modiloader | a1a84f0f2e2fe33545bb8b0895b81b0fe7e958798045f277e12b1748035c8db9

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	HPWuSchdb.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\system32\HPWuSchdb.exe = "C:\\Windows\\system32\\HPWuSchdb.exe:*:Enabled:Explorer"	HPWuSchdb.exe

UAC bypass 3 TTPs 1 IoCs

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	HPWuSchdb.exe

Windows security bypass 2 TTPs 1 IoCs

Disabling Security Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "1"	HPWuSchdb.exe

ModiLoader Second Stage 17 IoCs

resource	yara_rule
behavioral1/memory/1240-140-0x0000000000400000-0x000000000042C000-memory.dmp	modiloader_stage2
behavioral1/memory/1240-141-0x00000000004089B0-mapping.dmp	modiloader_stage2
behavioral1/memory/1240-143-0x0000000000400000-0x000000000042C000-memory.dmp	modiloader_stage2
behavioral1/memory/1240-145-0x0000000000400000-0x000000000042C000-memory.dmp	modiloader_stage2
behavioral1/memory/1240-148-0x0000000000400000-0x000000000042C000-memory.dmp	modiloader_stage2
behavioral1/memory/1240-150-0x0000000000400000-0x000000000042C000-memory.dmp	modiloader_stage2
behavioral1/memory/1240-152-0x0000000000400000-0x000000000042C000-memory.dmp	modiloader_stage2
behavioral1/memory/1240-154-0x0000000000400000-0x000000000042C000-memory.dmp	modiloader_stage2
behavioral1/memory/1240-156-0x0000000000400000-0x000000000042C000-memory.dmp	modiloader_stage2
behavioral1/memory/1240-158-0x0000000000400000-0x000000000042C000-memory.dmp	modiloader_stage2
behavioral1/memory/1240-160-0x0000000000400000-0x000000000042C000-memory.dmp	modiloader_stage2
behavioral1/memory/1240-162-0x0000000000400000-0x000000000042C000-memory.dmp	modiloader_stage2
behavioral1/memory/1240-164-0x0000000000400000-0x000000000042C000-memory.dmp	modiloader_stage2
behavioral1/memory/1240-190-0x0000000000400000-0x000000000042C000-memory.dmp	modiloader_stage2
behavioral1/memory/1356-196-0x00000000004089B0-mapping.dmp	modiloader_stage2
behavioral1/memory/1356-201-0x0000000000400000-0x000000000042C000-memory.dmp	modiloader_stage2
behavioral1/memory/1356-209-0x0000000000400000-0x000000000042C000-memory.dmp	modiloader_stage2

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reader_sl.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Adobe Reader Speed Launcher = "C:\\Windows\\reader_sl.exe"	reader_sl.exe

Executes dropped EXE 12 IoCs

pid	Process
2036	uninstall.exe
2016	A~NSISu_.exe
856	HPWuSchdb.exe
276	HPWuSchdb.exe
680	hp-357.exe
1484	reader_sl.exe
1900	hp-357.exe
1240	reader_sl.exe
1652	lsass.exe
668	lsass.exe
1700	reader_sl.exe
1356	reader_sl.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Q505INH8-GHF6-0703-7B60-R228UUF0136B}	reader_sl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Q505INH8-GHF6-0703-7B60-R228UUF0136B}\StubPath = "\"C:\\Windows\\reader_sl.exe\""	reader_sl.exe

Loads dropped DLL 29 IoCs

pid	Process
1724	a1a84f0f2e2fe33545bb8b0895b81b0fe7e958798045f277e12b1748035c8db9.exe
2036	uninstall.exe
2036	uninstall.exe
2036	uninstall.exe
2036	uninstall.exe
2016	A~NSISu_.exe
2016	A~NSISu_.exe
2016	A~NSISu_.exe
1724	a1a84f0f2e2fe33545bb8b0895b81b0fe7e958798045f277e12b1748035c8db9.exe
1724	a1a84f0f2e2fe33545bb8b0895b81b0fe7e958798045f277e12b1748035c8db9.exe
856	HPWuSchdb.exe
856	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
680	hp-357.exe
276	HPWuSchdb.exe
1484	reader_sl.exe
680	hp-357.exe
1900	hp-357.exe
1484	reader_sl.exe
1240	reader_sl.exe
1900	hp-357.exe
1900	hp-357.exe
1652	lsass.exe
1652	lsass.exe
668	lsass.exe
1240	reader_sl.exe

Windows security modification 2 TTPs 1 IoCs

Disabling Security Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "1"	HPWuSchdb.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	a1a84f0f2e2fe33545bb8b0895b81b0fe7e958798045f277e12b1748035c8db9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a1a84f0f2e2fe33545bb8b0895b81b0fe7e958798045f277e12b1748035c8db9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\HP Software Updater v1.1 = "C:\\Windows\\system32\\HPWuSchdb.exe"	HPWuSchdb.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	reader_sl.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Adobe Reader Speed Launcher = "C:\\Windows\\reader_sl.exe"	reader_sl.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	HPWuSchdb.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	HPWuSchdb.exe
File opened (read-only)	\??\K:	HPWuSchdb.exe
File opened (read-only)	\??\P:	HPWuSchdb.exe
File opened (read-only)	\??\H:	HPWuSchdb.exe
File opened (read-only)	\??\F:	HPWuSchdb.exe
File opened (read-only)	\??\G:	HPWuSchdb.exe
File opened (read-only)	\??\M:	HPWuSchdb.exe
File opened (read-only)	\??\R:	HPWuSchdb.exe
File opened (read-only)	\??\S:	HPWuSchdb.exe
File opened (read-only)	\??\W:	HPWuSchdb.exe
File opened (read-only)	\??\X:	HPWuSchdb.exe
File opened (read-only)	\??\E:	HPWuSchdb.exe
File opened (read-only)	\??\J:	HPWuSchdb.exe
File opened (read-only)	\??\L:	HPWuSchdb.exe
File opened (read-only)	\??\N:	HPWuSchdb.exe
File opened (read-only)	\??\Q:	HPWuSchdb.exe
File opened (read-only)	\??\T:	HPWuSchdb.exe
File opened (read-only)	\??\U:	HPWuSchdb.exe
File opened (read-only)	\??\V:	HPWuSchdb.exe
File opened (read-only)	\??\I:	HPWuSchdb.exe
File opened (read-only)	\??\Y:	HPWuSchdb.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\HPWuSchdb.exe	HPWuSchdb.exe
File created	C:\Windows\SysWOW64\hp-357.exe	HPWuSchdb.exe
File created	C:\Windows\SysWOW64\reader_sl.exe	HPWuSchdb.exe
File opened for modification	C:\Windows\SysWOW64\HPWuSchdb.exe	HPWuSchdb.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 856 set thread context of 276	856	HPWuSchdb.exe	30
PID 680 set thread context of 1900	680	hp-357.exe	33
PID 1484 set thread context of 1240	1484	reader_sl.exe	34
PID 1652 set thread context of 668	1652	lsass.exe	36
PID 1700 set thread context of 1356	1700	reader_sl.exe	38

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\program files\emule\incoming\G-Force Platinum v3.7.5.exe	HPWuSchdb.exe
File created	C:\program files\morpheus\my shared folder\Sophos antivirus updater bypass.exe	HPWuSchdb.exe
File created	C:\program files\grokster\my grokster\Tuneup Ultilities 2010.exe	HPWuSchdb.exe
File created	C:\program files\winmx\shared\Ashampoo Snap 3.02.exe	HPWuSchdb.exe
File created	C:\program files\emule\incoming\Google SketchUp 7.1 Pro.exe	HPWuSchdb.exe
File created	C:\program files\tesla\files\Daemon Tools Pro 4.11.exe	HPWuSchdb.exe
File created	C:\program files\tesla\files\Starcraft2 Patch v0.2.exe	HPWuSchdb.exe
File created	C:\program files\winmx\shared\Mp3 Splitter and Joiner Pro v3.48.exe	HPWuSchdb.exe
File created	C:\program files\grokster\my grokster\VmWare keygen.exe	HPWuSchdb.exe
File created	C:\program files\icq\shared folder\Magic Video Converter 8 0 2 18.exe	HPWuSchdb.exe
File created	C:\program files\icq\shared folder\Kaspersky AntiVirus 2010 crack.exe	HPWuSchdb.exe
File created	C:\program files\tesla\files\Myspace theme collection.exe	HPWuSchdb.exe
File created	C:\program files\tesla\files\Avast 4.8 Professional.exe	HPWuSchdb.exe
File created	C:\program files\tesla\files\Winamp.Pro.v7.33.PowerPack.Portable+installer.exe	HPWuSchdb.exe
File created	C:\program files\emule\incoming\Motorola, nokia, ericsson mobil phone tools.exe	HPWuSchdb.exe
File created	C:\program files\morpheus\my shared folder\Adobe Acrobat Reader keygen.exe	HPWuSchdb.exe
File created	C:\program files\winmx\shared\Rapidshare Auto Downloader 3.8.exe	HPWuSchdb.exe
File created	C:\program files\grokster\my grokster\Absolute Video Converter 6.2.exe	HPWuSchdb.exe
File created	C:\program files\emule\incoming\Starcraft2.exe	HPWuSchdb.exe
File created	C:\program files\limewire\shared\VmWare keygen.exe	HPWuSchdb.exe
File created	C:\program files\icq\shared folder\PDF-XChange Pro.exe	HPWuSchdb.exe
File created	C:\program files\winmx\shared\LimeWire Pro v4.18.3.exe	HPWuSchdb.exe
File opened for modification	C:\Program Files (x86)\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}\chrome\content\timer.xul	lsass.exe
File created	C:\program files\tesla\files\K-Lite Mega Codec v5.6.1 Portable.exe	HPWuSchdb.exe
File created	C:\program files\limewire\shared\Twitter FriendAdder 2.1.1.exe	HPWuSchdb.exe
File created	C:\program files\tesla\files\PDF to Word Converter 3.0.exe	HPWuSchdb.exe
File created	C:\Program Files (x86)\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}\install.rdf	hp-357.exe
File created	C:\program files\morpheus\my shared folder\Norton Anti-Virus 2010 Enterprise Crack.exe	HPWuSchdb.exe
File created	C:\program files\icq\shared folder\YouTubeGet 5.4.exe	HPWuSchdb.exe
File created	C:\program files\morpheus\my shared folder\Kaspersky AntiVirus 2010 crack.exe	HPWuSchdb.exe
File created	C:\program files\tesla\files\AnyDVD HD v.6.3.1.8 Beta incl crack.exe	HPWuSchdb.exe
File created	C:\program files\tesla\files\Super Utilities Pro 2009 11.0.exe	HPWuSchdb.exe
File created	C:\program files\winmx\shared\Adobe Photoshop CS4 crack.exe	HPWuSchdb.exe
File created	C:\program files\winmx\shared\Adobe Illustrator CS4 crack.exe	HPWuSchdb.exe
File created	C:\program files\icq\shared folder\Adobe Acrobat Reader keygen.exe	HPWuSchdb.exe
File created	C:\program files\morpheus\my shared folder\DVD Tools Nero 10.5.6.0.exe	HPWuSchdb.exe
File created	C:\program files\tesla\files\Divx Pro 7 + keymaker.exe	HPWuSchdb.exe
File created	C:\program files\winmx\shared\Daemon Tools Pro 4.11.exe	HPWuSchdb.exe
File created	C:\program files\winmx\shared\Kaspersky Internet Security 2010 keygen.exe	HPWuSchdb.exe
File created	C:\program files\emule\incoming\Absolute Video Converter 6.2.exe	HPWuSchdb.exe
File created	C:\program files\emule\incoming\Windows 2008 Enterprise Server VMWare Virtual Machine.exe	HPWuSchdb.exe
File created	C:\program files\emule\incoming\Adobe Acrobat Reader keygen.exe	HPWuSchdb.exe
File created	C:\program files\morpheus\my shared folder\Magic Video Converter 8 0 2 18.exe	HPWuSchdb.exe
File created	C:\program files\grokster\my grokster\Download Accelerator Plus v9.exe	HPWuSchdb.exe
File created	C:\program files\grokster\my grokster\Blaze DVD Player Pro v6.52.exe	HPWuSchdb.exe
File created	C:\program files\grokster\my grokster\Ad-aware 2010.exe	HPWuSchdb.exe
File created	C:\program files\limewire\shared\Rapidshare Auto Downloader 3.8.exe	HPWuSchdb.exe
File created	C:\program files\winmx\shared\PDF-XChange Pro.exe	HPWuSchdb.exe
File created	C:\program files\winmx\shared\Microsoft.Windows 7 ULTIMATE FINAL activator+keygen x86.exe	HPWuSchdb.exe
File created	C:\program files\icq\shared folder\VmWare 7.0 keygen.exe	HPWuSchdb.exe
File created	C:\program files\tesla\files\Adobe Photoshop CS4 crack.exe	HPWuSchdb.exe
File created	C:\program files\tesla\files\Starcraft2.exe	HPWuSchdb.exe
File created	C:\program files\icq\shared folder\VmWare keygen.exe	HPWuSchdb.exe
File created	C:\program files\tesla\files\Ashampoo Snap 3.02.exe	HPWuSchdb.exe
File created	C:\program files\tesla\files\Download Boost 2.0.exe	HPWuSchdb.exe
File created	C:\program files\winmx\shared\K-Lite Mega Codec v5.5.1.exe	HPWuSchdb.exe
File created	C:\program files\icq\shared folder\Super Utilities Pro 2009 11.0.exe	HPWuSchdb.exe
File created	C:\program files\icq\shared folder\Starcraft2 keys.txt.exe	HPWuSchdb.exe
File created	C:\program files\emule\incoming\Rapidshare Auto Downloader 3.8.exe	HPWuSchdb.exe
File created	C:\program files\morpheus\my shared folder\Microsoft.Windows 7 ULTIMATE FINAL activator+keygen x86.exe	HPWuSchdb.exe
File created	C:\program files\tesla\files\VmWare 7.0 keygen.exe	HPWuSchdb.exe
File created	C:\program files\icq\shared folder\Norton Anti-Virus 2010 Enterprise Crack.exe	HPWuSchdb.exe
File created	C:\program files\morpheus\my shared folder\Adobe Illustrator CS4 crack.exe	HPWuSchdb.exe
File created	C:\program files\limewire\shared\Starcraft2 Oblivion DLL.exe	HPWuSchdb.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\reader_sl.exe	reader_sl.exe
File opened for modification	C:\Windows\reader_sl.exe	reader_sl.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 12 IoCs

installer

resource	yara_rule
behavioral1/files/0x000c0000000122da-55.dat	nsis_installer_1
behavioral1/files/0x000c0000000122da-57.dat	nsis_installer_1
behavioral1/files/0x000c0000000122da-60.dat	nsis_installer_1
behavioral1/files/0x000c0000000122da-59.dat	nsis_installer_1
behavioral1/files/0x000c0000000122da-61.dat	nsis_installer_1
behavioral1/files/0x000c0000000122da-62.dat	nsis_installer_1
behavioral1/files/0x00080000000122e2-63.dat	nsis_installer_1
behavioral1/files/0x00080000000122e2-65.dat	nsis_installer_1
behavioral1/files/0x00080000000122e2-68.dat	nsis_installer_1
behavioral1/files/0x00080000000122e2-67.dat	nsis_installer_1
behavioral1/files/0x00080000000122e2-69.dat	nsis_installer_1
behavioral1/files/0x00080000000122e2-70.dat	nsis_installer_1

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe
276	HPWuSchdb.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	668	lsass.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
856	HPWuSchdb.exe
680	hp-357.exe
1484	reader_sl.exe
1652	lsass.exe
1700	reader_sl.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2036	1724	a1a84f0f2e2fe33545bb8b0895b81b0fe7e958798045f277e12b1748035c8db9.exe	27
PID 1724 wrote to memory of 2036	1724	a1a84f0f2e2fe33545bb8b0895b81b0fe7e958798045f277e12b1748035c8db9.exe	27
PID 1724 wrote to memory of 2036	1724	a1a84f0f2e2fe33545bb8b0895b81b0fe7e958798045f277e12b1748035c8db9.exe	27
PID 1724 wrote to memory of 2036	1724	a1a84f0f2e2fe33545bb8b0895b81b0fe7e958798045f277e12b1748035c8db9.exe	27
PID 1724 wrote to memory of 2036	1724	a1a84f0f2e2fe33545bb8b0895b81b0fe7e958798045f277e12b1748035c8db9.exe	27
PID 1724 wrote to memory of 2036	1724	a1a84f0f2e2fe33545bb8b0895b81b0fe7e958798045f277e12b1748035c8db9.exe	27
PID 1724 wrote to memory of 2036	1724	a1a84f0f2e2fe33545bb8b0895b81b0fe7e958798045f277e12b1748035c8db9.exe	27
PID 2036 wrote to memory of 2016	2036	uninstall.exe	28
PID 2036 wrote to memory of 2016	2036	uninstall.exe	28
PID 2036 wrote to memory of 2016	2036	uninstall.exe	28
PID 2036 wrote to memory of 2016	2036	uninstall.exe	28
PID 2036 wrote to memory of 2016	2036	uninstall.exe	28
PID 2036 wrote to memory of 2016	2036	uninstall.exe	28
PID 2036 wrote to memory of 2016	2036	uninstall.exe	28
PID 1724 wrote to memory of 856	1724	a1a84f0f2e2fe33545bb8b0895b81b0fe7e958798045f277e12b1748035c8db9.exe	29
PID 1724 wrote to memory of 856	1724	a1a84f0f2e2fe33545bb8b0895b81b0fe7e958798045f277e12b1748035c8db9.exe	29
PID 1724 wrote to memory of 856	1724	a1a84f0f2e2fe33545bb8b0895b81b0fe7e958798045f277e12b1748035c8db9.exe	29
PID 1724 wrote to memory of 856	1724	a1a84f0f2e2fe33545bb8b0895b81b0fe7e958798045f277e12b1748035c8db9.exe	29
PID 1724 wrote to memory of 856	1724	a1a84f0f2e2fe33545bb8b0895b81b0fe7e958798045f277e12b1748035c8db9.exe	29
PID 1724 wrote to memory of 856	1724	a1a84f0f2e2fe33545bb8b0895b81b0fe7e958798045f277e12b1748035c8db9.exe	29
PID 1724 wrote to memory of 856	1724	a1a84f0f2e2fe33545bb8b0895b81b0fe7e958798045f277e12b1748035c8db9.exe	29
PID 856 wrote to memory of 276	856	HPWuSchdb.exe	30
PID 856 wrote to memory of 276	856	HPWuSchdb.exe	30
PID 856 wrote to memory of 276	856	HPWuSchdb.exe	30
PID 856 wrote to memory of 276	856	HPWuSchdb.exe	30
PID 856 wrote to memory of 276	856	HPWuSchdb.exe	30
PID 856 wrote to memory of 276	856	HPWuSchdb.exe	30
PID 856 wrote to memory of 276	856	HPWuSchdb.exe	30
PID 856 wrote to memory of 276	856	HPWuSchdb.exe	30
PID 856 wrote to memory of 276	856	HPWuSchdb.exe	30
PID 856 wrote to memory of 276	856	HPWuSchdb.exe	30
PID 856 wrote to memory of 276	856	HPWuSchdb.exe	30
PID 856 wrote to memory of 276	856	HPWuSchdb.exe	30
PID 856 wrote to memory of 276	856	HPWuSchdb.exe	30
PID 856 wrote to memory of 276	856	HPWuSchdb.exe	30
PID 856 wrote to memory of 276	856	HPWuSchdb.exe	30
PID 276 wrote to memory of 680	276	HPWuSchdb.exe	31
PID 276 wrote to memory of 680	276	HPWuSchdb.exe	31
PID 276 wrote to memory of 680	276	HPWuSchdb.exe	31
PID 276 wrote to memory of 680	276	HPWuSchdb.exe	31
PID 276 wrote to memory of 680	276	HPWuSchdb.exe	31
PID 276 wrote to memory of 680	276	HPWuSchdb.exe	31
PID 276 wrote to memory of 680	276	HPWuSchdb.exe	31
PID 276 wrote to memory of 1484	276	HPWuSchdb.exe	32
PID 276 wrote to memory of 1484	276	HPWuSchdb.exe	32
PID 276 wrote to memory of 1484	276	HPWuSchdb.exe	32
PID 276 wrote to memory of 1484	276	HPWuSchdb.exe	32
PID 276 wrote to memory of 1484	276	HPWuSchdb.exe	32
PID 276 wrote to memory of 1484	276	HPWuSchdb.exe	32
PID 276 wrote to memory of 1484	276	HPWuSchdb.exe	32
PID 680 wrote to memory of 1900	680	hp-357.exe	33
PID 680 wrote to memory of 1900	680	hp-357.exe	33
PID 680 wrote to memory of 1900	680	hp-357.exe	33
PID 680 wrote to memory of 1900	680	hp-357.exe	33
PID 680 wrote to memory of 1900	680	hp-357.exe	33
PID 680 wrote to memory of 1900	680	hp-357.exe	33
PID 680 wrote to memory of 1900	680	hp-357.exe	33
PID 680 wrote to memory of 1900	680	hp-357.exe	33
PID 680 wrote to memory of 1900	680	hp-357.exe	33
PID 680 wrote to memory of 1900	680	hp-357.exe	33
PID 680 wrote to memory of 1900	680	hp-357.exe	33
PID 680 wrote to memory of 1900	680	hp-357.exe	33
PID 680 wrote to memory of 1900	680	hp-357.exe	33
PID 1484 wrote to memory of 1240	1484	reader_sl.exe	34

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	HPWuSchdb.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1348
- C:\Users\Admin\AppData\Local\Temp\a1a84f0f2e2fe33545bb8b0895b81b0fe7e958798045f277e12b1748035c8db9.exe
  "C:\Users\Admin\AppData\Local\Temp\a1a84f0f2e2fe33545bb8b0895b81b0fe7e958798045f277e12b1748035c8db9.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\uninstall.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\uninstall.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2036
  - - C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe
      "C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe" _?=C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2016
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPWuSchdb.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPWuSchdb.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:856
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPWuSchdb.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPWuSchdb.exe"
      4⤵
      Modifies firewall policy service
      UAC bypass
      Windows security bypass
      Executes dropped EXE
      Loads dropped DLL
      Windows security modification
      Adds Run key to start application
      Checks whether UAC is enabled
      Enumerates connected drives
      Drops file in System32 directory
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:276
    - - C:\Windows\SysWOW64\hp-357.exe
        
        "C:\Windows\system32\hp-357.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:680
      - C:\Windows\SysWOW64\hp-357.exe
        
        "C:\Windows\SysWOW64\hp-357.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        
        PID:1900
        
        C:\Users\Admin\AppData\Roaming\SystemProc\lsass.exe
        
        "C:\Users\Admin\AppData\Roaming\SystemProc\lsass.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1652
        
        C:\Users\Admin\AppData\Roaming\SystemProc\lsass.exe
        
        "C:\Users\Admin\AppData\Roaming\SystemProc\lsass.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:668
    - - C:\Windows\SysWOW64\reader_sl.exe
        
        "C:\Windows\system32\reader_sl.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1484
      - C:\Windows\SysWOW64\reader_sl.exe
        
        "C:\Windows\SysWOW64\reader_sl.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        
        PID:1240
        
        C:\Windows\reader_sl.exe
        
        "C:\Windows\reader_sl.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1700
        
        C:\Windows\reader_sl.exe
        
        "C:\Windows\reader_sl.exe"
        8⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        
        PID:1356
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:1924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry