a0af844bcbd5df4371cf9d3c1829fbe40c1ebc5f79e2a6f98a4b688ef6132118

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a0af844bcbd5df4371cf9d3c1829fbe40c1ebc5f79e2a6f98a4b688ef6132118.exe

Windows security bypass 2 TTPs 1 IoCs

Disabling Security Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0"	a0af844bcbd5df4371cf9d3c1829fbe40c1ebc5f79e2a6f98a4b688ef6132118.exe

Windows security modification 2 TTPs 1 IoCs

Disabling Security Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0"	a0af844bcbd5df4371cf9d3c1829fbe40c1ebc5f79e2a6f98a4b688ef6132118.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a0af844bcbd5df4371cf9d3c1829fbe40c1ebc5f79e2a6f98a4b688ef6132118.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	a0af844bcbd5df4371cf9d3c1829fbe40c1ebc5f79e2a6f98a4b688ef6132118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	a0af844bcbd5df4371cf9d3c1829fbe40c1ebc5f79e2a6f98a4b688ef6132118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1524 set thread context of 4832	1524	a0af844bcbd5df4371cf9d3c1829fbe40c1ebc5f79e2a6f98a4b688ef6132118.exe	87

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeBackupPrivilege	1524	a0af844bcbd5df4371cf9d3c1829fbe40c1ebc5f79e2a6f98a4b688ef6132118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1524	a0af844bcbd5df4371cf9d3c1829fbe40c1ebc5f79e2a6f98a4b688ef6132118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 4832	1524	a0af844bcbd5df4371cf9d3c1829fbe40c1ebc5f79e2a6f98a4b688ef6132118.exe	87
PID 1524 wrote to memory of 4832	1524	a0af844bcbd5df4371cf9d3c1829fbe40c1ebc5f79e2a6f98a4b688ef6132118.exe	87
PID 1524 wrote to memory of 4832	1524	a0af844bcbd5df4371cf9d3c1829fbe40c1ebc5f79e2a6f98a4b688ef6132118.exe	87
PID 1524 wrote to memory of 4832	1524	a0af844bcbd5df4371cf9d3c1829fbe40c1ebc5f79e2a6f98a4b688ef6132118.exe	87
PID 1524 wrote to memory of 4832	1524	a0af844bcbd5df4371cf9d3c1829fbe40c1ebc5f79e2a6f98a4b688ef6132118.exe	87
PID 1524 wrote to memory of 4832	1524	a0af844bcbd5df4371cf9d3c1829fbe40c1ebc5f79e2a6f98a4b688ef6132118.exe	87
PID 1524 wrote to memory of 4832	1524	a0af844bcbd5df4371cf9d3c1829fbe40c1ebc5f79e2a6f98a4b688ef6132118.exe	87

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a0af844bcbd5df4371cf9d3c1829fbe40c1ebc5f79e2a6f98a4b688ef6132118.exe

C:\Users\Admin\AppData\Local\Temp\a0af844bcbd5df4371cf9d3c1829fbe40c1ebc5f79e2a6f98a4b688ef6132118.exe
"C:\Users\Admin\AppData\Local\Temp\a0af844bcbd5df4371cf9d3c1829fbe40c1ebc5f79e2a6f98a4b688ef6132118.exe"
1⤵
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1524
- C:\Users\Admin\AppData\Local\Temp\a0af844bcbd5df4371cf9d3c1829fbe40c1ebc5f79e2a6f98a4b688ef6132118.exe
  "C:\Users\Admin\AppData\Local\Temp\a0af844bcbd5df4371cf9d3c1829fbe40c1ebc5f79e2a6f98a4b688ef6132118.exe"
  2⤵
  PID:4832

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry