sality | ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 1 IoCs

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe

Windows security bypass 2 TTPs 6 IoCs

Disabling Security Tools

T1089

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1"	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe

Disables Task Manager via registry modification
evasion

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2292-132-0x0000000002160000-0x00000000031EE000-memory.dmp	upx
behavioral2/memory/2292-133-0x0000000031420000-0x000000003143E000-memory.dmp	upx
behavioral2/memory/2292-134-0x0000000002160000-0x00000000031EE000-memory.dmp	upx

Windows security modification 2 TTPs 7 IoCs

Disabling Security Tools

T1089

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\hvrjzw.exe"	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SYSTEM.INI	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2292	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe
2292	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	2292	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe
Token: SeDebugPrivilege	2292	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe
Token: SeDebugPrivilege	2292	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe
Token: SeDebugPrivilege	2292	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe
Token: SeDebugPrivilege	2292	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe
Token: SeDebugPrivilege	2292	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe
Token: SeDebugPrivilege	2292	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe
Token: SeDebugPrivilege	2292	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe
Token: SeDebugPrivilege	2292	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe
Token: SeDebugPrivilege	2292	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe
Token: SeDebugPrivilege	2292	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe
Token: SeDebugPrivilege	2292	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 772	2292	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe	80
PID 2292 wrote to memory of 780	2292	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe	79
PID 2292 wrote to memory of 1016	2292	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe	9
PID 2292 wrote to memory of 2344	2292	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe	56
PID 2292 wrote to memory of 2352	2292	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe	55
PID 2292 wrote to memory of 2412	2292	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe	54
PID 2292 wrote to memory of 2948	2292	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe	48
PID 2292 wrote to memory of 2872	2292	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe	47
PID 2292 wrote to memory of 3256	2292	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe	46
PID 2292 wrote to memory of 3348	2292	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe	45
PID 2292 wrote to memory of 3424	2292	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe	22
PID 2292 wrote to memory of 3508	2292	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe	44
PID 2292 wrote to memory of 3660	2292	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe	43
PID 2292 wrote to memory of 4708	2292	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe	40
PID 2292 wrote to memory of 1488	2292	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe	24

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:1016

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3424

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:1488

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4708

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3660

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3508

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3348

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:2872

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2948
- C:\Users\Admin\AppData\Local\Temp\ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe
  "C:\Users\Admin\AppData\Local\Temp\ee68d5287762d9133b422604c089ea323ca51b893807274461eeaea4df2189c3.exe"
  2⤵
  - Modifies firewall policy service
  - UAC bypass
  - Windows security bypass
  - Disables RegEdit via registry modification
  - Windows security modification
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2292

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2412

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2344

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:780

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:772

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery