin\AppData\Local\Temp\server.exe	upx
C:\Users\Admin\AppData\Local\Temp\server.exe	upx
behavioral1/memory/1440-79-0x00000000005C0000-0x000000000164E000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\server.exe	upx
behavioral1/memory/1788-92-0x0000000000C80000-0x0000000000CB8000-memory.dmp	upx
C:\Windows\InstallDir\Server.exe	upx
behavioral1/memory/1740-109-0x0000000000C80000-0x0000000000CB8000-memory.dmp	upx
behavioral1/memory/1788-120-0x0000000000C80000-0x0000000000CB8000-memory.dmp	upx

Drops startup file 2 IoCs

Processes:

2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe

Loads dropped DLL 6 IoCs

Processes:

2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exeserver.exe

pid	process
1440	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe
1440	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe
1440	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe
1440	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe
1788	server.exe
1788	server.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 7 IoCs

Disabling Security Tools

Modify Registry

Processes:

2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

925build.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	925build.exe
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	925build.exe
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	925build.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

svchost.exeserver.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	server.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run	server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	svchost.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

System Information Discovery

T1082

Processes:

2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe

description	pid	process	target process
PID 1680 set thread context of 1440	1680	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe

Drops file in Windows directory 4 IoCs

Processes:

server.exe2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe

description	ioc	process
File created	C:\Windows\InstallDir\Server.exe	server.exe
File opened for modification	C:\Windows\InstallDir\	server.exe
File opened for modification	C:\Windows\SYSTEM.INI	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe

pid process

1440 2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe

description	pid	process
Token: SeDebugPrivilege	1440	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe
Token: SeDebugPrivilege	1440	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe
Token: SeDebugPrivilege	1440	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe
Token: SeDebugPrivilege	1440	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe
Token: SeDebugPrivilege	1440	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe
Token: SeDebugPrivilege	1440	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe
Token: SeDebugPrivilege	1440	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe
Token: SeDebugPrivilege	1440	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe
Token: SeDebugPrivilege	1440	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe
Token: SeDebugPrivilege	1440	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe
Token: SeDebugPrivilege	1440	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe
Token: SeDebugPrivilege	1440	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe
Token: SeDebugPrivilege	1440	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe
Token: SeDebugPrivilege	1440	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe
Token: SeDebugPrivilege	1440	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe
Token: SeDebugPrivilege	1440	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe
Token: SeDebugPrivilege	1440	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe
Token: SeDebugPrivilege	1440	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe
Token: SeDebugPrivilege	1440	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe
Token: SeDebugPrivilege	1440	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe
Token: SeDebugPrivilege	1440	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

explorer.exejavaw.exe

pid process

1740 explorer.exe
1720 javaw.exe

pid	process
1740	explorer.exe
1720	javaw.exe

Suspicious use of WriteProcessMemory 47 IoCs

Processes:

2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exeserver.exejavaw.execmd.exe

description	pid	process	target process
PID 1680 wrote to memory of 1440	1680	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe
PID 1680 wrote to memory of 1440	1680	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe
PID 1680 wrote to memory of 1440	1680	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe
PID 1680 wrote to memory of 1440	1680	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe
PID 1680 wrote to memory of 1440	1680	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe
PID 1680 wrote to memory of 1440	1680	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe
PID 1440 wrote to memory of 1132	1440	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe	taskhost.exe
PID 1440 wrote to memory of 1204	1440	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe	Dwm.exe
PID 1440 wrote to memory of 1252	1440	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe	Explorer.EXE
PID 1440 wrote to memory of 1720	1440	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe	javaw.exe
PID 1440 wrote to memory of 1720	1440	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe	javaw.exe
PID 1440 wrote to memory of 1720	1440	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe	javaw.exe
PID 1440 wrote to memory of 1720	1440	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe	javaw.exe
PID 1440 wrote to memory of 1788	1440	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe	server.exe
PID 1440 wrote to memory of 1788	1440	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe	server.exe
PID 1440 wrote to memory of 1788	1440	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe	server.exe
PID 1440 wrote to memory of 1788	1440	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe	server.exe
PID 1788 wrote to memory of 388	1788	server.exe	svchost.exe
PID 1788 wrote to memory of 388	1788	server.exe	svchost.exe
PID 1788 wrote to memory of 388	1788	server.exe	svchost.exe
PID 1788 wrote to memory of 388	1788	server.exe	svchost.exe
PID 1788 wrote to memory of 388	1788	server.exe	svchost.exe
PID 1788 wrote to memory of 560	1788	server.exe	iexplore.exe
PID 1788 wrote to memory of 560	1788	server.exe	iexplore.exe
PID 1788 wrote to memory of 560	1788	server.exe	iexplore.exe
PID 1788 wrote to memory of 560	1788	server.exe	iexplore.exe
PID 1788 wrote to memory of 1740	1788	server.exe	explorer.exe
PID 1788 wrote to memory of 1740	1788	server.exe	explorer.exe
PID 1788 wrote to memory of 1740	1788	server.exe	explorer.exe
PID 1788 wrote to memory of 1740	1788	server.exe	explorer.exe
PID 1720 wrote to memory of 1048	1720	javaw.exe	java.exe
PID 1720 wrote to memory of 1048	1720	javaw.exe	java.exe
PID 1720 wrote to memory of 1048	1720	javaw.exe	java.exe
PID 1788 wrote to memory of 1740	1788	server.exe	explorer.exe
PID 1788 wrote to memory of 556	1788	server.exe	925build.exe
PID 1788 wrote to memory of 556	1788	server.exe	925build.exe
PID 1788 wrote to memory of 556	1788	server.exe	925build.exe
PID 1788 wrote to memory of 556	1788	server.exe	925build.exe
PID 1720 wrote to memory of 1448	1720	javaw.exe	cmd.exe
PID 1720 wrote to memory of 1448	1720	javaw.exe	cmd.exe
PID 1720 wrote to memory of 1448	1720	javaw.exe	cmd.exe
PID 1448 wrote to memory of 1520	1448	cmd.exe	cscript.exe
PID 1448 wrote to memory of 1520	1448	cmd.exe	cscript.exe
PID 1448 wrote to memory of 1520	1448	cmd.exe	cscript.exe
PID 1720 wrote to memory of 1972	1720	javaw.exe	cmd.exe
PID 1720 wrote to memory of 1972	1720	javaw.exe	cmd.exe
PID 1720 wrote to memory of 1972	1720	javaw.exe	cmd.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

Processes:

2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe

outlook_office_path 1 IoCs

Processes:

925build.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	925build.exe

outlook_win_path 1 IoCs

Processes:

925build.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	925build.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1252

C:\Users\Admin\AppData\Local\Temp\2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe
"C:\Users\Admin\AppData\Local\Temp\2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe"
2⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1680

C:\Users\Admin\AppData\Local\Temp\2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe
"C:\Users\Admin\AppData\Local\Temp\2e6ed3d8b26ba87c304e0adf7b6244ac382a33fff95f22fab4c72b911601fc35.exe"
3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1440

C:\Program Files\Java\jre7\bin\javaw.exe
"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\uvum.jar"
4⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720

C:\Program Files\Java\jre7\bin\java.exe
"C:\Program Files\Java\jre7\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.20774946471079086456299629199630873.class
5⤵
PID:1048

C:\Windows\system32\cmd.exe
cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive2650949230723262349.vbs
5⤵
- Suspicious use of WriteProcessMemory
PID:1448

C:\Windows\system32\cscript.exe
cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive2650949230723262349.vbs
6⤵
PID:1520

C:\Windows\system32\cmd.exe
cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive1334231139795262594.vbs
5⤵
PID:1972

C:\Windows\system32\cscript.exe
cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive1334231139795262594.vbs
6⤵
PID:852

C:\Users\Admin\AppData\Local\Temp\server.exe
"C:\Users\Admin\AppData\Local\Temp\server.exe"
4⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1788

C:\Windows\SysWOW64\svchost.exe
svchost.exe
5⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
PID:388

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:560

C:\Windows\SysWOW64\explorer.exe
explorer.exe
5⤵
- Suspicious use of SetWindowsHookEx
PID:1740

C:\Users\Admin\AppData\Local\Temp\925build.exe
"C:\Users\Admin\AppData\Local\Temp\925build.exe"
5⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:556

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1204

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1132

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Modify Registry

Bypass User Account Control

T1088

Disabling Security Tools