1d0799de8e01ed4b223ed6e00d6e51cf8fcfc3142b9b794a901fb9baa3b4ecda

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	rundll32.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	rundll32.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
3	2348	rundll32.exe

Modifies Shared Task Scheduler registry keys 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler	36f0e4ed75a4cbbe79b1a7105bbb3995.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\SharedTaskScheduler\{786C369D-409A-456f-A13C-971EADA850C6} = "DertertDE"	36f0e4ed75a4cbbe79b1a7105bbb3995.exe

Loads dropped DLL 4 IoCs

pid	Process
2348	rundll32.exe
2348	rundll32.exe
2348	rundll32.exe
2348	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\Wow6432Node\CLSID\{786C369D-409A-456f-A13C-971EADA850C6}\InProcServer32\ = "C:\\Windows\\SysWow64\\birdasfihuy32.dll"	36f0e4ed75a4cbbe79b1a7105bbb3995.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\Wow6432Node\CLSID\{786C369D-409A-456f-A13C-971EADA850C6}\InProcServer32\ThreadingModel = "Apartment"	36f0e4ed75a4cbbe79b1a7105bbb3995.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\Wow6432Node\CLSID\{786C369D-409A-456f-A13C-971EADA850C6}\InProcServer32	36f0e4ed75a4cbbe79b1a7105bbb3995.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2304-0-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral1/memory/2304-9-0x0000000000400000-0x000000000040F000-memory.dmp	upx

Windows security modification 2 TTPs 5 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	rundll32.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\birdasfihuy32.dll	36f0e4ed75a4cbbe79b1a7105bbb3995.exe
File created	C:\Windows\SysWOW64\biasfardihuy.dll	36f0e4ed75a4cbbe79b1a7105bbb3995.exe

Modifies Internet Explorer settings 1 TTPs 5 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\SOFTWARE\Microsoft\Internet Explorer\Security	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Security\sox_id = "456253522821"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Security	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Security\rpt = "6594"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Security\sox_ver = "0"	rundll32.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\Wow6432Node\CLSID\{786C369D-409A-456f-A13C-971EADA850C6}	36f0e4ed75a4cbbe79b1a7105bbb3995.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\Wow6432Node\CLSID\{786C369D-409A-456f-A13C-971EADA850C6}\InProcServer32\ = "C:\\Windows\\SysWow64\\birdasfihuy32.dll"	36f0e4ed75a4cbbe79b1a7105bbb3995.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\Wow6432Node\CLSID\{786C369D-409A-456f-A13C-971EADA850C6}\InProcServer32\ThreadingModel = "Apartment"	36f0e4ed75a4cbbe79b1a7105bbb3995.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\Wow6432Node\CLSID\{786C369D-409A-456f-A13C-971EADA850C6}\InProcServer32	36f0e4ed75a4cbbe79b1a7105bbb3995.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\Wow6432Node	36f0e4ed75a4cbbe79b1a7105bbb3995.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\Wow6432Node\CLSID	36f0e4ed75a4cbbe79b1a7105bbb3995.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 2348	2304	36f0e4ed75a4cbbe79b1a7105bbb3995.exe	27
PID 2304 wrote to memory of 2348	2304	36f0e4ed75a4cbbe79b1a7105bbb3995.exe	27
PID 2304 wrote to memory of 2348	2304	36f0e4ed75a4cbbe79b1a7105bbb3995.exe	27
PID 2304 wrote to memory of 2348	2304	36f0e4ed75a4cbbe79b1a7105bbb3995.exe	27
PID 2304 wrote to memory of 2348	2304	36f0e4ed75a4cbbe79b1a7105bbb3995.exe	27
PID 2304 wrote to memory of 2348	2304	36f0e4ed75a4cbbe79b1a7105bbb3995.exe	27
PID 2304 wrote to memory of 2348	2304	36f0e4ed75a4cbbe79b1a7105bbb3995.exe	27

C:\Users\Admin\AppData\Local\Temp\36f0e4ed75a4cbbe79b1a7105bbb3995.exe
"C:\Users\Admin\AppData\Local\Temp\36f0e4ed75a4cbbe79b1a7105bbb3995.exe"
1⤵
- Modifies Shared Task Scheduler registry keys
- Registers COM server for autorun
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Windows\system32\birdasfihuy32.dll, load
  2⤵
  - Modifies security service
  - Windows security bypass
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Windows security modification
  - Modifies Internet Explorer settings
  PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System