b6010aaa8482525d26b5df031b4061b12ec528197b99f23aae4d5c085e1e5b4c

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	b6010aaa8482525d26b5df031b4061b12ec528197b99f23aae4d5c085e1e5b4c.EXE

Windows security bypass 2 TTPs 1 IoCs

Disabling Security Tools

T1089

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0"	b6010aaa8482525d26b5df031b4061b12ec528197b99f23aae4d5c085e1e5b4c.EXE

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2920-133-0x0000000000400000-0x0000000000759000-memory.dmp	upx
behavioral2/memory/2920-139-0x0000000000400000-0x0000000000759000-memory.dmp	upx

Windows security modification 2 TTPs 1 IoCs

Disabling Security Tools

T1089

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0"	b6010aaa8482525d26b5df031b4061b12ec528197b99f23aae4d5c085e1e5b4c.EXE

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicrosoftUpdate = "C:\\Windows\\System32\\mscvin.exe"	b6010aaa8482525d26b5df031b4061b12ec528197b99f23aae4d5c085e1e5b4c.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	b6010aaa8482525d26b5df031b4061b12ec528197b99f23aae4d5c085e1e5b4c.EXE

Checks whether UAC is enabled 1 TTPs 1 IoCs

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	b6010aaa8482525d26b5df031b4061b12ec528197b99f23aae4d5c085e1e5b4c.EXE

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mscvin.exe	b6010aaa8482525d26b5df031b4061b12ec528197b99f23aae4d5c085e1e5b4c.EXE
File opened for modification	C:\Windows\SysWOW64\mscvin.exe	b6010aaa8482525d26b5df031b4061b12ec528197b99f23aae4d5c085e1e5b4c.EXE

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2920 set thread context of 2040	2920	b6010aaa8482525d26b5df031b4061b12ec528197b99f23aae4d5c085e1e5b4c.exe	25

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeBackupPrivilege	2040	b6010aaa8482525d26b5df031b4061b12ec528197b99f23aae4d5c085e1e5b4c.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2920	b6010aaa8482525d26b5df031b4061b12ec528197b99f23aae4d5c085e1e5b4c.exe
2040	b6010aaa8482525d26b5df031b4061b12ec528197b99f23aae4d5c085e1e5b4c.EXE
2040	b6010aaa8482525d26b5df031b4061b12ec528197b99f23aae4d5c085e1e5b4c.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 2040	2920	b6010aaa8482525d26b5df031b4061b12ec528197b99f23aae4d5c085e1e5b4c.exe	25
PID 2920 wrote to memory of 2040	2920	b6010aaa8482525d26b5df031b4061b12ec528197b99f23aae4d5c085e1e5b4c.exe	25
PID 2920 wrote to memory of 2040	2920	b6010aaa8482525d26b5df031b4061b12ec528197b99f23aae4d5c085e1e5b4c.exe	25
PID 2920 wrote to memory of 2040	2920	b6010aaa8482525d26b5df031b4061b12ec528197b99f23aae4d5c085e1e5b4c.exe	25
PID 2920 wrote to memory of 2040	2920	b6010aaa8482525d26b5df031b4061b12ec528197b99f23aae4d5c085e1e5b4c.exe	25
PID 2920 wrote to memory of 2040	2920	b6010aaa8482525d26b5df031b4061b12ec528197b99f23aae4d5c085e1e5b4c.exe	25
PID 2920 wrote to memory of 2040	2920	b6010aaa8482525d26b5df031b4061b12ec528197b99f23aae4d5c085e1e5b4c.exe	25
PID 2920 wrote to memory of 2040	2920	b6010aaa8482525d26b5df031b4061b12ec528197b99f23aae4d5c085e1e5b4c.exe	25

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	b6010aaa8482525d26b5df031b4061b12ec528197b99f23aae4d5c085e1e5b4c.EXE

C:\Users\Admin\AppData\Local\Temp\b6010aaa8482525d26b5df031b4061b12ec528197b99f23aae4d5c085e1e5b4c.exe
"C:\Users\Admin\AppData\Local\Temp\b6010aaa8482525d26b5df031b4061b12ec528197b99f23aae4d5c085e1e5b4c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Users\Admin\AppData\Local\Temp\b6010aaa8482525d26b5df031b4061b12ec528197b99f23aae4d5c085e1e5b4c.EXE
  "C:\Users\Admin\AppData\Local\Temp\b6010aaa8482525d26b5df031b4061b12ec528197b99f23aae4d5c085e1e5b4c.EXE"
  2⤵
  - UAC bypass
  - Windows security bypass
  - Windows security modification
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:2040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery