isrstealer | e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	bthserv.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	vbc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	vbc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	vbc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	bthserv.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	vbc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	vbc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	vbc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	bthserv.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 4 IoCs

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	vbc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	vbc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bthserv.exe

Windows security bypass 2 TTPs 24 IoCs

Disabling Security Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	vbc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	vbc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	vbc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	vbc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	vbc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	bthserv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	bthserv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	vbc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	vbc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	vbc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	vbc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	vbc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	bthserv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	bthserv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	vbc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	vbc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	bthserv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	bthserv.exe

NirSoft MailPassView 5 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral1/memory/1956-100-0x0000000000400000-0x000000000041F000-memory.dmp	MailPassView
behavioral1/memory/1956-101-0x0000000000400000-0x000000000041F000-memory.dmp	MailPassView
behavioral1/memory/1456-111-0x0000000007C40000-0x000000000888A000-memory.dmp	MailPassView
behavioral1/memory/276-151-0x0000000000400000-0x000000000041F000-memory.dmp	MailPassView
behavioral1/memory/276-152-0x0000000000400000-0x000000000041F000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral1/memory/1456-111-0x0000000007C40000-0x000000000888A000-memory.dmp	WebBrowserPassView

Nirsoft 5 IoCs

resource	yara_rule
behavioral1/memory/1956-100-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft
behavioral1/memory/1956-101-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft
behavioral1/memory/1456-111-0x0000000007C40000-0x000000000888A000-memory.dmp	Nirsoft
behavioral1/memory/276-151-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft
behavioral1/memory/276-152-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft

Executes dropped EXE 3 IoCs

pid	Process
1372	AdobeARMservice.exe
1488	bthserv.exe
1968	AdobeARMservice.exe

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1684-68-0x00000000026B0000-0x000000000373E000-memory.dmp	upx
behavioral1/memory/1688-77-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/1688-81-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/1688-82-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/1688-85-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/1688-93-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/1956-95-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1956-99-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1956-100-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1956-101-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1684-104-0x00000000026B0000-0x000000000373E000-memory.dmp	upx
behavioral1/memory/1260-127-0x0000000002600000-0x000000000368E000-memory.dmp	upx
behavioral1/memory/1332-136-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/1332-137-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/1332-138-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/1260-140-0x0000000002600000-0x000000000368E000-memory.dmp	upx
behavioral1/memory/276-150-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/276-151-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/276-152-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1260-154-0x0000000002600000-0x000000000368E000-memory.dmp	upx
behavioral1/memory/1260-159-0x0000000002600000-0x000000000368E000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
1260	vbc.exe

Loads dropped DLL 3 IoCs

pid	Process
1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
1372	AdobeARMservice.exe
1488	bthserv.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Windows security modification 2 TTPs 14 IoCs

Disabling Security Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	bthserv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	bthserv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	bthserv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	bthserv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	bthserv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	bthserv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	bthserv.exe

Accesses Microsoft Outlook accounts 1 TTPs 2 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bthserv.exe

Enumerates connected drives 3 TTPs 35 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	bthserv.exe
File opened (read-only)	\??\Q:	bthserv.exe
File opened (read-only)	\??\X:	bthserv.exe
File opened (read-only)	\??\F:	vbc.exe
File opened (read-only)	\??\I:	vbc.exe
File opened (read-only)	\??\E:	bthserv.exe
File opened (read-only)	\??\G:	vbc.exe
File opened (read-only)	\??\G:	bthserv.exe
File opened (read-only)	\??\N:	bthserv.exe
File opened (read-only)	\??\W:	bthserv.exe
File opened (read-only)	\??\Y:	bthserv.exe
File opened (read-only)	\??\E:	vbc.exe
File opened (read-only)	\??\J:	vbc.exe
File opened (read-only)	\??\I:	bthserv.exe
File opened (read-only)	\??\L:	vbc.exe
File opened (read-only)	\??\L:	bthserv.exe
File opened (read-only)	\??\O:	bthserv.exe
File opened (read-only)	\??\R:	bthserv.exe
File opened (read-only)	\??\Z:	bthserv.exe
File opened (read-only)	\??\F:	vbc.exe
File opened (read-only)	\??\H:	vbc.exe
File opened (read-only)	\??\G:	vbc.exe
File opened (read-only)	\??\K:	bthserv.exe
File opened (read-only)	\??\H:	vbc.exe
File opened (read-only)	\??\K:	vbc.exe
File opened (read-only)	\??\H:	bthserv.exe
File opened (read-only)	\??\T:	bthserv.exe
File opened (read-only)	\??\M:	vbc.exe
File opened (read-only)	\??\F:	bthserv.exe
File opened (read-only)	\??\S:	bthserv.exe
File opened (read-only)	\??\V:	bthserv.exe
File opened (read-only)	\??\U:	bthserv.exe
File opened (read-only)	\??\E:	vbc.exe
File opened (read-only)	\??\J:	bthserv.exe
File opened (read-only)	\??\P:	bthserv.exe

Drops autorun.inf file 1 TTPs 1 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\autorun.inf	bthserv.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 1456 set thread context of 1684	1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe	26
PID 1684 set thread context of 1688	1684	vbc.exe	28
PID 1684 set thread context of 1956	1684	vbc.exe	30
PID 1488 set thread context of 1260	1488	bthserv.exe	31
PID 1260 set thread context of 1332	1260	vbc.exe	33
PID 1260 set thread context of 276	1260	vbc.exe	36

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	bthserv.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SYSTEM.INI	vbc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
1684	vbc.exe
1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
1372	AdobeARMservice.exe
1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
1372	AdobeARMservice.exe
1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
1372	AdobeARMservice.exe
1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
1372	AdobeARMservice.exe
1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
1372	AdobeARMservice.exe
1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
1372	AdobeARMservice.exe
1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
1372	AdobeARMservice.exe
1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
1372	AdobeARMservice.exe
1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
1372	AdobeARMservice.exe
1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
1372	AdobeARMservice.exe
1684	vbc.exe
1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
1372	AdobeARMservice.exe
1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
1372	AdobeARMservice.exe
1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
1372	AdobeARMservice.exe
1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
1372	AdobeARMservice.exe
1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
1372	AdobeARMservice.exe
1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
1372	AdobeARMservice.exe
1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
1372	AdobeARMservice.exe
1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
1372	AdobeARMservice.exe
1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
1372	AdobeARMservice.exe
1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
1372	AdobeARMservice.exe
1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
1372	AdobeARMservice.exe
1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
1372	AdobeARMservice.exe
1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
1372	AdobeARMservice.exe
1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
1372	AdobeARMservice.exe
1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
1372	AdobeARMservice.exe
1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
1372	AdobeARMservice.exe
1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
1372	AdobeARMservice.exe
1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
1488	bthserv.exe
1260	vbc.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
Token: SeDebugPrivilege	1372	AdobeARMservice.exe
Token: SeDebugPrivilege	1488	bthserv.exe
Token: SeDebugPrivilege	1968	AdobeARMservice.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1684	vbc.exe
1372	AdobeARMservice.exe
1372	AdobeARMservice.exe
1260	vbc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 1684	1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe	26
PID 1456 wrote to memory of 1684	1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe	26
PID 1456 wrote to memory of 1684	1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe	26
PID 1456 wrote to memory of 1684	1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe	26
PID 1456 wrote to memory of 1684	1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe	26
PID 1456 wrote to memory of 1684	1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe	26
PID 1456 wrote to memory of 1684	1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe	26
PID 1456 wrote to memory of 1684	1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe	26
PID 1456 wrote to memory of 1372	1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe	27
PID 1456 wrote to memory of 1372	1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe	27
PID 1456 wrote to memory of 1372	1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe	27
PID 1456 wrote to memory of 1372	1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe	27
PID 1456 wrote to memory of 1372	1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe	27
PID 1456 wrote to memory of 1372	1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe	27
PID 1456 wrote to memory of 1372	1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe	27
PID 1684 wrote to memory of 1228	1684	vbc.exe	11
PID 1684 wrote to memory of 1308	1684	vbc.exe	10
PID 1684 wrote to memory of 1360	1684	vbc.exe	9
PID 1684 wrote to memory of 1456	1684	vbc.exe	25
PID 1684 wrote to memory of 1456	1684	vbc.exe	25
PID 1684 wrote to memory of 1372	1684	vbc.exe	27
PID 1684 wrote to memory of 1372	1684	vbc.exe	27
PID 1684 wrote to memory of 1688	1684	vbc.exe	28
PID 1684 wrote to memory of 1688	1684	vbc.exe	28
PID 1684 wrote to memory of 1688	1684	vbc.exe	28
PID 1684 wrote to memory of 1688	1684	vbc.exe	28
PID 1684 wrote to memory of 1688	1684	vbc.exe	28
PID 1684 wrote to memory of 1688	1684	vbc.exe	28
PID 1684 wrote to memory of 1688	1684	vbc.exe	28
PID 1684 wrote to memory of 1688	1684	vbc.exe	28
PID 1684 wrote to memory of 1688	1684	vbc.exe	28
PID 1372 wrote to memory of 1488	1372	AdobeARMservice.exe	29
PID 1372 wrote to memory of 1488	1372	AdobeARMservice.exe	29
PID 1372 wrote to memory of 1488	1372	AdobeARMservice.exe	29
PID 1372 wrote to memory of 1488	1372	AdobeARMservice.exe	29
PID 1684 wrote to memory of 1956	1684	vbc.exe	30
PID 1684 wrote to memory of 1956	1684	vbc.exe	30
PID 1684 wrote to memory of 1956	1684	vbc.exe	30
PID 1684 wrote to memory of 1956	1684	vbc.exe	30
PID 1684 wrote to memory of 1956	1684	vbc.exe	30
PID 1684 wrote to memory of 1956	1684	vbc.exe	30
PID 1684 wrote to memory of 1956	1684	vbc.exe	30
PID 1684 wrote to memory of 1956	1684	vbc.exe	30
PID 1684 wrote to memory of 1956	1684	vbc.exe	30
PID 1684 wrote to memory of 1228	1684	vbc.exe	11
PID 1684 wrote to memory of 1308	1684	vbc.exe	10
PID 1684 wrote to memory of 1360	1684	vbc.exe	9
PID 1684 wrote to memory of 1488	1684	vbc.exe	29
PID 1684 wrote to memory of 1488	1684	vbc.exe	29
PID 1456 wrote to memory of 1228	1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe	11
PID 1456 wrote to memory of 1308	1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe	10
PID 1456 wrote to memory of 1360	1456	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe	9
PID 1488 wrote to memory of 1260	1488	bthserv.exe	31
PID 1488 wrote to memory of 1260	1488	bthserv.exe	31
PID 1488 wrote to memory of 1260	1488	bthserv.exe	31
PID 1488 wrote to memory of 1260	1488	bthserv.exe	31
PID 1488 wrote to memory of 1260	1488	bthserv.exe	31
PID 1488 wrote to memory of 1260	1488	bthserv.exe	31
PID 1488 wrote to memory of 1260	1488	bthserv.exe	31
PID 1488 wrote to memory of 1260	1488	bthserv.exe	31
PID 1488 wrote to memory of 1968	1488	bthserv.exe	32
PID 1488 wrote to memory of 1968	1488	bthserv.exe	32
PID 1488 wrote to memory of 1968	1488	bthserv.exe	32
PID 1488 wrote to memory of 1968	1488	bthserv.exe	32

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bthserv.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1360
- C:\Users\Admin\AppData\Local\Temp\e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe
  "C:\Users\Admin\AppData\Local\Temp\e264f8835236ba69a65ee098b5b55db60b258e130720521ee2f87edaa412c525.exe"
  2⤵
  - Modifies firewall policy service
  - UAC bypass
  - Windows security bypass
  - Loads dropped DLL
  - Windows security modification
  - Checks whether UAC is enabled
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1456
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
    3⤵
    - Modifies firewall policy service
    - UAC bypass
    - Windows security bypass
    - Enumerates connected drives
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1684
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      /scomma "C:\Users\Admin\AppData\Local\Temp\avsYaDQwcn.ini"
      4⤵
      PID:1688
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      /scomma "C:\Users\Admin\AppData\Local\Temp\bFJ7zuGmcO.ini"
      4⤵
      Accesses Microsoft Outlook accounts
      PID:1956
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AdobeARMservice.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AdobeARMservice.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1372
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\bthserv.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\bthserv
      4⤵
      Modifies firewall policy service
      UAC bypass
      Windows security bypass
      Executes dropped EXE
      Loads dropped DLL
      Windows security modification
      Checks whether UAC is enabled
      Enumerates connected drives
      Drops autorun.inf file
      Suspicious use of SetThreadContext
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:1488
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
        5⤵
        Modifies firewall policy service
        UAC bypass
        Windows security bypass
        Deletes itself
        Enumerates connected drives
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1260
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\4FWmOKPs2q.ini"
        6⤵
        
        PID:1332
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\cw70KqZSrq.ini"
        6⤵
        Accesses Microsoft Outlook accounts
        
        PID:276
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AdobeARMservice.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AdobeARMservice.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1968

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1308

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1228

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:896

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Scripting

T1064

Persistence

Modify Existing Service

T1031

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry