blacknet | e6507f36045c13dee736bea44d61e90169ea69de61e9dc50b5743960c5b8f85a

Windows Service

T1543.003

Disable or Modify Tools

Processes:

furz.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	furz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	furz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	furz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	furz.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

Processes:

reg.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid	Process
2556	cmd.exe

Executes dropped EXE 5 IoCs

Processes:

furz.exeUacTest.exeInpwdja.exeMnrjvryib.exeWindowsUpdate.exe

pid	Process
2084	furz.exe
2208	UacTest.exe
1504	Inpwdja.exe
2832	Mnrjvryib.exe
892	WindowsUpdate.exe

Loads dropped DLL 6 IoCs

Processes:

97cb3fda3cff430377a866d6b437de8f.exeUacTest.exe

pid	Process
1932	97cb3fda3cff430377a866d6b437de8f.exe
1932	97cb3fda3cff430377a866d6b437de8f.exe
2208	UacTest.exe
2208	UacTest.exe
2208	UacTest.exe
2208	UacTest.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

Modify Registry

Processes:

furz.exeWindowsUpdate.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	furz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	WindowsUpdate.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Processes:

97cb3fda3cff430377a866d6b437de8f.exefurz.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Update Folder\\Windows Update.exe"	97cb3fda3cff430377a866d6b437de8f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\e162b1333458a713bc6916cc8ac4110c = "C:\\Windows\\Microsoft\\MyClient\\WindowsUpdate.exe"	furz.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

97cb3fda3cff430377a866d6b437de8f.exe

description	pid	Process	procid_target
PID 2388 set thread context of 1932	2388	97cb3fda3cff430377a866d6b437de8f.exe	28

Drops file in Windows directory 2 IoCs

Processes:

furz.exe

description	ioc	Process
File created	C:\Windows\Microsoft\MyClient\WindowsUpdate.exe	furz.exe
File opened for modification	C:\Windows\Microsoft\MyClient\WindowsUpdate.exe	furz.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

Processes:

schtasks.exeschtasks.exe

pid	Process
2188	schtasks.exe
1828	schtasks.exe

Kills process with taskkill 1 IoCs

evasion

Processes:

taskkill.exe

pid	Process
2044	taskkill.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

Processes:

reg.exe

pid	Process
2040	reg.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

Processes:

PING.EXEPING.EXE

pid	Process
2216	PING.EXE
324	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

97cb3fda3cff430377a866d6b437de8f.exefurz.exepowershell.exe

pid	Process
1932	97cb3fda3cff430377a866d6b437de8f.exe
1932	97cb3fda3cff430377a866d6b437de8f.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2472	powershell.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe
2084	furz.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

97cb3fda3cff430377a866d6b437de8f.exetaskkill.exefurz.exepowershell.exeWindowsUpdate.exepowershell.exe

description	pid	Process
Token: SeDebugPrivilege	1932	97cb3fda3cff430377a866d6b437de8f.exe
Token: SeDebugPrivilege	2044	taskkill.exe
Token: SeDebugPrivilege	2084	furz.exe
Token: SeDebugPrivilege	2472	powershell.exe
Token: SeDebugPrivilege	892	WindowsUpdate.exe
Token: SeDebugPrivilege	2884	powershell.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

furz.exeWindowsUpdate.exe

pid	Process
2084	furz.exe
2084	furz.exe
2084	furz.exe
892	WindowsUpdate.exe
892	WindowsUpdate.exe
892	WindowsUpdate.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

97cb3fda3cff430377a866d6b437de8f.exe97cb3fda3cff430377a866d6b437de8f.execmd.exeUacTest.exeMnrjvryib.exeInpwdja.execmd.execmd.execmd.exefurz.exe

description	pid	Process	procid_target
PID 2388 wrote to memory of 1932	2388	97cb3fda3cff430377a866d6b437de8f.exe	28
PID 2388 wrote to memory of 1932	2388	97cb3fda3cff430377a866d6b437de8f.exe	28
PID 2388 wrote to memory of 1932	2388	97cb3fda3cff430377a866d6b437de8f.exe	28
PID 2388 wrote to memory of 1932	2388	97cb3fda3cff430377a866d6b437de8f.exe	28
PID 2388 wrote to memory of 1932	2388	97cb3fda3cff430377a866d6b437de8f.exe	28
PID 2388 wrote to memory of 1932	2388	97cb3fda3cff430377a866d6b437de8f.exe	28
PID 2388 wrote to memory of 1932	2388	97cb3fda3cff430377a866d6b437de8f.exe	28
PID 2388 wrote to memory of 1932	2388	97cb3fda3cff430377a866d6b437de8f.exe	28
PID 2388 wrote to memory of 1932	2388	97cb3fda3cff430377a866d6b437de8f.exe	28
PID 1932 wrote to memory of 2084	1932	97cb3fda3cff430377a866d6b437de8f.exe	29
PID 1932 wrote to memory of 2084	1932	97cb3fda3cff430377a866d6b437de8f.exe	29
PID 1932 wrote to memory of 2084	1932	97cb3fda3cff430377a866d6b437de8f.exe	29
PID 1932 wrote to memory of 2084	1932	97cb3fda3cff430377a866d6b437de8f.exe	29
PID 1932 wrote to memory of 2208	1932	97cb3fda3cff430377a866d6b437de8f.exe	30
PID 1932 wrote to memory of 2208	1932	97cb3fda3cff430377a866d6b437de8f.exe	30
PID 1932 wrote to memory of 2208	1932	97cb3fda3cff430377a866d6b437de8f.exe	30
PID 1932 wrote to memory of 2208	1932	97cb3fda3cff430377a866d6b437de8f.exe	30
PID 1932 wrote to memory of 2556	1932	97cb3fda3cff430377a866d6b437de8f.exe	31
PID 1932 wrote to memory of 2556	1932	97cb3fda3cff430377a866d6b437de8f.exe	31
PID 1932 wrote to memory of 2556	1932	97cb3fda3cff430377a866d6b437de8f.exe	31
PID 1932 wrote to memory of 2556	1932	97cb3fda3cff430377a866d6b437de8f.exe	31
PID 2556 wrote to memory of 2216	2556	cmd.exe	33
PID 2556 wrote to memory of 2216	2556	cmd.exe	33
PID 2556 wrote to memory of 2216	2556	cmd.exe	33
PID 2556 wrote to memory of 2216	2556	cmd.exe	33
PID 2556 wrote to memory of 324	2556	cmd.exe	34
PID 2556 wrote to memory of 324	2556	cmd.exe	34
PID 2556 wrote to memory of 324	2556	cmd.exe	34
PID 2556 wrote to memory of 324	2556	cmd.exe	34
PID 2208 wrote to memory of 1504	2208	UacTest.exe	35
PID 2208 wrote to memory of 1504	2208	UacTest.exe	35
PID 2208 wrote to memory of 1504	2208	UacTest.exe	35
PID 2208 wrote to memory of 1504	2208	UacTest.exe	35
PID 2208 wrote to memory of 2832	2208	UacTest.exe	37
PID 2208 wrote to memory of 2832	2208	UacTest.exe	37
PID 2208 wrote to memory of 2832	2208	UacTest.exe	37
PID 2208 wrote to memory of 2832	2208	UacTest.exe	37
PID 2832 wrote to memory of 2516	2832	Mnrjvryib.exe	40
PID 2832 wrote to memory of 2516	2832	Mnrjvryib.exe	40
PID 2832 wrote to memory of 2516	2832	Mnrjvryib.exe	40
PID 2832 wrote to memory of 2516	2832	Mnrjvryib.exe	40
PID 1504 wrote to memory of 2976	1504	Inpwdja.exe	39
PID 1504 wrote to memory of 2976	1504	Inpwdja.exe	39
PID 1504 wrote to memory of 2976	1504	Inpwdja.exe	39
PID 1504 wrote to memory of 2976	1504	Inpwdja.exe	39
PID 2976 wrote to memory of 1072	2976	cmd.exe	41
PID 2976 wrote to memory of 1072	2976	cmd.exe	41
PID 2976 wrote to memory of 1072	2976	cmd.exe	41
PID 2516 wrote to memory of 2044	2516	cmd.exe	42
PID 2516 wrote to memory of 2044	2516	cmd.exe	42
PID 2516 wrote to memory of 2044	2516	cmd.exe	42
PID 1072 wrote to memory of 2040	1072	cmd.exe	43
PID 1072 wrote to memory of 2040	1072	cmd.exe	43
PID 1072 wrote to memory of 2040	1072	cmd.exe	43
PID 2084 wrote to memory of 2472	2084	furz.exe	45
PID 2084 wrote to memory of 2472	2084	furz.exe	45
PID 2084 wrote to memory of 2472	2084	furz.exe	45
PID 2084 wrote to memory of 1196	2084	furz.exe	47
PID 2084 wrote to memory of 1196	2084	furz.exe	47
PID 2084 wrote to memory of 1196	2084	furz.exe	47
PID 2084 wrote to memory of 892	2084	furz.exe	49
PID 2084 wrote to memory of 892	2084	furz.exe	49
PID 2084 wrote to memory of 892	2084	furz.exe	49
PID 2084 wrote to memory of 1828	2084	furz.exe	50

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\97cb3fda3cff430377a866d6b437de8f.exe
"C:\Users\Admin\AppData\Local\Temp\97cb3fda3cff430377a866d6b437de8f.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Users\Admin\AppData\Local\Temp\97cb3fda3cff430377a866d6b437de8f.exe
  "C:\Users\Admin\AppData\Local\Temp\97cb3fda3cff430377a866d6b437de8f.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Users\Admin\AppData\Local\Temp\furz.exe
    "C:\Users\Admin\AppData\Local\Temp\furz.exe"
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2084
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" Get-MpPreference -verbose
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2472
  - - C:\Windows\system32\schtasks.exe
      "schtasks" /delete /tn "WindowsUpdate.exe" /f
      4⤵
      PID:1196
  - - C:\Windows\Microsoft\MyClient\WindowsUpdate.exe
      "C:\Windows\Microsoft\MyClient\WindowsUpdate.exe"
      4⤵
      Executes dropped EXE
      Windows security modification
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:892
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" Get-MpPreference -verbose
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2884
    - - C:\Windows\system32\schtasks.exe
        
        "schtasks" /delete /tn "WindowsUpdate.exe" /f
        5⤵
        
        PID:2152
    - - C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "WindowsUpdate.exe" /sc ONLOGON /tr "C:\Windows\WindowsUpdate.exe" /rl HIGHEST /f
        5⤵
        Creates scheduled task(s)
        
        PID:2188
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 892 -s 1048
        5⤵
        
        PID:436
  - - C:\Windows\system32\schtasks.exe
      "schtasks" /create /tn "WindowsUpdate.exe" /sc ONLOGON /tr "C:\Windows\WindowsUpdate.exe" /rl HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:1828
- - C:\Users\Admin\AppData\Local\Temp\UacTest.exe
    "C:\Users\Admin\AppData\Local\Temp\UacTest.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2208
  - - C:\Users\Admin\AppData\Local\Temp\Inpwdja.exe
      "C:\Users\Admin\AppData\Local\Temp\Inpwdja.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1504
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\7C62.tmp\7C62.tmp\7C63.bat C:\Users\Admin\AppData\Local\Temp\Inpwdja.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2976
      - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /k C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1072
        
        C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        7⤵
        UAC bypass
        Modifies registry key
        
        PID:2040
  - - C:\Users\Admin\AppData\Local\Temp\Mnrjvryib.exe
      "C:\Users\Admin\AppData\Local\Temp\Mnrjvryib.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2832
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\7C61.tmp\7C62.tmp\7C63.bat C:\Users\Admin\AppData\Local\Temp\Mnrjvryib.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2516
      - C:\Windows\system32\taskkill.exe
        
        Taskkill /IM cmd.exe /F
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2044
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 100 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\97cb3fda3cff430377a866d6b437de8f.exe"& ping 1.1.1.1 -n 1 -w 900 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\97cb3fda3cff430377a866d6b437de8f.exe"
    3⤵
    - Deletes itself
    - Suspicious use of WriteProcessMemory
    PID:2556
  - - C:\Windows\SysWOW64\PING.EXE
      ping 1.1.1.1 -n 1 -w 100
      4⤵
      Runs ping.exe
      PID:2216
  - - C:\Windows\SysWOW64\PING.EXE
      ping 1.1.1.1 -n 1 -w 900
      4⤵
      Runs ping.exe
      PID:324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry