diamondfox | 48357e221b1e06c02805694894b00da3042087d2144f303f11e1ca8a3e5e701e

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe

Windows security bypass 2 TTPs 1 IoCs

Disabling Security Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0"	spoolsv.exe

Executes dropped EXE 2 IoCs

pid	Process
5092	spoolsv.exe
2696	spoolsv.exe

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spoolsv.exe	spoolsv.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.vbs	48357e221b1e06c02805694894b00da3042087d2144f303f11e1ca8a3e5e701e.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.vbs	spoolsv.exe

Windows security modification 2 TTPs 1 IoCs

Disabling Security Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0"	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows\CurrentVersion\run	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "C:\\Users\\Admin\\AppData\\Roaming\\lpt2.{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\spoolsv.exe"	spoolsv.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3632	48357e221b1e06c02805694894b00da3042087d2144f303f11e1ca8a3e5e701e.exe
4888	48357e221b1e06c02805694894b00da3042087d2144f303f11e1ca8a3e5e701e.exe
5092	spoolsv.exe
2696	spoolsv.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3632 wrote to memory of 4888	3632	48357e221b1e06c02805694894b00da3042087d2144f303f11e1ca8a3e5e701e.exe	81
PID 3632 wrote to memory of 4888	3632	48357e221b1e06c02805694894b00da3042087d2144f303f11e1ca8a3e5e701e.exe	81
PID 3632 wrote to memory of 4888	3632	48357e221b1e06c02805694894b00da3042087d2144f303f11e1ca8a3e5e701e.exe	81
PID 3632 wrote to memory of 4888	3632	48357e221b1e06c02805694894b00da3042087d2144f303f11e1ca8a3e5e701e.exe	81
PID 3632 wrote to memory of 4888	3632	48357e221b1e06c02805694894b00da3042087d2144f303f11e1ca8a3e5e701e.exe	81
PID 3632 wrote to memory of 4888	3632	48357e221b1e06c02805694894b00da3042087d2144f303f11e1ca8a3e5e701e.exe	81
PID 3632 wrote to memory of 4888	3632	48357e221b1e06c02805694894b00da3042087d2144f303f11e1ca8a3e5e701e.exe	81
PID 3632 wrote to memory of 4888	3632	48357e221b1e06c02805694894b00da3042087d2144f303f11e1ca8a3e5e701e.exe	81
PID 3632 wrote to memory of 4888	3632	48357e221b1e06c02805694894b00da3042087d2144f303f11e1ca8a3e5e701e.exe	81
PID 3632 wrote to memory of 4888	3632	48357e221b1e06c02805694894b00da3042087d2144f303f11e1ca8a3e5e701e.exe	81
PID 3632 wrote to memory of 4888	3632	48357e221b1e06c02805694894b00da3042087d2144f303f11e1ca8a3e5e701e.exe	81
PID 3632 wrote to memory of 4888	3632	48357e221b1e06c02805694894b00da3042087d2144f303f11e1ca8a3e5e701e.exe	81
PID 3632 wrote to memory of 4888	3632	48357e221b1e06c02805694894b00da3042087d2144f303f11e1ca8a3e5e701e.exe	81
PID 3632 wrote to memory of 4888	3632	48357e221b1e06c02805694894b00da3042087d2144f303f11e1ca8a3e5e701e.exe	81
PID 3632 wrote to memory of 4888	3632	48357e221b1e06c02805694894b00da3042087d2144f303f11e1ca8a3e5e701e.exe	81
PID 4888 wrote to memory of 5092	4888	48357e221b1e06c02805694894b00da3042087d2144f303f11e1ca8a3e5e701e.exe	82
PID 4888 wrote to memory of 5092	4888	48357e221b1e06c02805694894b00da3042087d2144f303f11e1ca8a3e5e701e.exe	82
PID 4888 wrote to memory of 5092	4888	48357e221b1e06c02805694894b00da3042087d2144f303f11e1ca8a3e5e701e.exe	82
PID 4888 wrote to memory of 436	4888	48357e221b1e06c02805694894b00da3042087d2144f303f11e1ca8a3e5e701e.exe	83
PID 4888 wrote to memory of 436	4888	48357e221b1e06c02805694894b00da3042087d2144f303f11e1ca8a3e5e701e.exe	83
PID 4888 wrote to memory of 436	4888	48357e221b1e06c02805694894b00da3042087d2144f303f11e1ca8a3e5e701e.exe	83
PID 5092 wrote to memory of 2696	5092	spoolsv.exe	85
PID 5092 wrote to memory of 2696	5092	spoolsv.exe	85
PID 5092 wrote to memory of 2696	5092	spoolsv.exe	85
PID 5092 wrote to memory of 2696	5092	spoolsv.exe	85
PID 5092 wrote to memory of 2696	5092	spoolsv.exe	85
PID 5092 wrote to memory of 2696	5092	spoolsv.exe	85
PID 5092 wrote to memory of 2696	5092	spoolsv.exe	85
PID 5092 wrote to memory of 2696	5092	spoolsv.exe	85
PID 5092 wrote to memory of 2696	5092	spoolsv.exe	85
PID 5092 wrote to memory of 2696	5092	spoolsv.exe	85
PID 5092 wrote to memory of 2696	5092	spoolsv.exe	85
PID 5092 wrote to memory of 2696	5092	spoolsv.exe	85
PID 5092 wrote to memory of 2696	5092	spoolsv.exe	85
PID 5092 wrote to memory of 2696	5092	spoolsv.exe	85
PID 5092 wrote to memory of 2696	5092	spoolsv.exe	85

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe

C:\Users\Admin\AppData\Local\Temp\48357e221b1e06c02805694894b00da3042087d2144f303f11e1ca8a3e5e701e.exe
"C:\Users\Admin\AppData\Local\Temp\48357e221b1e06c02805694894b00da3042087d2144f303f11e1ca8a3e5e701e.exe"
1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3632
- C:\Users\Admin\AppData\Local\Temp\48357e221b1e06c02805694894b00da3042087d2144f303f11e1ca8a3e5e701e.exe
  "C:\Users\Admin\AppData\Local\Temp\48357e221b1e06c02805694894b00da3042087d2144f303f11e1ca8a3e5e701e.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4888
- - C:\Users\Admin\AppData\Roaming\lpt2.{20D04FE0-3AEA-1069-A2D8-08002B30309D}\spoolsv.exe
    C:\Users\Admin\AppData\Roaming\lpt2.{20D04FE0-3AEA-1069-A2D8-08002B30309D}\spoolsv.exe
    3⤵
    - Executes dropped EXE
    - Drops startup file
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5092
  - - C:\Users\Admin\AppData\Roaming\lpt2.{20D04FE0-3AEA-1069-A2D8-08002B30309D}\spoolsv.exe
      C:\Users\Admin\AppData\Roaming\lpt2.{20D04FE0-3AEA-1069-A2D8-08002B30309D}\spoolsv.exe
      4⤵
      UAC bypass
      Windows security bypass
      Executes dropped EXE
      Drops startup file
      Windows security modification
      Adds Run key to start application
      Checks whether UAC is enabled
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:2696
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\80016A89.cmd
    3⤵
    PID:436

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry