ramnit | 30a6ca067df975818a69eb475901f7a2501e1a0883442ae01352a490d4cc8bed

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	vvtoslpd.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	vvtoslpd.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	vvtoslpd.exe

Modifies security service 2 TTPs 3 IoCs

evasion

Modify Registry

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	vvtoslpd.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mpssvc\Start = "4"	vvtoslpd.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	vvtoslpd.exe

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

UAC bypass 3 TTPs 1 IoCs

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	vvtoslpd.exe

Windows security bypass 2 TTPs 6 IoCs

Disabling Security Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	vvtoslpd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	vvtoslpd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	vvtoslpd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	vvtoslpd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	vvtoslpd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	vvtoslpd.exe

Executes dropped EXE 6 IoCs

pid	Process
2900	rvtql1X1e
1696	rvtql1X1e
1944	vvtoslpd.exe
3248	vvtoslpd.exe
3544	vvtoslpd.exe
644	vvtoslpd.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1696-142-0x0000000000400000-0x0000000000436000-memory.dmp	upx
behavioral2/memory/1696-145-0x0000000000400000-0x0000000000436000-memory.dmp	upx
behavioral2/memory/1696-147-0x0000000000400000-0x0000000000436000-memory.dmp	upx
behavioral2/memory/1696-150-0x0000000000400000-0x0000000000436000-memory.dmp	upx
behavioral2/memory/1696-159-0x0000000000400000-0x0000000000436000-memory.dmp	upx
behavioral2/memory/3248-172-0x0000000000400000-0x0000000000436000-memory.dmp	upx
behavioral2/memory/644-187-0x0000000000400000-0x0000000000436000-memory.dmp	upx

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	rvtql1X1e
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	vvtoslpd.exe

Windows security modification 2 TTPs 6 IoCs

Disabling Security Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	vvtoslpd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	vvtoslpd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	vvtoslpd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	vvtoslpd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	vvtoslpd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	vvtoslpd.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	vvtoslpd.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2900 set thread context of 1696	2900	rvtql1X1e	85
PID 1944 set thread context of 3248	1944	vvtoslpd.exe	107
PID 3544 set thread context of 644	3544	vvtoslpd.exe	111

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
796	4836	WerFault.exe	81
5108	4368	WerFault.exe	86
3392	1464	WerFault.exe	92

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "761227411"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377381527"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "761227411"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31001610"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "775132487"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31001610"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31001610"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "960759363"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31001610"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{58D21BB9-77FD-11ED-A0EE-5ECEF326E858} = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2252	IEXPLORE.EXE

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
648	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1696	rvtql1X1e
Token: SeDebugPrivilege	1696	rvtql1X1e
Token: SeSecurityPrivilege	3248	vvtoslpd.exe
Token: SeSecurityPrivilege	644	vvtoslpd.exe
Token: SeLoadDriverPrivilege	644	vvtoslpd.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
2900	rvtql1X1e
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE
216	IEXPLORE.EXE
216	IEXPLORE.EXE
216	IEXPLORE.EXE
216	IEXPLORE.EXE
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE
4720	IEXPLORE.EXE
4720	IEXPLORE.EXE
4720	IEXPLORE.EXE
4720	IEXPLORE.EXE
1944	vvtoslpd.exe
3544	vvtoslpd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 4836	4904	rundll32.exe	81
PID 4904 wrote to memory of 4836	4904	rundll32.exe	81
PID 4904 wrote to memory of 4836	4904	rundll32.exe	81
PID 4836 wrote to memory of 2900	4836	rundll32.exe	82
PID 4836 wrote to memory of 2900	4836	rundll32.exe	82
PID 4836 wrote to memory of 2900	4836	rundll32.exe	82
PID 2900 wrote to memory of 1696	2900	rvtql1X1e	85
PID 2900 wrote to memory of 1696	2900	rvtql1X1e	85
PID 2900 wrote to memory of 1696	2900	rvtql1X1e	85
PID 2900 wrote to memory of 1696	2900	rvtql1X1e	85
PID 2900 wrote to memory of 1696	2900	rvtql1X1e	85
PID 2900 wrote to memory of 1696	2900	rvtql1X1e	85
PID 2900 wrote to memory of 1696	2900	rvtql1X1e	85
PID 1696 wrote to memory of 4368	1696	rvtql1X1e	86
PID 1696 wrote to memory of 4368	1696	rvtql1X1e	86
PID 1696 wrote to memory of 4368	1696	rvtql1X1e	86
PID 1696 wrote to memory of 4368	1696	rvtql1X1e	86
PID 1696 wrote to memory of 4368	1696	rvtql1X1e	86
PID 1696 wrote to memory of 4368	1696	rvtql1X1e	86
PID 1696 wrote to memory of 4368	1696	rvtql1X1e	86
PID 1696 wrote to memory of 4368	1696	rvtql1X1e	86
PID 1696 wrote to memory of 4368	1696	rvtql1X1e	86
PID 1696 wrote to memory of 4368	1696	rvtql1X1e	86
PID 1696 wrote to memory of 1784	1696	rvtql1X1e	89
PID 1696 wrote to memory of 1784	1696	rvtql1X1e	89
PID 1696 wrote to memory of 1784	1696	rvtql1X1e	89
PID 1784 wrote to memory of 2252	1784	iexplore.exe	90
PID 1784 wrote to memory of 2252	1784	iexplore.exe	90
PID 2252 wrote to memory of 216	2252	IEXPLORE.EXE	91
PID 2252 wrote to memory of 216	2252	IEXPLORE.EXE	91
PID 2252 wrote to memory of 216	2252	IEXPLORE.EXE	91
PID 1696 wrote to memory of 1464	1696	rvtql1X1e	92
PID 1696 wrote to memory of 1464	1696	rvtql1X1e	92
PID 1696 wrote to memory of 1464	1696	rvtql1X1e	92
PID 1696 wrote to memory of 1464	1696	rvtql1X1e	92
PID 1696 wrote to memory of 1464	1696	rvtql1X1e	92
PID 1696 wrote to memory of 1464	1696	rvtql1X1e	92
PID 1696 wrote to memory of 1464	1696	rvtql1X1e	92
PID 1696 wrote to memory of 1464	1696	rvtql1X1e	92
PID 1696 wrote to memory of 1464	1696	rvtql1X1e	92
PID 1696 wrote to memory of 1464	1696	rvtql1X1e	92
PID 1696 wrote to memory of 1496	1696	rvtql1X1e	99
PID 1696 wrote to memory of 1496	1696	rvtql1X1e	99
PID 1696 wrote to memory of 1496	1696	rvtql1X1e	99
PID 1496 wrote to memory of 3952	1496	iexplore.exe	100
PID 1496 wrote to memory of 3952	1496	iexplore.exe	100
PID 2252 wrote to memory of 4720	2252	IEXPLORE.EXE	101
PID 2252 wrote to memory of 4720	2252	IEXPLORE.EXE	101
PID 2252 wrote to memory of 4720	2252	IEXPLORE.EXE	101
PID 1696 wrote to memory of 1944	1696	rvtql1X1e	106
PID 1696 wrote to memory of 1944	1696	rvtql1X1e	106
PID 1696 wrote to memory of 1944	1696	rvtql1X1e	106
PID 1944 wrote to memory of 3248	1944	vvtoslpd.exe	107
PID 1944 wrote to memory of 3248	1944	vvtoslpd.exe	107
PID 1944 wrote to memory of 3248	1944	vvtoslpd.exe	107
PID 1944 wrote to memory of 3248	1944	vvtoslpd.exe	107
PID 1944 wrote to memory of 3248	1944	vvtoslpd.exe	107
PID 1944 wrote to memory of 3248	1944	vvtoslpd.exe	107
PID 1944 wrote to memory of 3248	1944	vvtoslpd.exe	107
PID 3248 wrote to memory of 4312	3248	vvtoslpd.exe	108
PID 3248 wrote to memory of 4312	3248	vvtoslpd.exe	108
PID 3248 wrote to memory of 4312	3248	vvtoslpd.exe	108
PID 4312 wrote to memory of 3544	4312	cmd.exe	110
PID 4312 wrote to memory of 3544	4312	cmd.exe	110

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	vvtoslpd.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\30a6ca067df975818a69eb475901f7a2501e1a0883442ae01352a490d4cc8bed.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\30a6ca067df975818a69eb475901f7a2501e1a0883442ae01352a490d4cc8bed.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Users\Admin\AppData\Local\Temp\rvtql1X1e
    "rvtql1X1e"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2900
  - - C:\Users\Admin\AppData\Local\Temp\rvtql1X1e
      "rvtql1X1e"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1696
    - - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        5⤵
        
        PID:4368
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4368 -s 204
        6⤵
        Program crash
        
        PID:5108
    - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
        
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1784
      - C:\Program Files\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
        6⤵
        Modifies Internet Explorer settings
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2252
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2252 CREDAT:17410 /prefetch:2
        7⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:216
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2252 CREDAT:17416 /prefetch:2
        7⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:4720
    - - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        5⤵
        
        PID:1464
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1464 -s 204
        6⤵
        Program crash
        
        PID:3392
    - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
        
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1496
      - C:\Program Files\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
        6⤵
        Modifies Internet Explorer settings
        
        PID:3952
    - - C:\Users\Admin\AppData\Local\Temp\vvtoslpd.exe
        
        "C:\Users\Admin\AppData\Local\Temp\vvtoslpd.exe" elevate
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1944
      - C:\Users\Admin\AppData\Local\Temp\vvtoslpd.exe
        
        "C:\Users\Admin\AppData\Local\Temp\vvtoslpd.exe" elevate
        6⤵
        Executes dropped EXE
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3248
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\vvtoslpd.exe"" admin
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\vvtoslpd.exe
        
        "C:\Users\Admin\AppData\Local\Temp\vvtoslpd.exe" admin
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3544
        
        C:\Users\Admin\AppData\Local\Temp\vvtoslpd.exe
        
        "C:\Users\Admin\AppData\Local\Temp\vvtoslpd.exe" admin
        9⤵
        Modifies firewall policy service
        Modifies security service
        UAC bypass
        Windows security bypass
        Executes dropped EXE
        Windows security modification
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:644
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4836 -s 620
    3⤵
    - Program crash
    PID:796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4836 -ip 4836
1⤵
PID:4980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4368 -ip 4368
1⤵
PID:3060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1464 -ip 1464
1⤵
PID:3108

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry