sality | 167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\userinit.exe"	userinit.exe

Modifies firewall policy service 2 TTPs 18 IoCs

evasion

Modify Registry

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	userinit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	userinit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	userinit.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 6 IoCs

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	userinit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe

Windows security bypass 2 TTPs 36 IoCs

Disabling Security Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	userinit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	userinit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	userinit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	userinit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	userinit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	userinit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	system.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1"	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1"	system.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1"	system.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1"	system.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1"	system.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1"	userinit.exe

Disables Task Manager via registry modification
evasion

Executes dropped EXE 57 IoCs

pid	Process
2976	userinit.exe
4832	system.exe
4996	system.exe
2316	system.exe
4036	system.exe
5112	system.exe
1076	system.exe
3028	system.exe
3176	system.exe
4720	system.exe
4908	system.exe
3808	system.exe
1792	system.exe
3144	system.exe
3008	system.exe
1160	system.exe
2904	system.exe
4308	system.exe
4800	system.exe
2344	system.exe
2784	system.exe
2004	system.exe
3908	system.exe
3460	system.exe
1496	system.exe
216	system.exe
2788	system.exe
4628	system.exe
2204	system.exe
4368	system.exe
64	system.exe
3756	system.exe
2184	system.exe
4720	system.exe
3192	system.exe
2064	system.exe
4000	system.exe
3212	system.exe
2256	system.exe
2352	system.exe
4276	system.exe
664	system.exe
4816	system.exe
1172	system.exe
4304	system.exe
732	system.exe
4924	system.exe
1296	system.exe
2344	system.exe
1816	system.exe
2556	system.exe
784	system.exe
1124	system.exe
4420	system.exe
3412	system.exe
4984	system.exe
2016	system.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5080-132-0x00000000007D0000-0x000000000185E000-memory.dmp	upx
behavioral2/memory/5080-137-0x00000000007D0000-0x000000000185E000-memory.dmp	upx
behavioral2/memory/5080-146-0x00000000007D0000-0x000000000185E000-memory.dmp	upx
behavioral2/memory/4832-152-0x0000000000810000-0x000000000189E000-memory.dmp	upx
behavioral2/memory/4832-159-0x0000000000810000-0x000000000189E000-memory.dmp	upx
behavioral2/memory/4996-169-0x00000000007D0000-0x000000000185E000-memory.dmp	upx
behavioral2/memory/2316-179-0x0000000000810000-0x000000000189E000-memory.dmp	upx
behavioral2/memory/4036-186-0x0000000000810000-0x000000000189E000-memory.dmp	upx
behavioral2/memory/4036-190-0x0000000000810000-0x000000000189E000-memory.dmp	upx
behavioral2/memory/2976-191-0x00000000035E0000-0x000000000466E000-memory.dmp	upx
behavioral2/memory/2976-196-0x00000000035E0000-0x000000000466E000-memory.dmp	upx
behavioral2/memory/2976-222-0x00000000035E0000-0x000000000466E000-memory.dmp	upx

Windows security modification 2 TTPs 42 IoCs

Disabling Security Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	userinit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	userinit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	userinit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	userinit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	userinit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	userinit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	userinit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	system.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	userinit.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	userinit.exe
File opened (read-only)	\??\H:	userinit.exe
File opened (read-only)	\??\L:	userinit.exe
File opened (read-only)	\??\T:	userinit.exe
File opened (read-only)	\??\X:	userinit.exe
File opened (read-only)	\??\F:	userinit.exe
File opened (read-only)	\??\K:	userinit.exe
File opened (read-only)	\??\W:	userinit.exe
File opened (read-only)	\??\V:	userinit.exe
File opened (read-only)	\??\Y:	userinit.exe
File opened (read-only)	\??\G:	userinit.exe
File opened (read-only)	\??\J:	userinit.exe
File opened (read-only)	\??\M:	userinit.exe
File opened (read-only)	\??\N:	userinit.exe
File opened (read-only)	\??\P:	userinit.exe
File opened (read-only)	\??\Q:	userinit.exe
File opened (read-only)	\??\I:	userinit.exe
File opened (read-only)	\??\O:	userinit.exe
File opened (read-only)	\??\R:	userinit.exe
File opened (read-only)	\??\S:	userinit.exe
File opened (read-only)	\??\U:	userinit.exe
File opened (read-only)	\??\Z:	userinit.exe

Drops autorun.inf file 1 TTPs 1 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\autorun.inf	userinit.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\system.exe	userinit.exe
File opened for modification	C:\Windows\SysWOW64\system.exe	userinit.exe

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File opened for modification	C:\PROGRAM FILES\7-ZIP\7z.exe	userinit.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zFM.exe	userinit.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe	userinit.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe	userinit.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe	userinit.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe	userinit.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe	userinit.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zG.exe	userinit.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\Uninstall.exe	userinit.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe	userinit.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe	userinit.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SYSTEM.INI	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
File created	C:\Windows\userinit.exe	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
File opened for modification	C:\Windows\userinit.exe	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
File created	C:\Windows\kdcoms.dll	userinit.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
2976	userinit.exe
2976	userinit.exe
2976	userinit.exe
2976	userinit.exe
4832	system.exe
4832	system.exe
4832	system.exe
4832	system.exe
2976	userinit.exe
2976	userinit.exe
4996	system.exe
4996	system.exe
4996	system.exe
4996	system.exe
2976	userinit.exe
2976	userinit.exe
2316	system.exe
2316	system.exe
2316	system.exe
2316	system.exe
2976	userinit.exe
2976	userinit.exe
4036	system.exe
4036	system.exe
4036	system.exe
4036	system.exe
2976	userinit.exe
2976	userinit.exe
2976	userinit.exe
2976	userinit.exe
5112	system.exe
5112	system.exe
2976	userinit.exe
2976	userinit.exe
1076	system.exe
1076	system.exe
2976	userinit.exe
2976	userinit.exe
3028	system.exe
3028	system.exe
2976	userinit.exe
2976	userinit.exe
2976	userinit.exe
2976	userinit.exe
3176	system.exe
3176	system.exe
2976	userinit.exe
2976	userinit.exe
4720	system.exe
4720	system.exe
2976	userinit.exe
2976	userinit.exe
4908	system.exe
4908	system.exe
2976	userinit.exe
2976	userinit.exe
3808	system.exe
3808	system.exe
2976	userinit.exe
2976	userinit.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2976	userinit.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Token: SeDebugPrivilege	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
2976	userinit.exe
2976	userinit.exe
4832	system.exe
4832	system.exe
4996	system.exe
4996	system.exe
2316	system.exe
2316	system.exe
4036	system.exe
4036	system.exe
5112	system.exe
5112	system.exe
1076	system.exe
1076	system.exe
3028	system.exe
3028	system.exe
3176	system.exe
3176	system.exe
4720	system.exe
4720	system.exe
4908	system.exe
4908	system.exe
3808	system.exe
3808	system.exe
1792	system.exe
1792	system.exe
3144	system.exe
3144	system.exe
3008	system.exe
3008	system.exe
1160	system.exe
1160	system.exe
2904	system.exe
2904	system.exe
4308	system.exe
4308	system.exe
4800	system.exe
4800	system.exe
2344	system.exe
2344	system.exe
2784	system.exe
2784	system.exe
2004	system.exe
2004	system.exe
3908	system.exe
3908	system.exe
3460	system.exe
3460	system.exe
1496	system.exe
1496	system.exe
216	system.exe
216	system.exe
2788	system.exe
2788	system.exe
4628	system.exe
4628	system.exe
2204	system.exe
2204	system.exe
4368	system.exe
4368	system.exe
64	system.exe
64	system.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 756	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe	8
PID 5080 wrote to memory of 764	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe	80
PID 5080 wrote to memory of 1000	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe	12
PID 5080 wrote to memory of 2384	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe	52
PID 5080 wrote to memory of 2456	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe	51
PID 5080 wrote to memory of 2756	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe	42
PID 5080 wrote to memory of 2484	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe	41
PID 5080 wrote to memory of 2780	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe	40
PID 5080 wrote to memory of 3272	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe	39
PID 5080 wrote to memory of 3364	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe	38
PID 5080 wrote to memory of 3424	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe	37
PID 5080 wrote to memory of 3516	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe	36
PID 5080 wrote to memory of 3696	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe	35
PID 5080 wrote to memory of 4648	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe	32
PID 5080 wrote to memory of 4792	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe	16
PID 5080 wrote to memory of 2976	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe	81
PID 5080 wrote to memory of 2976	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe	81
PID 5080 wrote to memory of 2976	5080	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe	81
PID 2976 wrote to memory of 4832	2976	userinit.exe	82
PID 2976 wrote to memory of 4832	2976	userinit.exe	82
PID 2976 wrote to memory of 4832	2976	userinit.exe	82
PID 4832 wrote to memory of 756	4832	system.exe	8
PID 4832 wrote to memory of 764	4832	system.exe	80
PID 4832 wrote to memory of 1000	4832	system.exe	12
PID 4832 wrote to memory of 2384	4832	system.exe	52
PID 4832 wrote to memory of 2456	4832	system.exe	51
PID 4832 wrote to memory of 2756	4832	system.exe	42
PID 4832 wrote to memory of 2484	4832	system.exe	41
PID 4832 wrote to memory of 2780	4832	system.exe	40
PID 4832 wrote to memory of 3272	4832	system.exe	39
PID 4832 wrote to memory of 3364	4832	system.exe	38
PID 4832 wrote to memory of 3424	4832	system.exe	37
PID 4832 wrote to memory of 3516	4832	system.exe	36
PID 4832 wrote to memory of 3696	4832	system.exe	35
PID 4832 wrote to memory of 4648	4832	system.exe	32
PID 4832 wrote to memory of 4792	4832	system.exe	16
PID 4832 wrote to memory of 2976	4832	system.exe	81
PID 4832 wrote to memory of 2976	4832	system.exe	81
PID 2976 wrote to memory of 4996	2976	userinit.exe	83
PID 2976 wrote to memory of 4996	2976	userinit.exe	83
PID 2976 wrote to memory of 4996	2976	userinit.exe	83
PID 4996 wrote to memory of 756	4996	system.exe	8
PID 4996 wrote to memory of 764	4996	system.exe	80
PID 4996 wrote to memory of 1000	4996	system.exe	12
PID 4996 wrote to memory of 2384	4996	system.exe	52
PID 4996 wrote to memory of 2456	4996	system.exe	51
PID 4996 wrote to memory of 2756	4996	system.exe	42
PID 4996 wrote to memory of 2484	4996	system.exe	41
PID 4996 wrote to memory of 2780	4996	system.exe	40
PID 4996 wrote to memory of 3272	4996	system.exe	39
PID 4996 wrote to memory of 3364	4996	system.exe	38
PID 4996 wrote to memory of 3424	4996	system.exe	37
PID 4996 wrote to memory of 3516	4996	system.exe	36
PID 4996 wrote to memory of 3696	4996	system.exe	35
PID 4996 wrote to memory of 4648	4996	system.exe	32
PID 4996 wrote to memory of 4792	4996	system.exe	16
PID 2976 wrote to memory of 2316	2976	userinit.exe	84
PID 2976 wrote to memory of 2316	2976	userinit.exe	84
PID 2976 wrote to memory of 2316	2976	userinit.exe	84
PID 2316 wrote to memory of 756	2316	system.exe	8
PID 2316 wrote to memory of 764	2316	system.exe	80
PID 2316 wrote to memory of 1000	2316	system.exe	12
PID 2316 wrote to memory of 2384	2316	system.exe	52
PID 2316 wrote to memory of 2456	2316	system.exe	51

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	userinit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:756

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:1000

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4792

C:\Users\Admin\AppData\Local\Temp\167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe
"C:\Users\Admin\AppData\Local\Temp\167296f596acfc3636c93f975b5abb3395c5f5e760bc29d2535527642f4d40fa.exe"
1⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5080
- C:\Windows\userinit.exe
  C:\Windows\userinit.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies firewall policy service
  - UAC bypass
  - Windows security bypass
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Windows security modification
  - Checks whether UAC is enabled
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2976
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Modifies firewall policy service
    - UAC bypass
    - Windows security bypass
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Windows security modification
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:4832
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Modifies firewall policy service
    - UAC bypass
    - Windows security bypass
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Windows security modification
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:4996
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Modifies firewall policy service
    - UAC bypass
    - Windows security bypass
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Windows security modification
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:2316
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Modifies firewall policy service
    - UAC bypass
    - Windows security bypass
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Windows security modification
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - System policy modification
    PID:4036
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:5112
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1076
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:3028
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:3176
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4720
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4908
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:3808
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1792
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3144
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3008
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1160
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2904
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4308
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4800
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2344
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2784
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2004
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3908
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3460
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1496
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:216
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2788
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4628
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2204
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4368
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:64
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:3756
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:2184
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:4720
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:3192
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:2064
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:4000
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:3212
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:2256
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:2352
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:4276
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:664
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:4816
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:1172
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:4304
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:732
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:4924
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:1296
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:2344
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:1816
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:2556
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:784
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:1124
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:4420
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:3412
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:4984
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:2016

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4648

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3696

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3516

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3424

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3364

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:2780

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2484

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2456

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2384

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:764

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Modify Existing Service

T1031

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry