xpertrat | 79df6cbb29cb39554f1061d71437c0c5b6351a398abcece971653b90f7d13216

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry

Processes:

FIX.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	FIX.exe

Windows security bypass 2 TTPs 1 IoCs

Disabling Security Tools

Modify Registry

Processes:

FIX.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0"	FIX.exe

XpertRAT
XpertRAT is a remote access trojan with various capabilities.
rat xpertrat

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

iexplore.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\A440L3X3-W3L2-L8R1-T2B2-T227F2P4U7V3 = "C:\\Users\\Admin\\AppData\\Roaming\\A440L3X3-W3L2-L8R1-T2B2-T227F2P4U7V3\\A440L3X3-W3L2-L8R1-T2B2-T227F2P4U7V3.exe"	iexplore.exe

Executes dropped EXE 4 IoCs

Processes:

Black Inject.exeDOWS.exeFIX.exeFIX.exe

pid	Process
916	Black Inject.exe
1448	DOWS.exe
1712	FIX.exe
1380	FIX.exe

Loads dropped DLL 14 IoCs

Processes:

79df6cbb29cb39554f1061d71437c0c5b6351a398abcece971653b90f7d13216.exeDOWS.exeFIX.exeFIX.exe

pid	Process
896	79df6cbb29cb39554f1061d71437c0c5b6351a398abcece971653b90f7d13216.exe
896	79df6cbb29cb39554f1061d71437c0c5b6351a398abcece971653b90f7d13216.exe
896	79df6cbb29cb39554f1061d71437c0c5b6351a398abcece971653b90f7d13216.exe
1448	DOWS.exe
1448	DOWS.exe
1448	DOWS.exe
1448	DOWS.exe
1712	FIX.exe
1712	FIX.exe
1712	FIX.exe
1712	FIX.exe
1380	FIX.exe
1380	FIX.exe
1380	FIX.exe

Windows security modification 2 TTPs 1 IoCs

Disabling Security Tools

Modify Registry

Processes:

FIX.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0"	FIX.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

iexplore.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\A440L3X3-W3L2-L8R1-T2B2-T227F2P4U7V3 = "C:\\Users\\Admin\\AppData\\Roaming\\A440L3X3-W3L2-L8R1-T2B2-T227F2P4U7V3\\A440L3X3-W3L2-L8R1-T2B2-T227F2P4U7V3.exe"	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\A440L3X3-W3L2-L8R1-T2B2-T227F2P4U7V3 = "C:\\Users\\Admin\\AppData\\Roaming\\A440L3X3-W3L2-L8R1-T2B2-T227F2P4U7V3\\A440L3X3-W3L2-L8R1-T2B2-T227F2P4U7V3.exe"	iexplore.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

System Information Discovery

T1082

Processes:

FIX.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	FIX.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

FIX.exeFIX.exe

description	pid	Process	procid_target
PID 1712 set thread context of 1380	1712	FIX.exe	30
PID 1380 set thread context of 1912	1380	FIX.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

iexplore.exe

description	pid	Process
Token: SeDebugPrivilege	1912	iexplore.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

79df6cbb29cb39554f1061d71437c0c5b6351a398abcece971653b90f7d13216.exeBlack Inject.exeFIX.exeFIX.exeiexplore.exe

pid	Process
896	79df6cbb29cb39554f1061d71437c0c5b6351a398abcece971653b90f7d13216.exe
916	Black Inject.exe
1712	FIX.exe
1380	FIX.exe
1912	iexplore.exe

Suspicious use of WriteProcessMemory 49 IoCs

Processes:

79df6cbb29cb39554f1061d71437c0c5b6351a398abcece971653b90f7d13216.exeDOWS.exeFIX.exeFIX.exeiexplore.exe

description	pid	Process	procid_target
PID 896 wrote to memory of 916	896	79df6cbb29cb39554f1061d71437c0c5b6351a398abcece971653b90f7d13216.exe	27
PID 896 wrote to memory of 916	896	79df6cbb29cb39554f1061d71437c0c5b6351a398abcece971653b90f7d13216.exe	27
PID 896 wrote to memory of 916	896	79df6cbb29cb39554f1061d71437c0c5b6351a398abcece971653b90f7d13216.exe	27
PID 896 wrote to memory of 916	896	79df6cbb29cb39554f1061d71437c0c5b6351a398abcece971653b90f7d13216.exe	27
PID 896 wrote to memory of 1448	896	79df6cbb29cb39554f1061d71437c0c5b6351a398abcece971653b90f7d13216.exe	28
PID 896 wrote to memory of 1448	896	79df6cbb29cb39554f1061d71437c0c5b6351a398abcece971653b90f7d13216.exe	28
PID 896 wrote to memory of 1448	896	79df6cbb29cb39554f1061d71437c0c5b6351a398abcece971653b90f7d13216.exe	28
PID 896 wrote to memory of 1448	896	79df6cbb29cb39554f1061d71437c0c5b6351a398abcece971653b90f7d13216.exe	28
PID 896 wrote to memory of 1448	896	79df6cbb29cb39554f1061d71437c0c5b6351a398abcece971653b90f7d13216.exe	28
PID 896 wrote to memory of 1448	896	79df6cbb29cb39554f1061d71437c0c5b6351a398abcece971653b90f7d13216.exe	28
PID 896 wrote to memory of 1448	896	79df6cbb29cb39554f1061d71437c0c5b6351a398abcece971653b90f7d13216.exe	28
PID 1448 wrote to memory of 1712	1448	DOWS.exe	29
PID 1448 wrote to memory of 1712	1448	DOWS.exe	29
PID 1448 wrote to memory of 1712	1448	DOWS.exe	29
PID 1448 wrote to memory of 1712	1448	DOWS.exe	29
PID 1448 wrote to memory of 1712	1448	DOWS.exe	29
PID 1448 wrote to memory of 1712	1448	DOWS.exe	29
PID 1448 wrote to memory of 1712	1448	DOWS.exe	29
PID 1712 wrote to memory of 1380	1712	FIX.exe	30
PID 1712 wrote to memory of 1380	1712	FIX.exe	30
PID 1712 wrote to memory of 1380	1712	FIX.exe	30
PID 1712 wrote to memory of 1380	1712	FIX.exe	30
PID 1712 wrote to memory of 1380	1712	FIX.exe	30
PID 1712 wrote to memory of 1380	1712	FIX.exe	30
PID 1712 wrote to memory of 1380	1712	FIX.exe	30
PID 1712 wrote to memory of 1380	1712	FIX.exe	30
PID 1712 wrote to memory of 1380	1712	FIX.exe	30
PID 1712 wrote to memory of 1380	1712	FIX.exe	30
PID 1712 wrote to memory of 1380	1712	FIX.exe	30
PID 1380 wrote to memory of 1912	1380	FIX.exe	32
PID 1380 wrote to memory of 1912	1380	FIX.exe	32
PID 1380 wrote to memory of 1912	1380	FIX.exe	32
PID 1380 wrote to memory of 1912	1380	FIX.exe	32
PID 1380 wrote to memory of 1912	1380	FIX.exe	32
PID 1380 wrote to memory of 1912	1380	FIX.exe	32
PID 1380 wrote to memory of 1912	1380	FIX.exe	32
PID 1380 wrote to memory of 1912	1380	FIX.exe	32
PID 1380 wrote to memory of 1912	1380	FIX.exe	32
PID 1380 wrote to memory of 1912	1380	FIX.exe	32
PID 1380 wrote to memory of 1912	1380	FIX.exe	32
PID 1380 wrote to memory of 1912	1380	FIX.exe	32
PID 1912 wrote to memory of 1884	1912	iexplore.exe	33
PID 1912 wrote to memory of 1884	1912	iexplore.exe	33
PID 1912 wrote to memory of 1884	1912	iexplore.exe	33
PID 1912 wrote to memory of 1884	1912	iexplore.exe	33
PID 1912 wrote to memory of 1884	1912	iexplore.exe	33
PID 1912 wrote to memory of 1884	1912	iexplore.exe	33
PID 1912 wrote to memory of 1884	1912	iexplore.exe	33
PID 1912 wrote to memory of 1884	1912	iexplore.exe	33

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

Processes:

FIX.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	FIX.exe

C:\Users\Admin\AppData\Local\Temp\79df6cbb29cb39554f1061d71437c0c5b6351a398abcece971653b90f7d13216.exe
"C:\Users\Admin\AppData\Local\Temp\79df6cbb29cb39554f1061d71437c0c5b6351a398abcece971653b90f7d13216.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:896
- C:\Users\Admin\AppData\Local\Temp\Black Inject.exe
  "C:\Users\Admin\AppData\Local\Temp\Black Inject.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:916
- C:\Users\Admin\AppData\Local\Temp\DOWS.exe
  "C:\Users\Admin\AppData\Local\Temp\DOWS.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1448
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\FIX.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\FIX.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1712
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\FIX.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\FIX.exe"
      4⤵
      UAC bypass
      Windows security bypass
      Executes dropped EXE
      Loads dropped DLL
      Windows security modification
      Checks whether UAC is enabled
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:1380
    - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX0\FIX.exe
        5⤵
        Adds policy Run key to start application
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1912
      - C:\Windows\SysWOW64\notepad.exe
        
        notepad.exe
        6⤵
        
        PID:1884

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry