sality | bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	Au_.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	Au_.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	Au_.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 2 IoCs

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Au_.exe

Windows security bypass 2 TTPs 12 IoCs

Disabling Security Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	Au_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	Au_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	Au_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	Au_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	Au_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	Au_.exe

Executes dropped EXE 1 IoCs

pid	Process
1688	Au_.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2016-55-0x0000000002020000-0x00000000030AE000-memory.dmp	upx
behavioral1/memory/2016-57-0x0000000002020000-0x00000000030AE000-memory.dmp	upx
behavioral1/memory/2016-64-0x0000000002020000-0x00000000030AE000-memory.dmp	upx
behavioral1/memory/1688-67-0x0000000004DC0000-0x0000000005E4E000-memory.dmp	upx
behavioral1/memory/1688-69-0x0000000004DC0000-0x0000000004F1C000-memory.dmp	upx
behavioral1/memory/1688-72-0x0000000004DC0000-0x0000000004F1C000-memory.dmp	upx

Loads dropped DLL 1 IoCs

pid	Process
2016	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe

Windows security modification 2 TTPs 14 IoCs

Disabling Security Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	Au_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	Au_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	Au_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	Au_.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	Au_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	Au_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	Au_.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Au_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SYSTEM.INI	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2016	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe
1688	Au_.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeDebugPrivilege	2016	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe
Token: SeDebugPrivilege	2016	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe
Token: SeDebugPrivilege	2016	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe
Token: SeDebugPrivilege	2016	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe
Token: SeDebugPrivilege	2016	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe
Token: SeDebugPrivilege	2016	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe
Token: SeDebugPrivilege	2016	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe
Token: SeDebugPrivilege	2016	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe
Token: SeDebugPrivilege	2016	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe
Token: SeDebugPrivilege	2016	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe
Token: SeDebugPrivilege	2016	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe
Token: SeDebugPrivilege	2016	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe
Token: SeDebugPrivilege	2016	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe
Token: SeDebugPrivilege	2016	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe
Token: SeDebugPrivilege	2016	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe
Token: SeDebugPrivilege	2016	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe
Token: SeDebugPrivilege	2016	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe
Token: SeDebugPrivilege	2016	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe
Token: SeDebugPrivilege	2016	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe
Token: SeDebugPrivilege	2016	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe
Token: SeDebugPrivilege	2016	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe
Token: SeDebugPrivilege	1688	Au_.exe
Token: SeDebugPrivilege	1688	Au_.exe
Token: SeDebugPrivilege	1688	Au_.exe
Token: SeDebugPrivilege	1688	Au_.exe
Token: SeDebugPrivilege	1688	Au_.exe
Token: SeDebugPrivilege	1688	Au_.exe
Token: SeDebugPrivilege	1688	Au_.exe
Token: SeDebugPrivilege	1688	Au_.exe
Token: SeDebugPrivilege	1688	Au_.exe
Token: SeDebugPrivilege	1688	Au_.exe
Token: SeDebugPrivilege	1688	Au_.exe
Token: SeDebugPrivilege	1688	Au_.exe
Token: SeDebugPrivilege	1688	Au_.exe
Token: SeDebugPrivilege	1688	Au_.exe
Token: SeDebugPrivilege	1688	Au_.exe
Token: SeDebugPrivilege	1688	Au_.exe
Token: SeDebugPrivilege	1688	Au_.exe
Token: SeDebugPrivilege	1688	Au_.exe
Token: SeDebugPrivilege	1688	Au_.exe
Token: SeDebugPrivilege	1688	Au_.exe
Token: SeDebugPrivilege	1688	Au_.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1108	2016	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe	15
PID 2016 wrote to memory of 1180	2016	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe	7
PID 2016 wrote to memory of 1232	2016	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe	14
PID 2016 wrote to memory of 1688	2016	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe	28
PID 2016 wrote to memory of 1688	2016	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe	28
PID 2016 wrote to memory of 1688	2016	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe	28
PID 2016 wrote to memory of 1688	2016	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe	28
PID 1688 wrote to memory of 1108	1688	Au_.exe	15
PID 1688 wrote to memory of 1180	1688	Au_.exe	7
PID 1688 wrote to memory of 1232	1688	Au_.exe	14

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Au_.exe

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1180

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1232
- C:\Users\Admin\AppData\Local\Temp\bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe
  "C:\Users\Admin\AppData\Local\Temp\bbea5cc97ec6d480ecc0227db4c3779136df8a31d775de33db653d4005f134c5.exe"
  2⤵
  - Modifies firewall policy service
  - UAC bypass
  - Windows security bypass
  - Loads dropped DLL
  - Windows security modification
  - Checks whether UAC is enabled
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2016
- - C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
    "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
    3⤵
    - Modifies firewall policy service
    - UAC bypass
    - Windows security bypass
    - Executes dropped EXE
    - Windows security modification
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:1688

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1108

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry