sality | 1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	Au_.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	Au_.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	Au_.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 2 IoCs

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Au_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe

Windows security bypass 2 TTPs 12 IoCs

Disabling Security Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	Au_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	Au_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	Au_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	Au_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	Au_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	Au_.exe

Executes dropped EXE 2 IoCs

pid	Process
1120	Au_.exe
964	Au_.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1368-56-0x0000000001E50000-0x0000000002F0A000-memory.dmp	upx
behavioral1/memory/1368-57-0x0000000001E50000-0x0000000002F0A000-memory.dmp	upx
behavioral1/memory/1368-60-0x0000000004940000-0x00000000049E9000-memory.dmp	upx
behavioral1/memory/1368-68-0x0000000001E50000-0x0000000002F0A000-memory.dmp	upx
behavioral1/memory/964-76-0x0000000001ED0000-0x0000000002F8A000-memory.dmp	upx
behavioral1/memory/964-80-0x0000000001ED0000-0x0000000002F8A000-memory.dmp	upx

Loads dropped DLL 6 IoCs

pid	Process
1368	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe
1368	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe
1368	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe
1368	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe
1120	Au_.exe
1120	Au_.exe

Windows security modification 2 TTPs 14 IoCs

Disabling Security Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	Au_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	Au_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	Au_.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	Au_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	Au_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	Au_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	Au_.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Au_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Au_.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\6c4c8b	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe
File opened for modification	C:\Windows\SYSTEM.INI	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe
File created	C:\Windows\6c6a58	Au_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1368	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe
964	Au_.exe
1120	Au_.exe
1120	Au_.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeDebugPrivilege	1368	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe
Token: SeDebugPrivilege	1368	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe
Token: SeDebugPrivilege	1368	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe
Token: SeDebugPrivilege	1368	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe
Token: SeDebugPrivilege	1368	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe
Token: SeDebugPrivilege	1368	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe
Token: SeDebugPrivilege	1368	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe
Token: SeDebugPrivilege	1368	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe
Token: SeDebugPrivilege	1368	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe
Token: SeDebugPrivilege	1368	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe
Token: SeDebugPrivilege	1368	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe
Token: SeDebugPrivilege	1368	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe
Token: SeDebugPrivilege	1368	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe
Token: SeDebugPrivilege	1368	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe
Token: SeDebugPrivilege	1368	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe
Token: SeDebugPrivilege	1368	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe
Token: SeDebugPrivilege	1368	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe
Token: SeDebugPrivilege	1368	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe
Token: SeDebugPrivilege	1368	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe
Token: SeDebugPrivilege	1368	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe
Token: SeDebugPrivilege	964	Au_.exe
Token: SeDebugPrivilege	964	Au_.exe
Token: SeDebugPrivilege	964	Au_.exe
Token: SeDebugPrivilege	964	Au_.exe
Token: SeDebugPrivilege	964	Au_.exe
Token: SeDebugPrivilege	964	Au_.exe
Token: SeDebugPrivilege	964	Au_.exe
Token: SeDebugPrivilege	964	Au_.exe
Token: SeDebugPrivilege	964	Au_.exe
Token: SeDebugPrivilege	964	Au_.exe
Token: SeDebugPrivilege	964	Au_.exe
Token: SeDebugPrivilege	964	Au_.exe
Token: SeDebugPrivilege	964	Au_.exe
Token: SeDebugPrivilege	964	Au_.exe
Token: SeDebugPrivilege	964	Au_.exe
Token: SeDebugPrivilege	964	Au_.exe
Token: SeDebugPrivilege	964	Au_.exe
Token: SeDebugPrivilege	964	Au_.exe
Token: SeDebugPrivilege	964	Au_.exe
Token: SeDebugPrivilege	964	Au_.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 1260	1368	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe	11
PID 1368 wrote to memory of 1396	1368	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe	17
PID 1368 wrote to memory of 1424	1368	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe	12
PID 1368 wrote to memory of 1120	1368	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe	27
PID 1368 wrote to memory of 1120	1368	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe	27
PID 1368 wrote to memory of 1120	1368	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe	27
PID 1368 wrote to memory of 1120	1368	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe	27
PID 1368 wrote to memory of 1120	1368	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe	27
PID 1368 wrote to memory of 1120	1368	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe	27
PID 1368 wrote to memory of 1120	1368	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe	27
PID 1120 wrote to memory of 964	1120	Au_.exe	28
PID 1120 wrote to memory of 964	1120	Au_.exe	28
PID 1120 wrote to memory of 964	1120	Au_.exe	28
PID 1120 wrote to memory of 964	1120	Au_.exe	28
PID 1120 wrote to memory of 964	1120	Au_.exe	28
PID 1120 wrote to memory of 964	1120	Au_.exe	28
PID 1120 wrote to memory of 964	1120	Au_.exe	28
PID 964 wrote to memory of 1260	964	Au_.exe	11
PID 964 wrote to memory of 1396	964	Au_.exe	17
PID 964 wrote to memory of 1424	964	Au_.exe	12
PID 964 wrote to memory of 1120	964	Au_.exe	27
PID 964 wrote to memory of 1120	964	Au_.exe	27

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Au_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1260

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1424
- C:\Users\Admin\AppData\Local\Temp\1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe
  "C:\Users\Admin\AppData\Local\Temp\1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f.exe"
  2⤵
  - Modifies firewall policy service
  - UAC bypass
  - Windows security bypass
  - Loads dropped DLL
  - Windows security modification
  - Checks whether UAC is enabled
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1368
- - C:\Users\Admin\AppData\Local\Temp\wps\~6c4c7c\Au_.exe
    "C:\Users\Admin\AppData\Local\Temp\wps\~6c4c7c\Au_.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1120
  - - C:\Users\Admin\AppData\Local\Temp\wps\~6c4c7c\Au_.exe
      "C:\Users\Admin\AppData\Local\Temp\wps\~6c4c7c\Au_.exe" -downpower
      4⤵
      Modifies firewall policy service
      UAC bypass
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      Checks whether UAC is enabled
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:964

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1396

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry