ramnit | 12af93d29007b28f8e5cd5db210de0b91e0e84ca318893a79d0efc11f813fb9d

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	yuhdkxje.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	yuhdkxje.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	yuhdkxje.exe

Modifies security service 2 TTPs 3 IoCs

evasion

Modify Registry

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	yuhdkxje.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	yuhdkxje.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mpssvc\Start = "4"	yuhdkxje.exe

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

UAC bypass 3 TTPs 1 IoCs

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yuhdkxje.exe

Windows security bypass 2 TTPs 6 IoCs

Disabling Security Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	yuhdkxje.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	yuhdkxje.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	yuhdkxje.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	yuhdkxje.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	yuhdkxje.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	yuhdkxje.exe

Executes dropped EXE 6 IoCs

pid	Process
3208	rvtql1X1e
4420	rvtql1X1e
1376	yuhdkxje.exe
2028	yuhdkxje.exe
2588	yuhdkxje.exe
2100	yuhdkxje.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4420-142-0x0000000000400000-0x0000000000436000-memory.dmp	upx
behavioral2/memory/4420-146-0x0000000000400000-0x0000000000436000-memory.dmp	upx
behavioral2/memory/4420-147-0x0000000000400000-0x0000000000436000-memory.dmp	upx
behavioral2/memory/4420-150-0x0000000000400000-0x0000000000436000-memory.dmp	upx
behavioral2/memory/4420-156-0x0000000000400000-0x0000000000436000-memory.dmp	upx
behavioral2/memory/2028-168-0x0000000000400000-0x0000000000436000-memory.dmp	upx
behavioral2/memory/2100-184-0x0000000000400000-0x0000000000436000-memory.dmp	upx

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	yuhdkxje.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	rvtql1X1e

Windows security modification 2 TTPs 6 IoCs

Disabling Security Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	yuhdkxje.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	yuhdkxje.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	yuhdkxje.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	yuhdkxje.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	yuhdkxje.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	yuhdkxje.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yuhdkxje.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3208 set thread context of 4420	3208	rvtql1X1e	80
PID 1376 set thread context of 2028	1376	yuhdkxje.exe	103
PID 2588 set thread context of 2100	2588	yuhdkxje.exe	107

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3356	4904	WerFault.exe	81
3076	3888	WerFault.exe	88

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2894066231"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2726095996"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31001618"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31001618"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377385163"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31001618"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2774845834"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{CD2297EC-7805-11ED-AECB-C2DBB15B3A76} = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2725940019"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31001618"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4296	IEXPLORE.EXE

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeSecurityPrivilege	4420	rvtql1X1e
Token: SeDebugPrivilege	4420	rvtql1X1e
Token: SeSecurityPrivilege	2028	yuhdkxje.exe
Token: SeSecurityPrivilege	2100	yuhdkxje.exe
Token: SeLoadDriverPrivilege	2100	yuhdkxje.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4296	IEXPLORE.EXE
4296	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
3208	rvtql1X1e
4296	IEXPLORE.EXE
4296	IEXPLORE.EXE
1688	IEXPLORE.EXE
1688	IEXPLORE.EXE
1688	IEXPLORE.EXE
1688	IEXPLORE.EXE
4296	IEXPLORE.EXE
4296	IEXPLORE.EXE
4360	IEXPLORE.EXE
4360	IEXPLORE.EXE
4360	IEXPLORE.EXE
4360	IEXPLORE.EXE
1376	yuhdkxje.exe
2588	yuhdkxje.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 3796	4512	rundll32.exe	78
PID 4512 wrote to memory of 3796	4512	rundll32.exe	78
PID 4512 wrote to memory of 3796	4512	rundll32.exe	78
PID 3796 wrote to memory of 3208	3796	rundll32.exe	79
PID 3796 wrote to memory of 3208	3796	rundll32.exe	79
PID 3796 wrote to memory of 3208	3796	rundll32.exe	79
PID 3208 wrote to memory of 4420	3208	rvtql1X1e	80
PID 3208 wrote to memory of 4420	3208	rvtql1X1e	80
PID 3208 wrote to memory of 4420	3208	rvtql1X1e	80
PID 3208 wrote to memory of 4420	3208	rvtql1X1e	80
PID 3208 wrote to memory of 4420	3208	rvtql1X1e	80
PID 3208 wrote to memory of 4420	3208	rvtql1X1e	80
PID 3208 wrote to memory of 4420	3208	rvtql1X1e	80
PID 4420 wrote to memory of 4904	4420	rvtql1X1e	81
PID 4420 wrote to memory of 4904	4420	rvtql1X1e	81
PID 4420 wrote to memory of 4904	4420	rvtql1X1e	81
PID 4420 wrote to memory of 4904	4420	rvtql1X1e	81
PID 4420 wrote to memory of 4904	4420	rvtql1X1e	81
PID 4420 wrote to memory of 4904	4420	rvtql1X1e	81
PID 4420 wrote to memory of 4904	4420	rvtql1X1e	81
PID 4420 wrote to memory of 4904	4420	rvtql1X1e	81
PID 4420 wrote to memory of 4904	4420	rvtql1X1e	81
PID 4420 wrote to memory of 4904	4420	rvtql1X1e	81
PID 4420 wrote to memory of 1648	4420	rvtql1X1e	85
PID 4420 wrote to memory of 1648	4420	rvtql1X1e	85
PID 4420 wrote to memory of 1648	4420	rvtql1X1e	85
PID 1648 wrote to memory of 4296	1648	iexplore.exe	86
PID 1648 wrote to memory of 4296	1648	iexplore.exe	86
PID 4296 wrote to memory of 1688	4296	IEXPLORE.EXE	87
PID 4296 wrote to memory of 1688	4296	IEXPLORE.EXE	87
PID 4296 wrote to memory of 1688	4296	IEXPLORE.EXE	87
PID 4420 wrote to memory of 3888	4420	rvtql1X1e	88
PID 4420 wrote to memory of 3888	4420	rvtql1X1e	88
PID 4420 wrote to memory of 3888	4420	rvtql1X1e	88
PID 4420 wrote to memory of 3888	4420	rvtql1X1e	88
PID 4420 wrote to memory of 3888	4420	rvtql1X1e	88
PID 4420 wrote to memory of 3888	4420	rvtql1X1e	88
PID 4420 wrote to memory of 3888	4420	rvtql1X1e	88
PID 4420 wrote to memory of 3888	4420	rvtql1X1e	88
PID 4420 wrote to memory of 3888	4420	rvtql1X1e	88
PID 4420 wrote to memory of 3888	4420	rvtql1X1e	88
PID 4420 wrote to memory of 1956	4420	rvtql1X1e	97
PID 4420 wrote to memory of 1956	4420	rvtql1X1e	97
PID 4420 wrote to memory of 1956	4420	rvtql1X1e	97
PID 1956 wrote to memory of 3316	1956	iexplore.exe	98
PID 1956 wrote to memory of 3316	1956	iexplore.exe	98
PID 4296 wrote to memory of 4360	4296	IEXPLORE.EXE	99
PID 4296 wrote to memory of 4360	4296	IEXPLORE.EXE	99
PID 4296 wrote to memory of 4360	4296	IEXPLORE.EXE	99
PID 4420 wrote to memory of 1376	4420	rvtql1X1e	102
PID 4420 wrote to memory of 1376	4420	rvtql1X1e	102
PID 4420 wrote to memory of 1376	4420	rvtql1X1e	102
PID 1376 wrote to memory of 2028	1376	yuhdkxje.exe	103
PID 1376 wrote to memory of 2028	1376	yuhdkxje.exe	103
PID 1376 wrote to memory of 2028	1376	yuhdkxje.exe	103
PID 1376 wrote to memory of 2028	1376	yuhdkxje.exe	103
PID 1376 wrote to memory of 2028	1376	yuhdkxje.exe	103
PID 1376 wrote to memory of 2028	1376	yuhdkxje.exe	103
PID 1376 wrote to memory of 2028	1376	yuhdkxje.exe	103
PID 2028 wrote to memory of 1272	2028	yuhdkxje.exe	104
PID 2028 wrote to memory of 1272	2028	yuhdkxje.exe	104
PID 2028 wrote to memory of 1272	2028	yuhdkxje.exe	104
PID 1272 wrote to memory of 2588	1272	cmd.exe	106
PID 1272 wrote to memory of 2588	1272	cmd.exe	106

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yuhdkxje.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\12af93d29007b28f8e5cd5db210de0b91e0e84ca318893a79d0efc11f813fb9d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\12af93d29007b28f8e5cd5db210de0b91e0e84ca318893a79d0efc11f813fb9d.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3796
- - C:\Users\Admin\AppData\Local\Temp\rvtql1X1e
    "rvtql1X1e"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3208
  - - C:\Users\Admin\AppData\Local\Temp\rvtql1X1e
      "rvtql1X1e"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4420
    - - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        5⤵
        
        PID:4904
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 204
        6⤵
        Program crash
        
        PID:3356
    - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
        
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1648
      - C:\Program Files\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
        6⤵
        Modifies Internet Explorer settings
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4296
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4296 CREDAT:17410 /prefetch:2
        7⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1688
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4296 CREDAT:82950 /prefetch:2
        7⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:4360
    - - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        5⤵
        
        PID:3888
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 204
        6⤵
        Program crash
        
        PID:3076
    - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
        
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1956
      - C:\Program Files\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
        6⤵
        Modifies Internet Explorer settings
        
        PID:3316
    - - C:\Users\Admin\AppData\Local\Temp\yuhdkxje.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yuhdkxje.exe" elevate
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1376
      - C:\Users\Admin\AppData\Local\Temp\yuhdkxje.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yuhdkxje.exe" elevate
        6⤵
        Executes dropped EXE
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2028
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\yuhdkxje.exe"" admin
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1272
        
        C:\Users\Admin\AppData\Local\Temp\yuhdkxje.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yuhdkxje.exe" admin
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\yuhdkxje.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yuhdkxje.exe" admin
        9⤵
        Modifies firewall policy service
        Modifies security service
        UAC bypass
        Windows security bypass
        Executes dropped EXE
        Windows security modification
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4904 -ip 4904
1⤵
PID:4852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3888 -ip 3888
1⤵
PID:3044

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry