sality | a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\userinit.exe"	userinit.exe

Modifies firewall policy service 2 TTPs 45 IoCs

evasion

Modify Registry

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	userinit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	userinit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	userinit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	system.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 15 IoCs

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	userinit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe

Windows security bypass 2 TTPs 64 IoCs

Disabling Security Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	userinit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	userinit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	userinit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	system.exe

Executes dropped EXE 64 IoCs

pid	Process
1588	userinit.exe
1592	system.exe
1448	system.exe
4236	system.exe
484	system.exe
2240	system.exe
4020	system.exe
4608	system.exe
1544	system.exe
4564	system.exe
2980	system.exe
3212	system.exe
4884	system.exe
4808	system.exe
400	system.exe
3740	system.exe
1924	system.exe
1484	system.exe
3456	system.exe
2336	system.exe
2304	system.exe
3104	system.exe
4472	system.exe
3540	system.exe
3468	system.exe
5004	system.exe
1944	system.exe
1544	system.exe
2436	system.exe
2976	system.exe
956	system.exe
668	system.exe
1012	system.exe
1808	system.exe
3400	system.exe
2152	system.exe
3852	system.exe
1308	system.exe
2328	system.exe
2092	system.exe
4808	system.exe
4268	system.exe
2000	system.exe
4200	system.exe
4308	system.exe
3744	system.exe
4236	system.exe
1208	system.exe
2956	system.exe
4376	system.exe
1952	system.exe
3312	system.exe
1440	system.exe
4836	system.exe
4852	system.exe
3892	system.exe
4100	system.exe
1496	system.exe
4748	system.exe
4708	system.exe
3092	system.exe
4088	system.exe
4656	system.exe
4532	system.exe

UPX packed file 31 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2028-134-0x0000000000830000-0x00000000018BE000-memory.dmp	upx
behavioral2/memory/2028-136-0x0000000000830000-0x00000000018BE000-memory.dmp	upx
behavioral2/memory/2028-149-0x0000000000830000-0x00000000018BE000-memory.dmp	upx
behavioral2/memory/1592-153-0x0000000000770000-0x00000000017FE000-memory.dmp	upx
behavioral2/memory/1592-159-0x0000000000770000-0x00000000017FE000-memory.dmp	upx
behavioral2/memory/1448-164-0x0000000000800000-0x000000000188E000-memory.dmp	upx
behavioral2/memory/1448-170-0x0000000000800000-0x000000000188E000-memory.dmp	upx
behavioral2/memory/4236-173-0x00000000007C0000-0x000000000184E000-memory.dmp	upx
behavioral2/memory/4236-180-0x00000000007C0000-0x000000000184E000-memory.dmp	upx
behavioral2/memory/484-183-0x0000000000870000-0x00000000018FE000-memory.dmp	upx
behavioral2/memory/484-190-0x0000000000870000-0x00000000018FE000-memory.dmp	upx
behavioral2/memory/2240-192-0x0000000000780000-0x000000000180E000-memory.dmp	upx
behavioral2/memory/2240-200-0x0000000000780000-0x000000000180E000-memory.dmp	upx
behavioral2/memory/4608-209-0x00000000007A0000-0x000000000182E000-memory.dmp	upx
behavioral2/memory/4608-215-0x00000000007A0000-0x000000000182E000-memory.dmp	upx
behavioral2/memory/1544-218-0x00000000008F0000-0x000000000197E000-memory.dmp	upx
behavioral2/memory/1544-224-0x00000000008F0000-0x000000000197E000-memory.dmp	upx
behavioral2/memory/4564-227-0x00000000008B0000-0x000000000193E000-memory.dmp	upx
behavioral2/memory/4564-236-0x00000000008B0000-0x000000000193E000-memory.dmp	upx
behavioral2/memory/2980-237-0x0000000000810000-0x000000000189E000-memory.dmp	upx
behavioral2/memory/2980-243-0x0000000000810000-0x000000000189E000-memory.dmp	upx
behavioral2/memory/3212-252-0x0000000000870000-0x00000000018FE000-memory.dmp	upx
behavioral2/memory/4884-255-0x00000000007E0000-0x000000000186E000-memory.dmp	upx
behavioral2/memory/4884-261-0x00000000007E0000-0x000000000186E000-memory.dmp	upx
behavioral2/memory/4808-264-0x0000000000880000-0x000000000190E000-memory.dmp	upx
behavioral2/memory/4808-270-0x0000000000880000-0x000000000190E000-memory.dmp	upx
behavioral2/memory/400-273-0x00000000007B0000-0x000000000183E000-memory.dmp	upx
behavioral2/memory/400-280-0x00000000007B0000-0x000000000183E000-memory.dmp	upx
behavioral2/memory/400-283-0x00000000007B0000-0x000000000183E000-memory.dmp	upx
behavioral2/memory/1588-290-0x00000000036A0000-0x000000000472E000-memory.dmp	upx
behavioral2/memory/1588-293-0x00000000036A0000-0x000000000472E000-memory.dmp	upx

Windows security modification 2 TTPs 64 IoCs

Disabling Security Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	userinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	system.exe

Checks whether UAC is enabled 1 TTPs 15 IoCs

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	userinit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	userinit.exe
File opened (read-only)	\??\Q:	userinit.exe
File opened (read-only)	\??\Z:	userinit.exe
File opened (read-only)	\??\V:	userinit.exe
File opened (read-only)	\??\Y:	userinit.exe
File opened (read-only)	\??\I:	userinit.exe
File opened (read-only)	\??\J:	userinit.exe
File opened (read-only)	\??\L:	userinit.exe
File opened (read-only)	\??\P:	userinit.exe
File opened (read-only)	\??\R:	userinit.exe
File opened (read-only)	\??\G:	userinit.exe
File opened (read-only)	\??\M:	userinit.exe
File opened (read-only)	\??\U:	userinit.exe
File opened (read-only)	\??\S:	userinit.exe
File opened (read-only)	\??\T:	userinit.exe
File opened (read-only)	\??\W:	userinit.exe
File opened (read-only)	\??\E:	userinit.exe
File opened (read-only)	\??\F:	userinit.exe
File opened (read-only)	\??\H:	userinit.exe
File opened (read-only)	\??\K:	userinit.exe
File opened (read-only)	\??\O:	userinit.exe
File opened (read-only)	\??\X:	userinit.exe

Drops autorun.inf file 1 TTPs 1 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\autorun.inf	userinit.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\system.exe	userinit.exe
File opened for modification	C:\Windows\SysWOW64\system.exe	userinit.exe

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File opened for modification	C:\PROGRAM FILES\7-ZIP\7z.exe	userinit.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe	userinit.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe	userinit.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe	userinit.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe	userinit.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zFM.exe	userinit.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zG.exe	userinit.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\Uninstall.exe	userinit.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe	userinit.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe	userinit.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe	userinit.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SYSTEM.INI	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
File created	C:\Windows\userinit.exe	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
File opened for modification	C:\Windows\userinit.exe	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
File created	C:\Windows\kdcoms.dll	userinit.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
1588	userinit.exe
1588	userinit.exe
1588	userinit.exe
1588	userinit.exe
1592	system.exe
1592	system.exe
1592	system.exe
1592	system.exe
1588	userinit.exe
1588	userinit.exe
1448	system.exe
1448	system.exe
1588	userinit.exe
1588	userinit.exe
4236	system.exe
4236	system.exe
4236	system.exe
4236	system.exe
1588	userinit.exe
1588	userinit.exe
484	system.exe
484	system.exe
484	system.exe
484	system.exe
1588	userinit.exe
1588	userinit.exe
2240	system.exe
2240	system.exe
2240	system.exe
2240	system.exe
1588	userinit.exe
1588	userinit.exe
4020	system.exe
4020	system.exe
1588	userinit.exe
1588	userinit.exe
4608	system.exe
4608	system.exe
4608	system.exe
4608	system.exe
1588	userinit.exe
1588	userinit.exe
1544	system.exe
1544	system.exe
1544	system.exe
1544	system.exe
1588	userinit.exe
1588	userinit.exe
4564	system.exe
4564	system.exe
4564	system.exe
4564	system.exe
1588	userinit.exe
1588	userinit.exe
2980	system.exe
2980	system.exe
2980	system.exe
2980	system.exe
1588	userinit.exe
1588	userinit.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1588	userinit.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Token: SeDebugPrivilege	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
1588	userinit.exe
1588	userinit.exe
1592	system.exe
1592	system.exe
1448	system.exe
1448	system.exe
4236	system.exe
4236	system.exe
484	system.exe
484	system.exe
2240	system.exe
2240	system.exe
4020	system.exe
4020	system.exe
4608	system.exe
4608	system.exe
1544	system.exe
1544	system.exe
4564	system.exe
4564	system.exe
2980	system.exe
2980	system.exe
3212	system.exe
3212	system.exe
4884	system.exe
4884	system.exe
4808	system.exe
4808	system.exe
400	system.exe
400	system.exe
3740	system.exe
3740	system.exe
1924	system.exe
1924	system.exe
1484	system.exe
1484	system.exe
3456	system.exe
3456	system.exe
2336	system.exe
2336	system.exe
2304	system.exe
2304	system.exe
3104	system.exe
3104	system.exe
4472	system.exe
4472	system.exe
3540	system.exe
3540	system.exe
3468	system.exe
3468	system.exe
5004	system.exe
5004	system.exe
1944	system.exe
1944	system.exe
1544	system.exe
1544	system.exe
2436	system.exe
2436	system.exe
2976	system.exe
2976	system.exe
956	system.exe
956	system.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 780	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe	8
PID 2028 wrote to memory of 784	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe	81
PID 2028 wrote to memory of 1020	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe	78
PID 2028 wrote to memory of 2356	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe	58
PID 2028 wrote to memory of 2388	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe	57
PID 2028 wrote to memory of 2468	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe	54
PID 2028 wrote to memory of 2640	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe	20
PID 2028 wrote to memory of 3096	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe	47
PID 2028 wrote to memory of 3288	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe	46
PID 2028 wrote to memory of 3420	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe	44
PID 2028 wrote to memory of 3508	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe	21
PID 2028 wrote to memory of 3616	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe	22
PID 2028 wrote to memory of 3808	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe	43
PID 2028 wrote to memory of 4692	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe	24
PID 2028 wrote to memory of 4556	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe	32
PID 2028 wrote to memory of 1588	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe	83
PID 2028 wrote to memory of 1588	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe	83
PID 2028 wrote to memory of 1588	2028	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe	83
PID 1588 wrote to memory of 1592	1588	userinit.exe	84
PID 1588 wrote to memory of 1592	1588	userinit.exe	84
PID 1588 wrote to memory of 1592	1588	userinit.exe	84
PID 1592 wrote to memory of 780	1592	system.exe	8
PID 1592 wrote to memory of 784	1592	system.exe	81
PID 1592 wrote to memory of 1020	1592	system.exe	78
PID 1592 wrote to memory of 2356	1592	system.exe	58
PID 1588 wrote to memory of 1448	1588	userinit.exe	85
PID 1588 wrote to memory of 1448	1588	userinit.exe	85
PID 1588 wrote to memory of 1448	1588	userinit.exe	85
PID 1588 wrote to memory of 4236	1588	userinit.exe	86
PID 1588 wrote to memory of 4236	1588	userinit.exe	86
PID 1588 wrote to memory of 4236	1588	userinit.exe	86
PID 1588 wrote to memory of 484	1588	userinit.exe	89
PID 1588 wrote to memory of 484	1588	userinit.exe	89
PID 1588 wrote to memory of 484	1588	userinit.exe	89
PID 484 wrote to memory of 780	484	system.exe	8
PID 484 wrote to memory of 784	484	system.exe	81
PID 484 wrote to memory of 1020	484	system.exe	78
PID 484 wrote to memory of 2356	484	system.exe	58
PID 484 wrote to memory of 2388	484	system.exe	57
PID 484 wrote to memory of 2468	484	system.exe	54
PID 484 wrote to memory of 2640	484	system.exe	20
PID 484 wrote to memory of 3096	484	system.exe	47
PID 484 wrote to memory of 3288	484	system.exe	46
PID 484 wrote to memory of 3420	484	system.exe	44
PID 484 wrote to memory of 3508	484	system.exe	21
PID 484 wrote to memory of 3616	484	system.exe	22
PID 484 wrote to memory of 3808	484	system.exe	43
PID 484 wrote to memory of 4692	484	system.exe	24
PID 1588 wrote to memory of 2240	1588	userinit.exe	91
PID 1588 wrote to memory of 2240	1588	userinit.exe	91
PID 1588 wrote to memory of 2240	1588	userinit.exe	91
PID 2240 wrote to memory of 780	2240	system.exe	8
PID 2240 wrote to memory of 784	2240	system.exe	81
PID 2240 wrote to memory of 1020	2240	system.exe	78
PID 1588 wrote to memory of 4020	1588	userinit.exe	93
PID 1588 wrote to memory of 4020	1588	userinit.exe	93
PID 1588 wrote to memory of 4020	1588	userinit.exe	93
PID 1588 wrote to memory of 4608	1588	userinit.exe	96
PID 1588 wrote to memory of 4608	1588	userinit.exe	96
PID 1588 wrote to memory of 4608	1588	userinit.exe	96
PID 4608 wrote to memory of 780	4608	system.exe	8
PID 4608 wrote to memory of 784	4608	system.exe	81
PID 4608 wrote to memory of 1020	4608	system.exe	78
PID 1588 wrote to memory of 1544	1588	userinit.exe	97

System policy modification 1 TTPs 15 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	userinit.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:780

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2640
- C:\Users\Admin\AppData\Local\Temp\a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe
  "C:\Users\Admin\AppData\Local\Temp\a272567e2fef5d25dfecb96b76fa9f01fa5be02149011a956985abb346c48b6a.exe"
  2⤵
  - Modifies firewall policy service
  - UAC bypass
  - Windows security bypass
  - Windows security modification
  - Checks whether UAC is enabled
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2028
- - C:\Windows\userinit.exe
    C:\Windows\userinit.exe
    3⤵
    - Modifies WinLogon for persistence
    - Modifies firewall policy service
    - UAC bypass
    - Windows security bypass
    - Executes dropped EXE
    - Windows security modification
    - Checks whether UAC is enabled
    - Enumerates connected drives
    - Drops autorun.inf file
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:1588
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Modifies firewall policy service
      UAC bypass
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:1592
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Modifies firewall policy service
      UAC bypass
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:1448
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Modifies firewall policy service
      UAC bypass
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:4236
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Modifies firewall policy service
      UAC bypass
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:484
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Modifies firewall policy service
      UAC bypass
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:2240
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:4020
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Modifies firewall policy service
      UAC bypass
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:4608
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Modifies firewall policy service
      UAC bypass
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:1544
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Modifies firewall policy service
      UAC bypass
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:4564
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Modifies firewall policy service
      UAC bypass
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:2980
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Modifies firewall policy service
      UAC bypass
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      Checks whether UAC is enabled
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:3212
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Modifies firewall policy service
      UAC bypass
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      Checks whether UAC is enabled
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:4884
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Modifies firewall policy service
      UAC bypass
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      Checks whether UAC is enabled
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:4808
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Modifies firewall policy service
      UAC bypass
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      Checks whether UAC is enabled
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:400
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3740
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1924
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1484
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3456
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2336
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2304
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3104
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4472
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3540
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3468
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5004
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1944
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1544
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2436
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2976
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:956
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      PID:668
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      PID:1012
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      PID:1808
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      PID:3400
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      PID:2152
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      PID:3852
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      PID:1308
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      PID:2328
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      PID:2092
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      PID:4808
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      PID:4268
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      PID:2000
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      PID:4200
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      PID:4308
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      PID:3744
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      PID:4236
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      PID:1208
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      PID:2956
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      PID:4376
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      PID:1952
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      PID:3312
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      PID:1440
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      PID:4836
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      PID:4852
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      PID:3892
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      PID:4100
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      PID:1496
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      PID:4748
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      PID:4708
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      PID:3092
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      PID:4088
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      PID:4656
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      Executes dropped EXE
      PID:4532
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      PID:4020
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      PID:4060
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      PID:3236
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      PID:1444
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      PID:2348
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      PID:2380
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      PID:3660
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      PID:4540
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      PID:4328
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      PID:3080
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      PID:2324
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      PID:1668
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      PID:1756
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      PID:316
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      PID:4112
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      PID:1968
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      PID:1592
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      PID:1436
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      PID:540
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      PID:1732
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      PID:4012
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      PID:3744
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      PID:1620
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      PID:4028
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      PID:2548
  - - C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      4⤵
      PID:3192

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3508

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3616

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4692

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4556

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3808

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3420

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3096

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2388

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2356

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:1020

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:784

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Modify Existing Service

T1031

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry