kinsing | d002e61eb33b500340e5cf915fa124b81263671d9586b76eb622ffb7c532f7a4

Windows Service

T1543.003

Processes:

reg.exereg.exereg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\bs.exe = "C:\\Users\\Admin\\AppData\\Roaming\\bs.exe:*:Enabled:Windows Messanger"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\74f99f20fec0194ccd0544ad42965175.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\74f99f20fec0194ccd0544ad42965175.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

74f99f20fec0194ccd0544ad42965175.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	74f99f20fec0194ccd0544ad42965175.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Balls = "C:\\Users\\Admin\\AppData\\Roaming\\bs.exe"	74f99f20fec0194ccd0544ad42965175.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

74f99f20fec0194ccd0544ad42965175.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FD0DF1DB-0FC2-F2FC-EFDC-BC3B8ABA28AF}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\bs.exe"	74f99f20fec0194ccd0544ad42965175.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{FD0DF1DB-0FC2-F2FC-EFDC-BC3B8ABA28AF}	74f99f20fec0194ccd0544ad42965175.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{FD0DF1DB-0FC2-F2FC-EFDC-BC3B8ABA28AF}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\bs.exe"	74f99f20fec0194ccd0544ad42965175.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FD0DF1DB-0FC2-F2FC-EFDC-BC3B8ABA28AF}	74f99f20fec0194ccd0544ad42965175.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

74f99f20fec0194ccd0544ad42965175.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Balls = "C:\\Users\\Admin\\AppData\\Roaming\\bs.exe"	74f99f20fec0194ccd0544ad42965175.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Balls = "C:\\Users\\Admin\\AppData\\Roaming\\bs.exe"	74f99f20fec0194ccd0544ad42965175.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

74f99f20fec0194ccd0544ad42965175.exe

description pid process target process

PID 4804 set thread context of 4212 4804 74f99f20fec0194ccd0544ad42965175.exe 74f99f20fec0194ccd0544ad42965175.exe
Modifies registry key 1 TTPs 4 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exereg.exereg.exe

pid process

516 reg.exe
4332 reg.exe
1268 reg.exe
3196 reg.exe

description	pid	process	target process
PID 4804 set thread context of 4212	4804	74f99f20fec0194ccd0544ad42965175.exe	74f99f20fec0194ccd0544ad42965175.exe

pid	process
516	reg.exe
4332	reg.exe
1268	reg.exe
3196	reg.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

Processes:

74f99f20fec0194ccd0544ad42965175.exe

description	pid	process
Token: 1	4212	74f99f20fec0194ccd0544ad42965175.exe
Token: SeCreateTokenPrivilege	4212	74f99f20fec0194ccd0544ad42965175.exe
Token: SeAssignPrimaryTokenPrivilege	4212	74f99f20fec0194ccd0544ad42965175.exe
Token: SeLockMemoryPrivilege	4212	74f99f20fec0194ccd0544ad42965175.exe
Token: SeIncreaseQuotaPrivilege	4212	74f99f20fec0194ccd0544ad42965175.exe
Token: SeMachineAccountPrivilege	4212	74f99f20fec0194ccd0544ad42965175.exe
Token: SeTcbPrivilege	4212	74f99f20fec0194ccd0544ad42965175.exe
Token: SeSecurityPrivilege	4212	74f99f20fec0194ccd0544ad42965175.exe
Token: SeTakeOwnershipPrivilege	4212	74f99f20fec0194ccd0544ad42965175.exe
Token: SeLoadDriverPrivilege	4212	74f99f20fec0194ccd0544ad42965175.exe
Token: SeSystemProfilePrivilege	4212	74f99f20fec0194ccd0544ad42965175.exe
Token: SeSystemtimePrivilege	4212	74f99f20fec0194ccd0544ad42965175.exe
Token: SeProfSingleProcessPrivilege	4212	74f99f20fec0194ccd0544ad42965175.exe
Token: SeIncBasePriorityPrivilege	4212	74f99f20fec0194ccd0544ad42965175.exe
Token: SeCreatePagefilePrivilege	4212	74f99f20fec0194ccd0544ad42965175.exe
Token: SeCreatePermanentPrivilege	4212	74f99f20fec0194ccd0544ad42965175.exe
Token: SeBackupPrivilege	4212	74f99f20fec0194ccd0544ad42965175.exe
Token: SeRestorePrivilege	4212	74f99f20fec0194ccd0544ad42965175.exe
Token: SeShutdownPrivilege	4212	74f99f20fec0194ccd0544ad42965175.exe
Token: SeDebugPrivilege	4212	74f99f20fec0194ccd0544ad42965175.exe
Token: SeAuditPrivilege	4212	74f99f20fec0194ccd0544ad42965175.exe
Token: SeSystemEnvironmentPrivilege	4212	74f99f20fec0194ccd0544ad42965175.exe
Token: SeChangeNotifyPrivilege	4212	74f99f20fec0194ccd0544ad42965175.exe
Token: SeRemoteShutdownPrivilege	4212	74f99f20fec0194ccd0544ad42965175.exe
Token: SeUndockPrivilege	4212	74f99f20fec0194ccd0544ad42965175.exe
Token: SeSyncAgentPrivilege	4212	74f99f20fec0194ccd0544ad42965175.exe
Token: SeEnableDelegationPrivilege	4212	74f99f20fec0194ccd0544ad42965175.exe
Token: SeManageVolumePrivilege	4212	74f99f20fec0194ccd0544ad42965175.exe
Token: SeImpersonatePrivilege	4212	74f99f20fec0194ccd0544ad42965175.exe
Token: SeCreateGlobalPrivilege	4212	74f99f20fec0194ccd0544ad42965175.exe
Token: 31	4212	74f99f20fec0194ccd0544ad42965175.exe
Token: 32	4212	74f99f20fec0194ccd0544ad42965175.exe
Token: 33	4212	74f99f20fec0194ccd0544ad42965175.exe
Token: 34	4212	74f99f20fec0194ccd0544ad42965175.exe
Token: 35	4212	74f99f20fec0194ccd0544ad42965175.exe
Token: SeDebugPrivilege	4212	74f99f20fec0194ccd0544ad42965175.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

74f99f20fec0194ccd0544ad42965175.exe74f99f20fec0194ccd0544ad42965175.exe

pid	process
4804	74f99f20fec0194ccd0544ad42965175.exe
4212	74f99f20fec0194ccd0544ad42965175.exe
4212	74f99f20fec0194ccd0544ad42965175.exe
4212	74f99f20fec0194ccd0544ad42965175.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

74f99f20fec0194ccd0544ad42965175.exe74f99f20fec0194ccd0544ad42965175.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 4804 wrote to memory of 4212	4804	74f99f20fec0194ccd0544ad42965175.exe	74f99f20fec0194ccd0544ad42965175.exe
PID 4804 wrote to memory of 4212	4804	74f99f20fec0194ccd0544ad42965175.exe	74f99f20fec0194ccd0544ad42965175.exe
PID 4804 wrote to memory of 4212	4804	74f99f20fec0194ccd0544ad42965175.exe	74f99f20fec0194ccd0544ad42965175.exe
PID 4804 wrote to memory of 4212	4804	74f99f20fec0194ccd0544ad42965175.exe	74f99f20fec0194ccd0544ad42965175.exe
PID 4804 wrote to memory of 4212	4804	74f99f20fec0194ccd0544ad42965175.exe	74f99f20fec0194ccd0544ad42965175.exe
PID 4804 wrote to memory of 4212	4804	74f99f20fec0194ccd0544ad42965175.exe	74f99f20fec0194ccd0544ad42965175.exe
PID 4804 wrote to memory of 4212	4804	74f99f20fec0194ccd0544ad42965175.exe	74f99f20fec0194ccd0544ad42965175.exe
PID 4804 wrote to memory of 4212	4804	74f99f20fec0194ccd0544ad42965175.exe	74f99f20fec0194ccd0544ad42965175.exe
PID 4212 wrote to memory of 4140	4212	74f99f20fec0194ccd0544ad42965175.exe	cmd.exe
PID 4212 wrote to memory of 4140	4212	74f99f20fec0194ccd0544ad42965175.exe	cmd.exe
PID 4212 wrote to memory of 4140	4212	74f99f20fec0194ccd0544ad42965175.exe	cmd.exe
PID 4212 wrote to memory of 3088	4212	74f99f20fec0194ccd0544ad42965175.exe	cmd.exe
PID 4212 wrote to memory of 3088	4212	74f99f20fec0194ccd0544ad42965175.exe	cmd.exe
PID 4212 wrote to memory of 3088	4212	74f99f20fec0194ccd0544ad42965175.exe	cmd.exe
PID 4212 wrote to memory of 3240	4212	74f99f20fec0194ccd0544ad42965175.exe	cmd.exe
PID 4212 wrote to memory of 3240	4212	74f99f20fec0194ccd0544ad42965175.exe	cmd.exe
PID 4212 wrote to memory of 3240	4212	74f99f20fec0194ccd0544ad42965175.exe	cmd.exe
PID 4212 wrote to memory of 1016	4212	74f99f20fec0194ccd0544ad42965175.exe	cmd.exe
PID 4212 wrote to memory of 1016	4212	74f99f20fec0194ccd0544ad42965175.exe	cmd.exe
PID 4212 wrote to memory of 1016	4212	74f99f20fec0194ccd0544ad42965175.exe	cmd.exe
PID 4140 wrote to memory of 516	4140	cmd.exe	reg.exe
PID 4140 wrote to memory of 516	4140	cmd.exe	reg.exe
PID 4140 wrote to memory of 516	4140	cmd.exe	reg.exe
PID 3240 wrote to memory of 4332	3240	cmd.exe	reg.exe
PID 3240 wrote to memory of 4332	3240	cmd.exe	reg.exe
PID 3240 wrote to memory of 4332	3240	cmd.exe	reg.exe
PID 1016 wrote to memory of 1268	1016	cmd.exe	reg.exe
PID 1016 wrote to memory of 1268	1016	cmd.exe	reg.exe
PID 1016 wrote to memory of 1268	1016	cmd.exe	reg.exe
PID 3088 wrote to memory of 3196	3088	cmd.exe	reg.exe
PID 3088 wrote to memory of 3196	3088	cmd.exe	reg.exe
PID 3088 wrote to memory of 3196	3088	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\74f99f20fec0194ccd0544ad42965175.exe
"C:\Users\Admin\AppData\Local\Temp\74f99f20fec0194ccd0544ad42965175.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4804

C:\Users\Admin\AppData\Local\Temp\74f99f20fec0194ccd0544ad42965175.exe
"C:\Users\Admin\AppData\Local\Temp\74f99f20fec0194ccd0544ad42965175.exe"
2⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4212

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bs.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bs.exe:*:Enabled:Windows Messanger" /f
3⤵
- Suspicious use of WriteProcessMemory
PID:1016

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bs.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bs.exe:*:Enabled:Windows Messanger" /f
4⤵
- Modifies firewall policy service
- Modifies registry key
PID:1268

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
3⤵
- Suspicious use of WriteProcessMemory
PID:3240

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
4⤵
- Modifies firewall policy service
- Modifies registry key
PID:4332

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\74f99f20fec0194ccd0544ad42965175.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\74f99f20fec0194ccd0544ad42965175.exe:*:Enabled:Windows Messanger" /f
3⤵
- Suspicious use of WriteProcessMemory
PID:3088

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\74f99f20fec0194ccd0544ad42965175.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\74f99f20fec0194ccd0544ad42965175.exe:*:Enabled:Windows Messanger" /f
4⤵
- Modifies firewall policy service
- Modifies registry key
PID:3196

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
3⤵
- Suspicious use of WriteProcessMemory
PID:4140

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
4⤵
- Modifies firewall policy service
- Modifies registry key
PID:516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

5