modiloader | c1eb5a438ecfb6a536d9b27fac94152105dcac9474415be4d52015d43a1b3c46

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry

Processes:

c1eb5a438ecfb6a536d9b27fac94152105dcac9474415be4d52015d43a1b3c46.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c1eb5a438ecfb6a536d9b27fac94152105dcac9474415be4d52015d43a1b3c46.exe

Windows security bypass 2 TTPs 1 IoCs

Disabling Security Tools

Modify Registry

Processes:

c1eb5a438ecfb6a536d9b27fac94152105dcac9474415be4d52015d43a1b3c46.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0"	c1eb5a438ecfb6a536d9b27fac94152105dcac9474415be4d52015d43a1b3c46.exe

ModiLoader Second Stage 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1192-135-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral2/memory/1192-134-0x0000000000000000-mapping.dmp	modiloader_stage2

Windows security modification 2 TTPs 1 IoCs

Disabling Security Tools

Modify Registry

Processes:

c1eb5a438ecfb6a536d9b27fac94152105dcac9474415be4d52015d43a1b3c46.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0"	c1eb5a438ecfb6a536d9b27fac94152105dcac9474415be4d52015d43a1b3c46.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

System Information Discovery

T1082

Processes:

c1eb5a438ecfb6a536d9b27fac94152105dcac9474415be4d52015d43a1b3c46.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c1eb5a438ecfb6a536d9b27fac94152105dcac9474415be4d52015d43a1b3c46.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

c1eb5a438ecfb6a536d9b27fac94152105dcac9474415be4d52015d43a1b3c46.exe

description	pid	process	target process
PID 3088 set thread context of 1192	3088	c1eb5a438ecfb6a536d9b27fac94152105dcac9474415be4d52015d43a1b3c46.exe	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

msedge.exemsedge.exe

pid process

4824 msedge.exe
4824 msedge.exe
1192 msedge.exe
1192 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

Processes:

msedge.exe

pid process

1192 msedge.exe
1192 msedge.exe
1192 msedge.exe
1192 msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

pid	process
4824	msedge.exe
4824	msedge.exe
1192	msedge.exe
1192	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

msedge.exe

pid	process
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

c1eb5a438ecfb6a536d9b27fac94152105dcac9474415be4d52015d43a1b3c46.exe

pid process

3088 c1eb5a438ecfb6a536d9b27fac94152105dcac9474415be4d52015d43a1b3c46.exe

pid	process
3088	c1eb5a438ecfb6a536d9b27fac94152105dcac9474415be4d52015d43a1b3c46.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

c1eb5a438ecfb6a536d9b27fac94152105dcac9474415be4d52015d43a1b3c46.exemsedge.exe

description	pid	process	target process
PID 3088 wrote to memory of 1192	3088	c1eb5a438ecfb6a536d9b27fac94152105dcac9474415be4d52015d43a1b3c46.exe	msedge.exe
PID 3088 wrote to memory of 1192	3088	c1eb5a438ecfb6a536d9b27fac94152105dcac9474415be4d52015d43a1b3c46.exe	msedge.exe
PID 3088 wrote to memory of 1192	3088	c1eb5a438ecfb6a536d9b27fac94152105dcac9474415be4d52015d43a1b3c46.exe	msedge.exe
PID 3088 wrote to memory of 1192	3088	c1eb5a438ecfb6a536d9b27fac94152105dcac9474415be4d52015d43a1b3c46.exe	msedge.exe
PID 3088 wrote to memory of 1192	3088	c1eb5a438ecfb6a536d9b27fac94152105dcac9474415be4d52015d43a1b3c46.exe	msedge.exe
PID 3088 wrote to memory of 1192	3088	c1eb5a438ecfb6a536d9b27fac94152105dcac9474415be4d52015d43a1b3c46.exe	msedge.exe
PID 3088 wrote to memory of 1192	3088	c1eb5a438ecfb6a536d9b27fac94152105dcac9474415be4d52015d43a1b3c46.exe	msedge.exe
PID 3088 wrote to memory of 1192	3088	c1eb5a438ecfb6a536d9b27fac94152105dcac9474415be4d52015d43a1b3c46.exe	msedge.exe
PID 3088 wrote to memory of 1192	3088	c1eb5a438ecfb6a536d9b27fac94152105dcac9474415be4d52015d43a1b3c46.exe	msedge.exe
PID 3088 wrote to memory of 1192	3088	c1eb5a438ecfb6a536d9b27fac94152105dcac9474415be4d52015d43a1b3c46.exe	msedge.exe
PID 3088 wrote to memory of 1192	3088	c1eb5a438ecfb6a536d9b27fac94152105dcac9474415be4d52015d43a1b3c46.exe	msedge.exe
PID 3088 wrote to memory of 1192	3088	c1eb5a438ecfb6a536d9b27fac94152105dcac9474415be4d52015d43a1b3c46.exe	msedge.exe
PID 1192 wrote to memory of 3136	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 3136	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 4728	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 4728	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 4728	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 4728	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 4728	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 4728	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 4728	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 4728	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 4728	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 4728	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 4728	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 4728	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 4728	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 4728	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 4728	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 4728	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 4728	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 4728	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 4728	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 4728	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 4728	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 4728	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 4728	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 4728	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 4728	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 4728	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 4728	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 4728	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 4728	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 4728	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 4728	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 4728	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 4728	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 4728	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 4728	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 4728	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 4728	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 4728	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 4728	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 4728	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 4824	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 4824	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 1804	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 1804	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 1804	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 1804	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 1804	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 1804	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 1804	1192	msedge.exe	msedge.exe
PID 1192 wrote to memory of 1804	1192	msedge.exe	msedge.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

Processes:

c1eb5a438ecfb6a536d9b27fac94152105dcac9474415be4d52015d43a1b3c46.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c1eb5a438ecfb6a536d9b27fac94152105dcac9474415be4d52015d43a1b3c46.exe

C:\Users\Admin\AppData\Local\Temp\c1eb5a438ecfb6a536d9b27fac94152105dcac9474415be4d52015d43a1b3c46.exe
"C:\Users\Admin\AppData\Local\Temp\c1eb5a438ecfb6a536d9b27fac94152105dcac9474415be4d52015d43a1b3c46.exe"
1⤵
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
2⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xf8,0x108,0x7fff26bf46f8,0x7fff26bf4708,0x7fff26bf4718
3⤵
PID:3136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,12596554291292205721,4594803202535526543,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
3⤵
PID:4728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,12596554291292205721,4594803202535526543,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,12596554291292205721,4594803202535526543,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
3⤵
PID:1804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12596554291292205721,4594803202535526543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:1
3⤵
PID:4652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12596554291292205721,4594803202535526543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
3⤵
PID:4736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12596554291292205721,4594803202535526543,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
3⤵
PID:4820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2104,12596554291292205721,4594803202535526543,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5828 /prefetch:8
3⤵
PID:2092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2104,12596554291292205721,4594803202535526543,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5964 /prefetch:8
3⤵
PID:3964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12596554291292205721,4594803202535526543,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:1
3⤵
PID:2248

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,12596554291292205721,4594803202535526543,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5844 /prefetch:8
3⤵
PID:4844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3420

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

3

Modify Registry

4