gh0strat | 8ad50e2cd339bb8033e62937f73308441bdbe8acf61ad9edd1489eb35f3a2895

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry

Processes:

server.exeekzx.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	server.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	server.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ekzx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ekzx.exe

Windows security bypass 2 TTPs 2 IoCs

Disabling Security Tools

Modify Registry

Processes:

server.exeekzx.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0"	server.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0"	ekzx.exe

Downloads MZ/PE file
Executes dropped EXE 4 IoCs

Processes:

Kcyyqug.exeKcyyqug.exeserver.exeekzx.exe

pid process

1848 Kcyyqug.exe
1524 Kcyyqug.exe
972 server.exe
1576 ekzx.exe
Loads dropped DLL 1 IoCs

Processes:

server.exe

pid process

972 server.exe

pid	process
1848	Kcyyqug.exe
1524	Kcyyqug.exe
972	server.exe
1576	ekzx.exe

pid	process
972	server.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Program Files (x86)\Kcyyqug.exe	upx
behavioral1/memory/1388-61-0x0000000000400000-0x0000000000463000-memory.dmp	upx
behavioral1/memory/1848-62-0x0000000000400000-0x0000000000463000-memory.dmp	upx
C:\Program Files (x86)\Kcyyqug.exe	upx
C:\Program Files (x86)\Kcyyqug.exe	upx
behavioral1/memory/1848-68-0x0000000000400000-0x0000000000463000-memory.dmp	upx
behavioral1/memory/1524-72-0x0000000000400000-0x0000000000463000-memory.dmp	upx

Windows security modification 2 TTPs 2 IoCs

Disabling Security Tools

Modify Registry

Processes:

server.exeekzx.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0"	server.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0"	ekzx.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

server.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ekzx.exe = "C:\\Windows\\WindowsUpdate\\ekzx.exe"	server.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

System Information Discovery

Processes:

server.exeekzx.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	server.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ekzx.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

tmp.exe

description	ioc	process
File opened (read-only)	\??\J:	tmp.exe
File opened (read-only)	\??\W:	tmp.exe
File opened (read-only)	\??\X:	tmp.exe
File opened (read-only)	\??\E:	tmp.exe
File opened (read-only)	\??\K:	tmp.exe
File opened (read-only)	\??\M:	tmp.exe
File opened (read-only)	\??\P:	tmp.exe
File opened (read-only)	\??\R:	tmp.exe
File opened (read-only)	\??\T:	tmp.exe
File opened (read-only)	\??\V:	tmp.exe
File opened (read-only)	\??\Z:	tmp.exe
File opened (read-only)	\??\B:	tmp.exe
File opened (read-only)	\??\O:	tmp.exe
File opened (read-only)	\??\Q:	tmp.exe
File opened (read-only)	\??\Y:	tmp.exe
File opened (read-only)	\??\I:	tmp.exe
File opened (read-only)	\??\G:	tmp.exe
File opened (read-only)	\??\H:	tmp.exe
File opened (read-only)	\??\L:	tmp.exe
File opened (read-only)	\??\N:	tmp.exe
File opened (read-only)	\??\S:	tmp.exe
File opened (read-only)	\??\U:	tmp.exe
File opened (read-only)	\??\F:	tmp.exe

Drops file in System32 directory 2 IoCs

Processes:

Kcyyqug.exeKcyyqug.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	Kcyyqug.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	Kcyyqug.exe

Drops file in Program Files directory 2 IoCs

Processes:

tmp.exe

description ioc process

File created C:\Program Files (x86)\Kcyyqug.exe tmp.exe
File opened for modification C:\Program Files (x86)\Kcyyqug.exe tmp.exe

description	ioc	process
File created	C:\Program Files (x86)\Kcyyqug.exe	tmp.exe
File opened for modification	C:\Program Files (x86)\Kcyyqug.exe	tmp.exe

Drops file in Windows directory 4 IoCs

Processes:

server.exeekzx.exe

description	ioc	process
File created	C:\Windows\WindowsUpdate\.temp.fortest	server.exe
File created	C:\Windows\WindowsUpdate\ekzx.exe	server.exe
File opened for modification	C:\Windows\WindowsUpdate\ekzx.exe	server.exe
File created	C:\Windows\WindowsUpdate\.temp.fortest	ekzx.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

Processes:

tmp.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	tmp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	tmp.exe

Modifies data under HKEY_USERS 25 IoCs

Processes:

Kcyyqug.exeKcyyqug.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	Kcyyqug.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	Kcyyqug.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Kcyyqug.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	Kcyyqug.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Kcyyqug.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	Kcyyqug.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Kcyyqug.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	Kcyyqug.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Kcyyqug.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Kcyyqug.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	Kcyyqug.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Kcyyqug.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	Kcyyqug.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	Kcyyqug.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	Kcyyqug.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	Kcyyqug.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	Kcyyqug.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	Kcyyqug.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	Kcyyqug.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	Kcyyqug.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	Kcyyqug.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Kcyyqug.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	Kcyyqug.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	Kcyyqug.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	Kcyyqug.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

tmp.exeKcyyqug.exeKcyyqug.exe

pid process

1388 tmp.exe
1388 tmp.exe
1848 Kcyyqug.exe
1848 Kcyyqug.exe
1524 Kcyyqug.exe
1524 Kcyyqug.exe
1388 tmp.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

server.exeekzx.exe

description pid process

Token: SeBackupPrivilege 972 server.exe
Token: SeBackupPrivilege 1576 ekzx.exe

pid	process
1388	tmp.exe
1388	tmp.exe
1848	Kcyyqug.exe
1848	Kcyyqug.exe
1524	Kcyyqug.exe
1524	Kcyyqug.exe
1388	tmp.exe

description	pid	process
Token: SeBackupPrivilege	972	server.exe
Token: SeBackupPrivilege	1576	ekzx.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Kcyyqug.exetmp.exeserver.exe

description	pid	process	target process
PID 1848 wrote to memory of 1524	1848	Kcyyqug.exe	Kcyyqug.exe
PID 1848 wrote to memory of 1524	1848	Kcyyqug.exe	Kcyyqug.exe
PID 1848 wrote to memory of 1524	1848	Kcyyqug.exe	Kcyyqug.exe
PID 1848 wrote to memory of 1524	1848	Kcyyqug.exe	Kcyyqug.exe
PID 1388 wrote to memory of 972	1388	tmp.exe	server.exe
PID 1388 wrote to memory of 972	1388	tmp.exe	server.exe
PID 1388 wrote to memory of 972	1388	tmp.exe	server.exe
PID 1388 wrote to memory of 972	1388	tmp.exe	server.exe
PID 972 wrote to memory of 1576	972	server.exe	ekzx.exe
PID 972 wrote to memory of 1576	972	server.exe	ekzx.exe
PID 972 wrote to memory of 1576	972	server.exe	ekzx.exe
PID 972 wrote to memory of 1576	972	server.exe	ekzx.exe

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

Processes:

server.exeekzx.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	server.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	server.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ekzx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ekzx.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1388

\??\c:\server.exe
c:\server.exe
2⤵
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:972

C:\Windows\WindowsUpdate\ekzx.exe
C:\Windows\WindowsUpdate\ekzx.exe
3⤵
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1576

C:\Program Files (x86)\Kcyyqug.exe
"C:\Program Files (x86)\Kcyyqug.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1848

C:\Program Files (x86)\Kcyyqug.exe
"C:\Program Files (x86)\Kcyyqug.exe" Win7
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1524

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

3

Modify Registry

5

Credential Access

Discovery

System Information Discovery

3

Query Registry

2

T1012

Peripheral Device Discovery