sality | 29ac6dc66bd7d3ff4f449a80662bb2547c793b67277ae69e6f51289ef3d6476d

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	e57db8b.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	e57db8b.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	e57db8b.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	e57fc90.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	e57fc90.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	e57fc90.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 2 IoCs

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e57db8b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e57fc90.exe

Windows security bypass 2 TTPs 12 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e57db8b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e57db8b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e57db8b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e57db8b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e57fc90.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e57fc90.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e57fc90.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e57fc90.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e57db8b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e57db8b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e57fc90.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e57fc90.exe

Executes dropped EXE 3 IoCs

pid	Process
4672	e57db8b.exe
1172	e57e0ea.exe
2204	e57fc90.exe

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4672-7-0x0000000000810000-0x00000000018CA000-memory.dmp	upx
behavioral2/memory/4672-9-0x0000000000810000-0x00000000018CA000-memory.dmp	upx
behavioral2/memory/4672-10-0x0000000000810000-0x00000000018CA000-memory.dmp	upx
behavioral2/memory/4672-12-0x0000000000810000-0x00000000018CA000-memory.dmp	upx
behavioral2/memory/4672-24-0x0000000000810000-0x00000000018CA000-memory.dmp	upx
behavioral2/memory/4672-30-0x0000000000810000-0x00000000018CA000-memory.dmp	upx
behavioral2/memory/4672-32-0x0000000000810000-0x00000000018CA000-memory.dmp	upx
behavioral2/memory/4672-33-0x0000000000810000-0x00000000018CA000-memory.dmp	upx
behavioral2/memory/4672-34-0x0000000000810000-0x00000000018CA000-memory.dmp	upx
behavioral2/memory/4672-35-0x0000000000810000-0x00000000018CA000-memory.dmp	upx
behavioral2/memory/4672-36-0x0000000000810000-0x00000000018CA000-memory.dmp	upx
behavioral2/memory/4672-37-0x0000000000810000-0x00000000018CA000-memory.dmp	upx
behavioral2/memory/4672-45-0x0000000000810000-0x00000000018CA000-memory.dmp	upx
behavioral2/memory/4672-46-0x0000000000810000-0x00000000018CA000-memory.dmp	upx
behavioral2/memory/4672-57-0x0000000000810000-0x00000000018CA000-memory.dmp	upx
behavioral2/memory/4672-58-0x0000000000810000-0x00000000018CA000-memory.dmp	upx
behavioral2/memory/4672-59-0x0000000000810000-0x00000000018CA000-memory.dmp	upx
behavioral2/memory/4672-63-0x0000000000810000-0x00000000018CA000-memory.dmp	upx
behavioral2/memory/4672-69-0x0000000000810000-0x00000000018CA000-memory.dmp	upx
behavioral2/memory/4672-72-0x0000000000810000-0x00000000018CA000-memory.dmp	upx
behavioral2/memory/2204-100-0x0000000000B20000-0x0000000001BDA000-memory.dmp	upx
behavioral2/memory/2204-102-0x0000000000B20000-0x0000000001BDA000-memory.dmp	upx
behavioral2/memory/2204-141-0x0000000000B20000-0x0000000001BDA000-memory.dmp	upx

Windows security modification 2 TTPs 14 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e57db8b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e57db8b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e57db8b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e57fc90.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e57fc90.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	e57fc90.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e57db8b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e57fc90.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e57fc90.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e57db8b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e57db8b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	e57db8b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e57fc90.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e57fc90.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e57db8b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e57fc90.exe

Enumerates connected drives 3 TTPs 6 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	e57db8b.exe
File opened (read-only)	\??\H:	e57db8b.exe
File opened (read-only)	\??\I:	e57db8b.exe
File opened (read-only)	\??\J:	e57db8b.exe
File opened (read-only)	\??\E:	e57fc90.exe
File opened (read-only)	\??\E:	e57db8b.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\e5837e4	e57fc90.exe
File created	C:\Windows\e57de69	e57db8b.exe
File opened for modification	C:\Windows\SYSTEM.INI	e57db8b.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4672	e57db8b.exe
4672	e57db8b.exe
4672	e57db8b.exe
4672	e57db8b.exe
2204	e57fc90.exe
2204	e57fc90.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe
Token: SeDebugPrivilege	4672	e57db8b.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 4216	3448	rundll32.exe	83
PID 3448 wrote to memory of 4216	3448	rundll32.exe	83
PID 3448 wrote to memory of 4216	3448	rundll32.exe	83
PID 4216 wrote to memory of 4672	4216	rundll32.exe	86
PID 4216 wrote to memory of 4672	4216	rundll32.exe	86
PID 4216 wrote to memory of 4672	4216	rundll32.exe	86
PID 4672 wrote to memory of 792	4672	e57db8b.exe	8
PID 4672 wrote to memory of 796	4672	e57db8b.exe	82
PID 4672 wrote to memory of 392	4672	e57db8b.exe	10
PID 4672 wrote to memory of 2332	4672	e57db8b.exe	66
PID 4672 wrote to memory of 2348	4672	e57db8b.exe	65
PID 4672 wrote to memory of 2540	4672	e57db8b.exe	27
PID 4672 wrote to memory of 3224	4672	e57db8b.exe	56
PID 4672 wrote to memory of 3408	4672	e57db8b.exe	55
PID 4672 wrote to memory of 3668	4672	e57db8b.exe	54
PID 4672 wrote to memory of 3776	4672	e57db8b.exe	31
PID 4672 wrote to memory of 3868	4672	e57db8b.exe	30
PID 4672 wrote to memory of 3980	4672	e57db8b.exe	53
PID 4672 wrote to memory of 3272	4672	e57db8b.exe	52
PID 4672 wrote to memory of 4996	4672	e57db8b.exe	50
PID 4672 wrote to memory of 752	4672	e57db8b.exe	40
PID 4672 wrote to memory of 4356	4672	e57db8b.exe	36
PID 4672 wrote to memory of 4156	4672	e57db8b.exe	35
PID 4672 wrote to memory of 3448	4672	e57db8b.exe	49
PID 4672 wrote to memory of 4216	4672	e57db8b.exe	83
PID 4672 wrote to memory of 4216	4672	e57db8b.exe	83
PID 4216 wrote to memory of 1172	4216	rundll32.exe	87
PID 4216 wrote to memory of 1172	4216	rundll32.exe	87
PID 4216 wrote to memory of 1172	4216	rundll32.exe	87
PID 4672 wrote to memory of 772	4672	e57db8b.exe	84
PID 4672 wrote to memory of 4600	4672	e57db8b.exe	85
PID 4216 wrote to memory of 2204	4216	rundll32.exe	89
PID 4216 wrote to memory of 2204	4216	rundll32.exe	89
PID 4216 wrote to memory of 2204	4216	rundll32.exe	89
PID 4672 wrote to memory of 792	4672	e57db8b.exe	8
PID 4672 wrote to memory of 796	4672	e57db8b.exe	82
PID 4672 wrote to memory of 392	4672	e57db8b.exe	10
PID 4672 wrote to memory of 2332	4672	e57db8b.exe	66
PID 4672 wrote to memory of 2348	4672	e57db8b.exe	65
PID 4672 wrote to memory of 2540	4672	e57db8b.exe	27
PID 4672 wrote to memory of 3224	4672	e57db8b.exe	56
PID 4672 wrote to memory of 3408	4672	e57db8b.exe	55
PID 4672 wrote to memory of 3668	4672	e57db8b.exe	54
PID 4672 wrote to memory of 3776	4672	e57db8b.exe	31
PID 4672 wrote to memory of 3868	4672	e57db8b.exe	30
PID 4672 wrote to memory of 3980	4672	e57db8b.exe	53
PID 4672 wrote to memory of 3272	4672	e57db8b.exe	52
PID 4672 wrote to memory of 4996	4672	e57db8b.exe	50
PID 4672 wrote to memory of 752	4672	e57db8b.exe	40
PID 4672 wrote to memory of 4356	4672	e57db8b.exe	36
PID 4672 wrote to memory of 4156	4672	e57db8b.exe	35
PID 4672 wrote to memory of 4600	4672	e57db8b.exe	85
PID 4672 wrote to memory of 1172	4672	e57db8b.exe	87
PID 4672 wrote to memory of 1172	4672	e57db8b.exe	87
PID 4672 wrote to memory of 1256	4672	e57db8b.exe	88
PID 4672 wrote to memory of 2204	4672	e57db8b.exe	89
PID 4672 wrote to memory of 2204	4672	e57db8b.exe	89
PID 2204 wrote to memory of 792	2204	e57fc90.exe	8
PID 2204 wrote to memory of 796	2204	e57fc90.exe	82
PID 2204 wrote to memory of 392	2204	e57fc90.exe	10
PID 2204 wrote to memory of 2332	2204	e57fc90.exe	66
PID 2204 wrote to memory of 2348	2204	e57fc90.exe	65
PID 2204 wrote to memory of 2540	2204	e57fc90.exe	27
PID 2204 wrote to memory of 3224	2204	e57fc90.exe	56

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e57db8b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e57fc90.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:792

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:392

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2540

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3868

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3776

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:4156

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:4356

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:752

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.3fbd7d4a57a164798b4857d39330d940_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.3fbd7d4a57a164798b4857d39330d940_JC.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4216
- - C:\Users\Admin\AppData\Local\Temp\e57db8b.exe
    C:\Users\Admin\AppData\Local\Temp\e57db8b.exe
    3⤵
    - Modifies firewall policy service
    - UAC bypass
    - Windows security bypass
    - Executes dropped EXE
    - Windows security modification
    - Checks whether UAC is enabled
    - Enumerates connected drives
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:4672
- - C:\Users\Admin\AppData\Local\Temp\e57e0ea.exe
    C:\Users\Admin\AppData\Local\Temp\e57e0ea.exe
    3⤵
    - Executes dropped EXE
    PID:1172
- - C:\Users\Admin\AppData\Local\Temp\e57fc90.exe
    C:\Users\Admin\AppData\Local\Temp\e57fc90.exe
    3⤵
    - Modifies firewall policy service
    - UAC bypass
    - Windows security bypass
    - Executes dropped EXE
    - Windows security modification
    - Checks whether UAC is enabled
    - Enumerates connected drives
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:2204

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4996

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3272

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3980

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3408

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2348

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2332

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:796

C:\Windows\system32\BackgroundTaskHost.exe
"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
1⤵
PID:772

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4600

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:1256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry