sality | ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 1 IoCs

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe

Windows security bypass 2 TTPs 6 IoCs

Disabling Security Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe

Executes dropped EXE 6 IoCs

pid	Process
1168	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
524	icsys.icn.exe
1520	explorer.exe
1488	spoolsv.exe
1568	svchost.exe
1944	spoolsv.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1168-62-0x0000000002570000-0x00000000035FE000-memory.dmp	upx
behavioral1/memory/1168-68-0x0000000002570000-0x00000000035FE000-memory.dmp	upx

Loads dropped DLL 12 IoCs

pid	Process
2016	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
2016	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
2016	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
2016	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
524	icsys.icn.exe
524	icsys.icn.exe
1520	explorer.exe
1520	explorer.exe
1488	spoolsv.exe
1488	spoolsv.exe
1568	svchost.exe
1568	svchost.exe

Windows security modification 2 TTPs 7 IoCs

Disabling Security Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
File opened for modification	C:\Windows\SYSTEM.INI	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
1016	schtasks.exe
828	schtasks.exe
764	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2016	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
2016	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
2016	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
2016	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
2016	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
2016	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
2016	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
2016	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
2016	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
2016	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
2016	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
2016	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
2016	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
2016	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
2016	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
2016	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
1168	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
524	icsys.icn.exe
524	icsys.icn.exe
524	icsys.icn.exe
524	icsys.icn.exe
524	icsys.icn.exe
524	icsys.icn.exe
524	icsys.icn.exe
524	icsys.icn.exe
524	icsys.icn.exe
524	icsys.icn.exe
524	icsys.icn.exe
524	icsys.icn.exe
524	icsys.icn.exe
524	icsys.icn.exe
524	icsys.icn.exe
524	icsys.icn.exe
524	icsys.icn.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1568	svchost.exe
1568	svchost.exe
1568	svchost.exe
1568	svchost.exe
1568	svchost.exe
1568	svchost.exe
1568	svchost.exe
1568	svchost.exe
1568	svchost.exe
1568	svchost.exe
1568	svchost.exe
1568	svchost.exe
1568	svchost.exe
1568	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1520	explorer.exe
1568	svchost.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	1168	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
Token: SeDebugPrivilege	1168	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
Token: SeDebugPrivilege	1168	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
Token: SeDebugPrivilege	1168	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
Token: SeDebugPrivilege	1168	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
Token: SeDebugPrivilege	1168	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
Token: SeDebugPrivilege	1168	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
Token: SeDebugPrivilege	1168	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
Token: SeDebugPrivilege	1168	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
Token: SeDebugPrivilege	1168	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
Token: SeDebugPrivilege	1168	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
Token: SeDebugPrivilege	1168	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
Token: SeDebugPrivilege	1168	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
Token: SeDebugPrivilege	1168	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
Token: SeDebugPrivilege	1168	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
Token: SeDebugPrivilege	1168	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
Token: SeDebugPrivilege	1168	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
Token: SeDebugPrivilege	1168	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
Token: SeDebugPrivilege	1168	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
Token: 33	2000	mmc.exe
Token: SeIncBasePriorityPrivilege	2000	mmc.exe
Token: 33	2000	mmc.exe
Token: SeIncBasePriorityPrivilege	2000	mmc.exe
Token: 33	2000	mmc.exe
Token: SeIncBasePriorityPrivilege	2000	mmc.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
2016	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
2016	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
1168	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
524	icsys.icn.exe
524	icsys.icn.exe
2000	mmc.exe
1520	explorer.exe
2000	mmc.exe
1520	explorer.exe
1488	spoolsv.exe
1488	spoolsv.exe
1568	svchost.exe
1568	svchost.exe
1944	spoolsv.exe
1944	spoolsv.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1168	2016	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe	26
PID 2016 wrote to memory of 1168	2016	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe	26
PID 2016 wrote to memory of 1168	2016	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe	26
PID 2016 wrote to memory of 1168	2016	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe	26
PID 1168 wrote to memory of 1244	1168	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe	16
PID 1168 wrote to memory of 1332	1168	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe	10
PID 1168 wrote to memory of 1368	1168	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe	15
PID 1168 wrote to memory of 2016	1168	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe	25
PID 1168 wrote to memory of 2016	1168	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe	25
PID 1168 wrote to memory of 2000	1168	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe	27
PID 1168 wrote to memory of 2000	1168	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe	27
PID 1168 wrote to memory of 2000	1168	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe	27
PID 1168 wrote to memory of 2000	1168	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe	27
PID 2016 wrote to memory of 524	2016	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe	28
PID 2016 wrote to memory of 524	2016	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe	28
PID 2016 wrote to memory of 524	2016	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe	28
PID 2016 wrote to memory of 524	2016	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe	28
PID 524 wrote to memory of 1520	524	icsys.icn.exe	29
PID 524 wrote to memory of 1520	524	icsys.icn.exe	29
PID 524 wrote to memory of 1520	524	icsys.icn.exe	29
PID 524 wrote to memory of 1520	524	icsys.icn.exe	29
PID 1520 wrote to memory of 1488	1520	explorer.exe	30
PID 1520 wrote to memory of 1488	1520	explorer.exe	30
PID 1520 wrote to memory of 1488	1520	explorer.exe	30
PID 1520 wrote to memory of 1488	1520	explorer.exe	30
PID 1488 wrote to memory of 1568	1488	spoolsv.exe	31
PID 1488 wrote to memory of 1568	1488	spoolsv.exe	31
PID 1488 wrote to memory of 1568	1488	spoolsv.exe	31
PID 1488 wrote to memory of 1568	1488	spoolsv.exe	31
PID 1568 wrote to memory of 1944	1568	svchost.exe	32
PID 1568 wrote to memory of 1944	1568	svchost.exe	32
PID 1568 wrote to memory of 1944	1568	svchost.exe	32
PID 1568 wrote to memory of 1944	1568	svchost.exe	32
PID 1520 wrote to memory of 288	1520	explorer.exe	33
PID 1520 wrote to memory of 288	1520	explorer.exe	33
PID 1520 wrote to memory of 288	1520	explorer.exe	33
PID 1520 wrote to memory of 288	1520	explorer.exe	33
PID 1568 wrote to memory of 1016	1568	svchost.exe	34
PID 1568 wrote to memory of 1016	1568	svchost.exe	34
PID 1568 wrote to memory of 1016	1568	svchost.exe	34
PID 1568 wrote to memory of 1016	1568	svchost.exe	34
PID 1568 wrote to memory of 828	1568	svchost.exe	37
PID 1568 wrote to memory of 828	1568	svchost.exe	37
PID 1568 wrote to memory of 828	1568	svchost.exe	37
PID 1568 wrote to memory of 828	1568	svchost.exe	37
PID 1568 wrote to memory of 764	1568	svchost.exe	39
PID 1568 wrote to memory of 764	1568	svchost.exe	39
PID 1568 wrote to memory of 764	1568	svchost.exe	39
PID 1568 wrote to memory of 764	1568	svchost.exe	39

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1332

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1368
- C:\Users\Admin\AppData\Local\Temp\ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
  "C:\Users\Admin\AppData\Local\Temp\ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2016
- - \??\c:\users\admin\appdata\local\temp\ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
    c:\users\admin\appdata\local\temp\ad56812b6bd4014581b826824c25728b6e839dc847b00a0c98461055e78684dd.exe
    3⤵
    - Modifies firewall policy service
    - UAC bypass
    - Windows security bypass
    - Executes dropped EXE
    - Windows security modification
    - Checks whether UAC is enabled
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:1168
  - - C:\Windows\system32\mmc.exe
      "C:\Windows\system32\mmc.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2000
- - C:\Windows\Resources\Themes\icsys.icn.exe
    C:\Windows\Resources\Themes\icsys.icn.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:524
  - - \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in System32 directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1520
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1488
      - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        6⤵
        Modifies visiblity of hidden/system files in Explorer
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1568
        
        \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1944
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 01:18 /f
        7⤵
        Creates scheduled task(s)
        
        PID:1016
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 01:19 /f
        7⤵
        Creates scheduled task(s)
        
        PID:828
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 01:20 /f
        7⤵
        Creates scheduled task(s)
        
        PID:764
    - - C:\Windows\Explorer.exe
        
        C:\Windows\Explorer.exe
        5⤵
        
        PID:288

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1244

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

Hidden Files and Directories

T1158

Modify Registry