darkcomet | ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869

Processes:

ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe

Modifies firewall policy service 2 TTPs 3 IoCs

evasion

Modify Registry

Modify Existing Service

T1031

Processes:

ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 1 IoCs

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry

Processes:

ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe

Windows security bypass 2 TTPs 6 IoCs

Disabling Security Tools

Modify Registry

Processes:

ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe

Drops file in Drivers directory 1 IoCs

Processes:

ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1900-55-0x00000000020B0000-0x000000000313E000-memory.dmp	upx
behavioral1/memory/1900-56-0x0000000000400000-0x0000000000504000-memory.dmp	upx
behavioral1/memory/1900-57-0x00000000020B0000-0x000000000313E000-memory.dmp	upx
behavioral1/memory/1900-59-0x0000000000400000-0x0000000000504000-memory.dmp	upx
behavioral1/memory/1900-60-0x00000000020B0000-0x000000000313E000-memory.dmp	upx

Windows security modification 2 TTPs 7 IoCs

Disabling Security Tools

Modify Registry

Processes:

ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

System Information Discovery

T1082

Processes:

ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe

Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe

description ioc process

File opened (read-only) \??\E: ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Drops file in Windows directory 1 IoCs

Processes:

ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe

description ioc process

File opened for modification C:\Windows\SYSTEM.INI ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened (read-only)	\??\E:	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe

description	ioc	process
File opened for modification	C:\Windows\SYSTEM.INI	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe

pid	process
1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe

Suspicious behavior: MapViewOfSection 21 IoCs

Processes:

ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe

pid	process
1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

Processes:

ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe

description	pid	process
Token: SeDebugPrivilege	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Token: SeDebugPrivilege	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Token: SeDebugPrivilege	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Token: SeDebugPrivilege	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Token: SeDebugPrivilege	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Token: SeDebugPrivilege	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Token: SeDebugPrivilege	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Token: SeDebugPrivilege	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Token: SeDebugPrivilege	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Token: SeDebugPrivilege	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Token: SeDebugPrivilege	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Token: SeDebugPrivilege	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Token: SeDebugPrivilege	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Token: SeDebugPrivilege	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Token: SeDebugPrivilege	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Token: SeDebugPrivilege	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Token: SeDebugPrivilege	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Token: SeDebugPrivilege	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Token: SeDebugPrivilege	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Token: SeDebugPrivilege	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Token: SeDebugPrivilege	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Token: SeIncreaseQuotaPrivilege	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Token: SeSecurityPrivilege	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Token: SeTakeOwnershipPrivilege	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Token: SeLoadDriverPrivilege	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Token: SeSystemProfilePrivilege	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Token: SeSystemtimePrivilege	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Token: SeProfSingleProcessPrivilege	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Token: SeIncBasePriorityPrivilege	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Token: SeCreatePagefilePrivilege	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Token: SeBackupPrivilege	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Token: SeRestorePrivilege	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Token: SeShutdownPrivilege	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Token: SeDebugPrivilege	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Token: SeSystemEnvironmentPrivilege	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Token: SeChangeNotifyPrivilege	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Token: SeRemoteShutdownPrivilege	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Token: SeUndockPrivilege	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Token: SeManageVolumePrivilege	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Token: SeImpersonatePrivilege	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Token: SeCreateGlobalPrivilege	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Token: 33	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Token: 34	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
Token: 35	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe

description	pid	process	target process
PID 1900 wrote to memory of 1240	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	taskhost.exe
PID 1900 wrote to memory of 1336	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	Dwm.exe
PID 1900 wrote to memory of 1392	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	Explorer.EXE
PID 1900 wrote to memory of 372	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	wininit.exe
PID 1900 wrote to memory of 372	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	wininit.exe
PID 1900 wrote to memory of 372	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	wininit.exe
PID 1900 wrote to memory of 372	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	wininit.exe
PID 1900 wrote to memory of 372	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	wininit.exe
PID 1900 wrote to memory of 372	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	wininit.exe
PID 1900 wrote to memory of 384	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	csrss.exe
PID 1900 wrote to memory of 384	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	csrss.exe
PID 1900 wrote to memory of 384	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	csrss.exe
PID 1900 wrote to memory of 384	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	csrss.exe
PID 1900 wrote to memory of 384	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	csrss.exe
PID 1900 wrote to memory of 384	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	csrss.exe
PID 1900 wrote to memory of 420	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	winlogon.exe
PID 1900 wrote to memory of 420	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	winlogon.exe
PID 1900 wrote to memory of 420	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	winlogon.exe
PID 1900 wrote to memory of 420	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	winlogon.exe
PID 1900 wrote to memory of 420	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	winlogon.exe
PID 1900 wrote to memory of 420	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	winlogon.exe
PID 1900 wrote to memory of 464	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	services.exe
PID 1900 wrote to memory of 464	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	services.exe
PID 1900 wrote to memory of 464	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	services.exe
PID 1900 wrote to memory of 464	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	services.exe
PID 1900 wrote to memory of 464	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	services.exe
PID 1900 wrote to memory of 464	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	services.exe
PID 1900 wrote to memory of 480	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	lsass.exe
PID 1900 wrote to memory of 480	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	lsass.exe
PID 1900 wrote to memory of 480	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	lsass.exe
PID 1900 wrote to memory of 480	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	lsass.exe
PID 1900 wrote to memory of 480	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	lsass.exe
PID 1900 wrote to memory of 480	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	lsass.exe
PID 1900 wrote to memory of 488	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	lsm.exe
PID 1900 wrote to memory of 488	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	lsm.exe
PID 1900 wrote to memory of 488	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	lsm.exe
PID 1900 wrote to memory of 488	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	lsm.exe
PID 1900 wrote to memory of 488	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	lsm.exe
PID 1900 wrote to memory of 488	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	lsm.exe
PID 1900 wrote to memory of 584	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	svchost.exe
PID 1900 wrote to memory of 584	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	svchost.exe
PID 1900 wrote to memory of 584	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	svchost.exe
PID 1900 wrote to memory of 584	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	svchost.exe
PID 1900 wrote to memory of 584	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	svchost.exe
PID 1900 wrote to memory of 584	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	svchost.exe
PID 1900 wrote to memory of 660	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	svchost.exe
PID 1900 wrote to memory of 660	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	svchost.exe
PID 1900 wrote to memory of 660	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	svchost.exe
PID 1900 wrote to memory of 660	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	svchost.exe
PID 1900 wrote to memory of 660	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	svchost.exe
PID 1900 wrote to memory of 660	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	svchost.exe
PID 1900 wrote to memory of 716	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	svchost.exe
PID 1900 wrote to memory of 716	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	svchost.exe
PID 1900 wrote to memory of 716	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	svchost.exe
PID 1900 wrote to memory of 716	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	svchost.exe
PID 1900 wrote to memory of 716	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	svchost.exe
PID 1900 wrote to memory of 716	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	svchost.exe
PID 1900 wrote to memory of 792	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	svchost.exe
PID 1900 wrote to memory of 792	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	svchost.exe
PID 1900 wrote to memory of 792	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	svchost.exe
PID 1900 wrote to memory of 792	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	svchost.exe
PID 1900 wrote to memory of 792	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	svchost.exe
PID 1900 wrote to memory of 792	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	svchost.exe
PID 1900 wrote to memory of 828	1900	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe	svchost.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

Processes:

ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:480

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:464

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
2⤵
PID:716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
2⤵
PID:868

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
3⤵
PID:2004

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
2⤵
PID:1128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
2⤵
PID:1780

C:\Windows\system32\taskhost.exe
"taskhost.exe"
2⤵
PID:1240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
2⤵
PID:1028

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
2⤵
PID:276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
2⤵
PID:296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
2⤵
PID:828

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
2⤵
PID:792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
2⤵
PID:660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
2⤵
PID:584

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:384

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:372

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
2⤵
PID:488

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1336

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1392

C:\Users\Admin\AppData\Local\Temp\ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe
"C:\Users\Admin\AppData\Local\Temp\ea34aaf09821e3744aa26872b019bcd0b5174a1a901fa17863b2c8ae6b92b869.exe"
2⤵
- Modifies WinLogon for persistence
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Drops file in Drivers directory
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1900

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Modify Registry

7

Bypass User Account Control

T1088

Disabling Security Tools

3

Credential Access

Discovery

System Information Discovery

3

T1082

Query Registry

T1012

Peripheral Device Discovery