gh0strat | 8ad50e2cd339bb8033e62937f73308441bdbe8acf61ad9edd1489eb35f3a2895

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

Processes:

server.exegtthp.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	server.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	server.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	gtthp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	gtthp.exe

Windows security bypass 2 TTPs 2 IoCs

Disabling Security Tools

T1089

Modify Registry

Processes:

server.exegtthp.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0"	server.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0"	gtthp.exe

Downloads MZ/PE file
Executes dropped EXE 4 IoCs

Processes:

Kcyyqug.exeKcyyqug.exeserver.exegtthp.exe

pid process

928 Kcyyqug.exe
1616 Kcyyqug.exe
2036 server.exe
932 gtthp.exe
Loads dropped DLL 1 IoCs

Processes:

server.exe

pid process

2036 server.exe

pid	process
928	Kcyyqug.exe
1616	Kcyyqug.exe
2036	server.exe
932	gtthp.exe

pid	process
2036	server.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Program Files (x86)\Kcyyqug.exe	upx
behavioral1/memory/928-65-0x0000000000400000-0x0000000000463000-memory.dmp	upx
behavioral1/memory/1708-64-0x0000000000400000-0x0000000000463000-memory.dmp	upx
C:\Program Files (x86)\Kcyyqug.exe	upx
C:\Program Files (x86)\Kcyyqug.exe	upx
behavioral1/memory/1616-72-0x0000000000400000-0x0000000000463000-memory.dmp	upx

Windows security modification 2 TTPs 2 IoCs

Disabling Security Tools

T1089

Modify Registry

Processes:

server.exegtthp.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0"	server.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0"	gtthp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

server.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\gtthp.exe = "C:\\Windows\\WindowsUpdate\\gtthp.exe"	server.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

System Information Discovery

Processes:

server.exegtthp.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	server.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	gtthp.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

f1ec2cf6256a7c8543586065a07da47a.exe

description	ioc	process
File opened (read-only)	\??\P:	f1ec2cf6256a7c8543586065a07da47a.exe
File opened (read-only)	\??\Q:	f1ec2cf6256a7c8543586065a07da47a.exe
File opened (read-only)	\??\G:	f1ec2cf6256a7c8543586065a07da47a.exe
File opened (read-only)	\??\H:	f1ec2cf6256a7c8543586065a07da47a.exe
File opened (read-only)	\??\I:	f1ec2cf6256a7c8543586065a07da47a.exe
File opened (read-only)	\??\J:	f1ec2cf6256a7c8543586065a07da47a.exe
File opened (read-only)	\??\K:	f1ec2cf6256a7c8543586065a07da47a.exe
File opened (read-only)	\??\B:	f1ec2cf6256a7c8543586065a07da47a.exe
File opened (read-only)	\??\M:	f1ec2cf6256a7c8543586065a07da47a.exe
File opened (read-only)	\??\N:	f1ec2cf6256a7c8543586065a07da47a.exe
File opened (read-only)	\??\U:	f1ec2cf6256a7c8543586065a07da47a.exe
File opened (read-only)	\??\F:	f1ec2cf6256a7c8543586065a07da47a.exe
File opened (read-only)	\??\L:	f1ec2cf6256a7c8543586065a07da47a.exe
File opened (read-only)	\??\V:	f1ec2cf6256a7c8543586065a07da47a.exe
File opened (read-only)	\??\W:	f1ec2cf6256a7c8543586065a07da47a.exe
File opened (read-only)	\??\X:	f1ec2cf6256a7c8543586065a07da47a.exe
File opened (read-only)	\??\E:	f1ec2cf6256a7c8543586065a07da47a.exe
File opened (read-only)	\??\O:	f1ec2cf6256a7c8543586065a07da47a.exe
File opened (read-only)	\??\R:	f1ec2cf6256a7c8543586065a07da47a.exe
File opened (read-only)	\??\S:	f1ec2cf6256a7c8543586065a07da47a.exe
File opened (read-only)	\??\T:	f1ec2cf6256a7c8543586065a07da47a.exe
File opened (read-only)	\??\Y:	f1ec2cf6256a7c8543586065a07da47a.exe
File opened (read-only)	\??\Z:	f1ec2cf6256a7c8543586065a07da47a.exe

Drops file in System32 directory 2 IoCs

Processes:

Kcyyqug.exeKcyyqug.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	Kcyyqug.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	Kcyyqug.exe

Drops file in Program Files directory 2 IoCs

Processes:

f1ec2cf6256a7c8543586065a07da47a.exe

description	ioc	process
File created	C:\Program Files (x86)\Kcyyqug.exe	f1ec2cf6256a7c8543586065a07da47a.exe
File opened for modification	C:\Program Files (x86)\Kcyyqug.exe	f1ec2cf6256a7c8543586065a07da47a.exe

Drops file in Windows directory 4 IoCs

Processes:

server.exegtthp.exe

description	ioc	process
File created	C:\Windows\WindowsUpdate\.temp.fortest	server.exe
File created	C:\Windows\WindowsUpdate\gtthp.exe	server.exe
File opened for modification	C:\Windows\WindowsUpdate\gtthp.exe	server.exe
File created	C:\Windows\WindowsUpdate\.temp.fortest	gtthp.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

Processes:

f1ec2cf6256a7c8543586065a07da47a.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	f1ec2cf6256a7c8543586065a07da47a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	f1ec2cf6256a7c8543586065a07da47a.exe

Modifies data under HKEY_USERS 25 IoCs

Processes:

Kcyyqug.exeKcyyqug.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	Kcyyqug.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	Kcyyqug.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	Kcyyqug.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	Kcyyqug.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Kcyyqug.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	Kcyyqug.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	Kcyyqug.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	Kcyyqug.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	Kcyyqug.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Kcyyqug.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	Kcyyqug.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	Kcyyqug.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Kcyyqug.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	Kcyyqug.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	Kcyyqug.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Kcyyqug.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	Kcyyqug.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	Kcyyqug.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	Kcyyqug.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Kcyyqug.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Kcyyqug.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	Kcyyqug.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Kcyyqug.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	Kcyyqug.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	Kcyyqug.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

f1ec2cf6256a7c8543586065a07da47a.exeKcyyqug.exeKcyyqug.exe

pid	process
1708	f1ec2cf6256a7c8543586065a07da47a.exe
1708	f1ec2cf6256a7c8543586065a07da47a.exe
928	Kcyyqug.exe
928	Kcyyqug.exe
1616	Kcyyqug.exe
1616	Kcyyqug.exe
1708	f1ec2cf6256a7c8543586065a07da47a.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

server.exegtthp.exe

description pid process

Token: SeBackupPrivilege 2036 server.exe
Token: SeBackupPrivilege 932 gtthp.exe

description	pid	process
Token: SeBackupPrivilege	2036	server.exe
Token: SeBackupPrivilege	932	gtthp.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Kcyyqug.exef1ec2cf6256a7c8543586065a07da47a.exeserver.exe

description	pid	process	target process
PID 928 wrote to memory of 1616	928	Kcyyqug.exe	Kcyyqug.exe
PID 928 wrote to memory of 1616	928	Kcyyqug.exe	Kcyyqug.exe
PID 928 wrote to memory of 1616	928	Kcyyqug.exe	Kcyyqug.exe
PID 928 wrote to memory of 1616	928	Kcyyqug.exe	Kcyyqug.exe
PID 1708 wrote to memory of 2036	1708	f1ec2cf6256a7c8543586065a07da47a.exe	server.exe
PID 1708 wrote to memory of 2036	1708	f1ec2cf6256a7c8543586065a07da47a.exe	server.exe
PID 1708 wrote to memory of 2036	1708	f1ec2cf6256a7c8543586065a07da47a.exe	server.exe
PID 1708 wrote to memory of 2036	1708	f1ec2cf6256a7c8543586065a07da47a.exe	server.exe
PID 2036 wrote to memory of 932	2036	server.exe	gtthp.exe
PID 2036 wrote to memory of 932	2036	server.exe	gtthp.exe
PID 2036 wrote to memory of 932	2036	server.exe	gtthp.exe
PID 2036 wrote to memory of 932	2036	server.exe	gtthp.exe

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

Processes:

gtthp.exeserver.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	gtthp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	server.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	server.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	gtthp.exe

C:\Users\Admin\AppData\Local\Temp\f1ec2cf6256a7c8543586065a07da47a.exe
"C:\Users\Admin\AppData\Local\Temp\f1ec2cf6256a7c8543586065a07da47a.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1708
- \??\c:\server.exe
  c:\server.exe
  2⤵
  - UAC bypass
  - Windows security bypass
  - Executes dropped EXE
  - Loads dropped DLL
  - Windows security modification
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2036
- - C:\Windows\WindowsUpdate\gtthp.exe
    C:\Windows\WindowsUpdate\gtthp.exe
    3⤵
    - UAC bypass
    - Windows security bypass
    - Executes dropped EXE
    - Windows security modification
    - Checks whether UAC is enabled
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:932

C:\Program Files (x86)\Kcyyqug.exe
"C:\Program Files (x86)\Kcyyqug.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:928
- C:\Program Files (x86)\Kcyyqug.exe
  "C:\Program Files (x86)\Kcyyqug.exe" Win7
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1616

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3