darkcomet | e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Users\\Admin\\AppData\\Roaming\\G9hdquLc\\VHExTPh.exe,explorer.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Users\\Admin\\AppData\\Roaming\\G9hdquLc\\VHExTPh.exe,explorer.exe"	reg.exe

Modifies firewall policy service 2 TTPs 3 IoCs

Modify Registry

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe

Modifies security service 2 TTPs 1 IoCs

Modify Registry

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe

Executes dropped EXE 5 IoCs

pid	Process
1916	CryptService.exe.exe
616	msdcsc.exe
1920	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
1992	msdcsc.exe
1188	CryptService.exe.exe

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

Hidden Files and Directories

pid	Process
1940	attrib.exe
672	attrib.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0008000000012326-78.dat	upx
behavioral1/files/0x0008000000012326-79.dat	upx
behavioral1/files/0x0008000000012326-81.dat	upx
behavioral1/files/0x0008000000012326-84.dat	upx
behavioral1/memory/1916-93-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/1916-123-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/files/0x0008000000012326-153.dat	upx
behavioral1/files/0x0008000000012326-152.dat	upx
behavioral1/files/0x0008000000012326-155.dat	upx
behavioral1/memory/1188-158-0x0000000000400000-0x00000000004B7000-memory.dmp	upx

Loads dropped DLL 8 IoCs

pid	Process
1668	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
1668	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
1668	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
988	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
1668	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
616	msdcsc.exe
616	msdcsc.exe
616	msdcsc.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1668 set thread context of 988	1668	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	31
PID 1668 set thread context of 1920	1668	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	40
PID 616 set thread context of 1992	616	msdcsc.exe	45

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1668	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
1668	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
1668	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
616	msdcsc.exe
616	msdcsc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1668	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Token: SeIncreaseQuotaPrivilege	1916	CryptService.exe.exe
Token: SeSecurityPrivilege	1916	CryptService.exe.exe
Token: SeTakeOwnershipPrivilege	1916	CryptService.exe.exe
Token: SeLoadDriverPrivilege	1916	CryptService.exe.exe
Token: SeSystemProfilePrivilege	1916	CryptService.exe.exe
Token: SeSystemtimePrivilege	1916	CryptService.exe.exe
Token: SeProfSingleProcessPrivilege	1916	CryptService.exe.exe
Token: SeIncBasePriorityPrivilege	1916	CryptService.exe.exe
Token: SeCreatePagefilePrivilege	1916	CryptService.exe.exe
Token: SeBackupPrivilege	1916	CryptService.exe.exe
Token: SeRestorePrivilege	1916	CryptService.exe.exe
Token: SeShutdownPrivilege	1916	CryptService.exe.exe
Token: SeDebugPrivilege	1916	CryptService.exe.exe
Token: SeSystemEnvironmentPrivilege	1916	CryptService.exe.exe
Token: SeChangeNotifyPrivilege	1916	CryptService.exe.exe
Token: SeRemoteShutdownPrivilege	1916	CryptService.exe.exe
Token: SeUndockPrivilege	1916	CryptService.exe.exe
Token: SeManageVolumePrivilege	1916	CryptService.exe.exe
Token: SeImpersonatePrivilege	1916	CryptService.exe.exe
Token: SeCreateGlobalPrivilege	1916	CryptService.exe.exe
Token: 33	1916	CryptService.exe.exe
Token: 34	1916	CryptService.exe.exe
Token: 35	1916	CryptService.exe.exe
Token: SeIncreaseQuotaPrivilege	988	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Token: SeSecurityPrivilege	988	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Token: SeTakeOwnershipPrivilege	988	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Token: SeLoadDriverPrivilege	988	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Token: SeSystemProfilePrivilege	988	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Token: SeSystemtimePrivilege	988	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Token: SeProfSingleProcessPrivilege	988	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Token: SeIncBasePriorityPrivilege	988	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Token: SeCreatePagefilePrivilege	988	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Token: SeBackupPrivilege	988	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Token: SeRestorePrivilege	988	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Token: SeShutdownPrivilege	988	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Token: SeDebugPrivilege	988	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Token: SeSystemEnvironmentPrivilege	988	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Token: SeChangeNotifyPrivilege	988	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Token: SeRemoteShutdownPrivilege	988	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Token: SeUndockPrivilege	988	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Token: SeManageVolumePrivilege	988	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Token: SeImpersonatePrivilege	988	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Token: SeCreateGlobalPrivilege	988	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Token: 33	988	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Token: 34	988	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Token: 35	988	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Token: SeIncreaseQuotaPrivilege	1920	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Token: SeSecurityPrivilege	1920	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Token: SeTakeOwnershipPrivilege	1920	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Token: SeLoadDriverPrivilege	1920	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Token: SeSystemProfilePrivilege	1920	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Token: SeSystemtimePrivilege	1920	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Token: SeProfSingleProcessPrivilege	1920	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Token: SeIncBasePriorityPrivilege	1920	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Token: SeCreatePagefilePrivilege	1920	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Token: SeBackupPrivilege	1920	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Token: SeRestorePrivilege	1920	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Token: SeShutdownPrivilege	1920	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Token: SeDebugPrivilege	1920	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Token: SeSystemEnvironmentPrivilege	1920	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Token: SeChangeNotifyPrivilege	1920	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Token: SeRemoteShutdownPrivilege	1920	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Token: SeUndockPrivilege	1920	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1916	CryptService.exe.exe
1920	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 1740	1668	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	28
PID 1668 wrote to memory of 1740	1668	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	28
PID 1668 wrote to memory of 1740	1668	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	28
PID 1668 wrote to memory of 1740	1668	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	28
PID 1740 wrote to memory of 956	1740	cmd.exe	30
PID 1740 wrote to memory of 956	1740	cmd.exe	30
PID 1740 wrote to memory of 956	1740	cmd.exe	30
PID 1740 wrote to memory of 956	1740	cmd.exe	30
PID 1668 wrote to memory of 988	1668	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	31
PID 1668 wrote to memory of 988	1668	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	31
PID 1668 wrote to memory of 988	1668	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	31
PID 1668 wrote to memory of 988	1668	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	31
PID 1668 wrote to memory of 988	1668	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	31
PID 1668 wrote to memory of 988	1668	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	31
PID 1668 wrote to memory of 988	1668	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	31
PID 1668 wrote to memory of 988	1668	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	31
PID 1668 wrote to memory of 988	1668	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	31
PID 1668 wrote to memory of 988	1668	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	31
PID 1668 wrote to memory of 988	1668	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	31
PID 1668 wrote to memory of 988	1668	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	31
PID 1668 wrote to memory of 988	1668	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	31
PID 1668 wrote to memory of 1916	1668	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	32
PID 1668 wrote to memory of 1916	1668	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	32
PID 1668 wrote to memory of 1916	1668	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	32
PID 1668 wrote to memory of 1916	1668	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	32
PID 988 wrote to memory of 1200	988	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	33
PID 988 wrote to memory of 1200	988	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	33
PID 988 wrote to memory of 1200	988	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	33
PID 988 wrote to memory of 1200	988	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	33
PID 988 wrote to memory of 824	988	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	34
PID 988 wrote to memory of 824	988	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	34
PID 988 wrote to memory of 824	988	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	34
PID 988 wrote to memory of 824	988	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	34
PID 1200 wrote to memory of 1940	1200	cmd.exe	37
PID 1200 wrote to memory of 1940	1200	cmd.exe	37
PID 1200 wrote to memory of 1940	1200	cmd.exe	37
PID 1200 wrote to memory of 1940	1200	cmd.exe	37
PID 824 wrote to memory of 672	824	cmd.exe	38
PID 824 wrote to memory of 672	824	cmd.exe	38
PID 824 wrote to memory of 672	824	cmd.exe	38
PID 824 wrote to memory of 672	824	cmd.exe	38
PID 988 wrote to memory of 616	988	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	39
PID 988 wrote to memory of 616	988	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	39
PID 988 wrote to memory of 616	988	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	39
PID 988 wrote to memory of 616	988	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	39
PID 1668 wrote to memory of 1920	1668	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	40
PID 1668 wrote to memory of 1920	1668	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	40
PID 1668 wrote to memory of 1920	1668	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	40
PID 1668 wrote to memory of 1920	1668	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	40
PID 1668 wrote to memory of 1920	1668	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	40
PID 1668 wrote to memory of 1920	1668	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	40
PID 1668 wrote to memory of 1920	1668	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	40
PID 1668 wrote to memory of 1920	1668	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	40
PID 1668 wrote to memory of 1920	1668	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	40
PID 1668 wrote to memory of 1920	1668	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	40
PID 1668 wrote to memory of 1920	1668	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	40
PID 1668 wrote to memory of 1920	1668	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	40
PID 1668 wrote to memory of 1920	1668	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	40
PID 1920 wrote to memory of 1564	1920	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	41
PID 1920 wrote to memory of 1564	1920	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	41
PID 1920 wrote to memory of 1564	1920	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	41
PID 1920 wrote to memory of 1564	1920	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	41
PID 1920 wrote to memory of 1564	1920	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	41
PID 1920 wrote to memory of 1564	1920	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe	41

System policy modification 1 TTPs 3 IoCs

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1"	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion	e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe

Views/modifies file attributes 1 TTPs 2 IoCs

Hidden Files and Directories

pid	Process
1940	attrib.exe
672	attrib.exe

C:\Users\Admin\AppData\Local\Temp\e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
"C:\Users\Admin\AppData\Local\Temp\e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v shell /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\G9hdquLc\VHExTPh.exe,explorer.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v shell /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\G9hdquLc\VHExTPh.exe,explorer.exe"
    3⤵
    - Modifies WinLogon for persistence
    PID:956
- C:\Users\Admin\AppData\Local\Temp\e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
  "C:\Users\Admin\AppData\Local\Temp\e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:988
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe" +s +h
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1200
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Users\Admin\AppData\Local\Temp\e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe" +s +h
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:1940
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:824
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:672
- - C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
    "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    PID:616
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v shell /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\G9hdquLc\VHExTPh.exe,explorer.exe"
      4⤵
      PID:1392
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v shell /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\G9hdquLc\VHExTPh.exe,explorer.exe"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1912
  - - C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
      "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
      4⤵
      Executes dropped EXE
      PID:1992
  - - C:\Users\Admin\AppData\Local\Temp\CryptService.exe.exe
      "C:\Users\Admin\AppData\Local\Temp\CryptService.exe.exe"
      4⤵
      Executes dropped EXE
      PID:1188
- C:\Users\Admin\AppData\Local\Temp\CryptService.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\CryptService.exe.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1916
- C:\Users\Admin\AppData\Local\Temp\e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
  "C:\Users\Admin\AppData\Local\Temp\e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe"
  2⤵
  - Modifies firewall policy service
  - Modifies security service
  - Windows security bypass
  - Executes dropped EXE
  - Windows security modification
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1920
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    PID:1564

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Hidden Files and Directories

Modify Registry