83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry

Processes:

svchost.exe83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe

Windows security bypass 2 TTPs 2 IoCs

Disabling Security Tools

Modify Registry

Processes:

svchost.exe83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0"	83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe

Executes dropped EXE 2 IoCs

Processes:

svchost.exesvchost.exe

pid process

268 svchost.exe
1304 svchost.exe

pid	process
268	svchost.exe
1304	svchost.exe

Drops startup file 2 IoCs

Processes:

svchost.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WordPad.exe	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WordPad.exe	svchost.exe

Loads dropped DLL 2 IoCs

Processes:

83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe

pid	process
460	83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe
460	83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe

Windows security modification 2 TTPs 2 IoCs

Disabling Security Tools

Modify Registry

Processes:

83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exesvchost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0"	83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0"	svchost.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

System Information Discovery

T1082

Processes:

83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exesvchost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exesvchost.exesvchost.exe

pid	process
1132	83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe
460	83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe
268	svchost.exe
1304	svchost.exe

Suspicious use of WriteProcessMemory 38 IoCs

Processes:

83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exesvchost.exe

description	pid	process	target process
PID 1132 wrote to memory of 460	1132	83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe	83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe
PID 1132 wrote to memory of 460	1132	83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe	83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe
PID 1132 wrote to memory of 460	1132	83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe	83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe
PID 1132 wrote to memory of 460	1132	83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe	83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe
PID 1132 wrote to memory of 460	1132	83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe	83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe
PID 1132 wrote to memory of 460	1132	83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe	83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe
PID 1132 wrote to memory of 460	1132	83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe	83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe
PID 1132 wrote to memory of 460	1132	83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe	83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe
PID 1132 wrote to memory of 460	1132	83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe	83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe
PID 1132 wrote to memory of 460	1132	83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe	83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe
PID 1132 wrote to memory of 460	1132	83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe	83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe
PID 1132 wrote to memory of 460	1132	83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe	83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe
PID 1132 wrote to memory of 460	1132	83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe	83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe
PID 1132 wrote to memory of 460	1132	83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe	83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe
PID 1132 wrote to memory of 460	1132	83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe	83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe
PID 460 wrote to memory of 268	460	83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe	svchost.exe
PID 460 wrote to memory of 268	460	83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe	svchost.exe
PID 460 wrote to memory of 268	460	83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe	svchost.exe
PID 460 wrote to memory of 268	460	83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe	svchost.exe
PID 268 wrote to memory of 1304	268	svchost.exe	svchost.exe
PID 268 wrote to memory of 1304	268	svchost.exe	svchost.exe
PID 268 wrote to memory of 1304	268	svchost.exe	svchost.exe
PID 268 wrote to memory of 1304	268	svchost.exe	svchost.exe
PID 268 wrote to memory of 1304	268	svchost.exe	svchost.exe
PID 268 wrote to memory of 1304	268	svchost.exe	svchost.exe
PID 268 wrote to memory of 1304	268	svchost.exe	svchost.exe
PID 268 wrote to memory of 1304	268	svchost.exe	svchost.exe
PID 268 wrote to memory of 1304	268	svchost.exe	svchost.exe
PID 268 wrote to memory of 1304	268	svchost.exe	svchost.exe
PID 268 wrote to memory of 1304	268	svchost.exe	svchost.exe
PID 268 wrote to memory of 1304	268	svchost.exe	svchost.exe
PID 268 wrote to memory of 1304	268	svchost.exe	svchost.exe
PID 268 wrote to memory of 1304	268	svchost.exe	svchost.exe
PID 268 wrote to memory of 1304	268	svchost.exe	svchost.exe
PID 460 wrote to memory of 1696	460	83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe	cmd.exe
PID 460 wrote to memory of 1696	460	83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe	cmd.exe
PID 460 wrote to memory of 1696	460	83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe	cmd.exe
PID 460 wrote to memory of 1696	460	83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe	cmd.exe

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

Processes:

svchost.exe83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	svchost.exe

C:\Users\Admin\AppData\Local\Temp\83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe
"C:\Users\Admin\AppData\Local\Temp\83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1132

C:\Users\Admin\AppData\Local\Temp\83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe
"C:\Users\Admin\AppData\Local\Temp\83f71770cfba923d1e8de4dc54ccb5429321467e26085788fce7b34162668e25.exe"
2⤵
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:460

C:\Users\Admin\AppData\Roaming\svchost.exe
C:\Users\Admin\AppData\Roaming\svchost.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:268

C:\Users\Admin\AppData\Roaming\svchost.exe
C:\Users\Admin\AppData\Roaming\svchost.exe
4⤵
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Drops startup file
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1304

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Melt.bat
3⤵
PID:1696

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

3

Modify Registry

4