74e1e95f56183d23fbd30164068e2557957d1c9faded8488794ef115448dca7f

Windows Service

Disable or Modify Tools

T1562.001

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION	dControl.exe

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

Windows Service

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "2"	dControl.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	dControl.exe

Downloads MZ/PE file

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpcmdrun.exe	dControl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpcmdrun.exe\Debugger = "C:\\Windows\\System32\\systray.exe"	dControl.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MPCMDRUN.EXE	dControl.exe

Registers COM server for autorun 1 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32	MsMpEng.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2156-0-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/2156-21-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/5016-42-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/436-63-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/4384-84-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/436-85-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/436-86-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/4556-369-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/436-882-0x0000000000400000-0x00000000004CD000-memory.dmp	upx

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\DisableAntiVirus = "1"	dControl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection	dControl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	dControl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\DisableAntiSpyware = "1"	dControl.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe

AutoIT Executable 8 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2156-21-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/5016-42-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/436-63-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/4384-84-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/436-85-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/436-86-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/4556-369-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/436-882-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	dControl.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	dControl.exe
File opened for modification	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	dControl.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe
File created	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\MpCmdRun-30-53C9D589-6B66-4F30-9BAB-9A0193B0BAFC.lock	MpCmdRun.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe
File created	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\mpam-c61b141e.exe	MpCmdRun.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	MsMpEng.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	MsMpEng.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	MsMpEng.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\EXTENSION VALIDATION\{2781761E-28E0-4109-99FE-B9D127C57AFE}	MsMpEng.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\EXTENSION VALIDATION\{2781761E-28E0-4109-99FE-B9D127C57AFE}	MsMpEng.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Defender	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache	MpCmdRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows Defender	MpCmdRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe

Modifies registry class 13 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\Implemented Categories\Disabled - {56FFCC30-D398-11D0-B2AE-00A0C908FA49}	MsMpEng.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\DIRECTORY\SHELLEX\CONTEXTMENUHANDLERS\EPP	MsMpEng.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\CLSID	MsMpEng.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\*\SHELLEX\CONTEXTMENUHANDLERS\EPP	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\Implemented Categories\Disabled - {56FFCC30-D398-11D0-B2AE-00A0C908FA49}	MsMpEng.exe
Key created	\REGISTRY\USER\S-1-5-21-3934047325-4097474570-3437169968-1000_Classes\Local Settings	firefox.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\DRIVE\SHELLEX\CONTEXTMENUHANDLERS\EPP	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32	MsMpEng.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}	MsMpEng.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2156	dControl.exe
2156	dControl.exe
2156	dControl.exe
2156	dControl.exe
2156	dControl.exe
2156	dControl.exe
5016	dControl.exe
5016	dControl.exe
5016	dControl.exe
5016	dControl.exe
5016	dControl.exe
5016	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
4384	dControl.exe
4384	dControl.exe
4384	dControl.exe
4384	dControl.exe
4384	dControl.exe
4384	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
4556	dControl.exe
4556	dControl.exe
4556	dControl.exe
4556	dControl.exe
4556	dControl.exe
4556	dControl.exe
436	dControl.exe
436	dControl.exe
4492	powershell.exe
4492	powershell.exe
436	dControl.exe
436	dControl.exe
4492	powershell.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
4492	powershell.exe
436	dControl.exe
436	dControl.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
436	dControl.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
632	Process not Found
4512	MsMpEng.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeDebugPrivilege	2156	dControl.exe
Token: SeAssignPrimaryTokenPrivilege	2156	dControl.exe
Token: SeIncreaseQuotaPrivilege	2156	dControl.exe
Token: 0	2156	dControl.exe
Token: SeDebugPrivilege	5016	dControl.exe
Token: SeAssignPrimaryTokenPrivilege	5016	dControl.exe
Token: SeIncreaseQuotaPrivilege	5016	dControl.exe
Token: SeDebugPrivilege	436	dControl.exe
Token: SeAssignPrimaryTokenPrivilege	436	dControl.exe
Token: SeIncreaseQuotaPrivilege	436	dControl.exe
Token: 0	436	dControl.exe
Token: SeDebugPrivilege	436	dControl.exe
Token: SeAssignPrimaryTokenPrivilege	436	dControl.exe
Token: SeIncreaseQuotaPrivilege	436	dControl.exe
Token: 0	436	dControl.exe
Token: SeAssignPrimaryTokenPrivilege	4512	MsMpEng.exe
Token: SeIncreaseQuotaPrivilege	4512	MsMpEng.exe
Token: SeTcbPrivilege	4512	MsMpEng.exe
Token: SeSecurityPrivilege	4512	MsMpEng.exe
Token: SeTakeOwnershipPrivilege	4512	MsMpEng.exe
Token: SeLoadDriverPrivilege	4512	MsMpEng.exe
Token: SeIncBasePriorityPrivilege	4512	MsMpEng.exe
Token: SeBackupPrivilege	4512	MsMpEng.exe
Token: SeRestorePrivilege	4512	MsMpEng.exe
Token: SeShutdownPrivilege	4512	MsMpEng.exe
Token: SeDebugPrivilege	4512	MsMpEng.exe
Token: SeSystemEnvironmentPrivilege	4512	MsMpEng.exe
Token: SeChangeNotifyPrivilege	4512	MsMpEng.exe
Token: SeImpersonatePrivilege	4512	MsMpEng.exe
Token: SeDebugPrivilege	4512	MsMpEng.exe
Token: SeBackupPrivilege	4512	MsMpEng.exe
Token: SeRestorePrivilege	4512	MsMpEng.exe
Token: SeDebugPrivilege	4492	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	4492	powershell.exe
Token: SeIncreaseQuotaPrivilege	4492	powershell.exe
Token: SeSecurityPrivilege	4492	powershell.exe
Token: SeTakeOwnershipPrivilege	4492	powershell.exe
Token: SeLoadDriverPrivilege	4492	powershell.exe
Token: SeSystemtimePrivilege	4492	powershell.exe
Token: SeBackupPrivilege	4492	powershell.exe
Token: SeRestorePrivilege	4492	powershell.exe
Token: SeShutdownPrivilege	4492	powershell.exe
Token: SeSystemEnvironmentPrivilege	4492	powershell.exe
Token: SeUndockPrivilege	4492	powershell.exe
Token: SeManageVolumePrivilege	4492	powershell.exe
Token: SeDebugPrivilege	1144	firefox.exe
Token: SeDebugPrivilege	1144	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
2148	MSASCuiL.exe
2148	MSASCuiL.exe
2148	MSASCuiL.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
2148	MSASCuiL.exe
2148	MSASCuiL.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe
436	dControl.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1144	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 436 wrote to memory of 4384	436	dControl.exe	80
PID 436 wrote to memory of 4384	436	dControl.exe	80
PID 436 wrote to memory of 4384	436	dControl.exe	80
PID 5064 wrote to memory of 4288	5064	explorer.exe	82
PID 5064 wrote to memory of 4288	5064	explorer.exe	82
PID 436 wrote to memory of 4556	436	dControl.exe	89
PID 436 wrote to memory of 4556	436	dControl.exe	89
PID 436 wrote to memory of 4556	436	dControl.exe	89
PID 436 wrote to memory of 3396	436	dControl.exe	90
PID 436 wrote to memory of 3396	436	dControl.exe	90
PID 4728 wrote to memory of 2148	4728	explorer.exe	94
PID 4728 wrote to memory of 2148	4728	explorer.exe	94
PID 4512 wrote to memory of 4184	4512	MsMpEng.exe	97
PID 4512 wrote to memory of 4184	4512	MsMpEng.exe	97
PID 4184 wrote to memory of 424	4184	MpCmdRun.exe	100
PID 4184 wrote to memory of 424	4184	MpCmdRun.exe	100
PID 4512 wrote to memory of 4820	4512	MsMpEng.exe	101
PID 4512 wrote to memory of 4820	4512	MsMpEng.exe	101
PID 4512 wrote to memory of 2360	4512	MsMpEng.exe	103
PID 4512 wrote to memory of 2360	4512	MsMpEng.exe	103
PID 4512 wrote to memory of 816	4512	MsMpEng.exe	106
PID 4512 wrote to memory of 816	4512	MsMpEng.exe	106
PID 2360 wrote to memory of 1752	2360	MpCmdRun.exe	105
PID 2360 wrote to memory of 1752	2360	MpCmdRun.exe	105
PID 436 wrote to memory of 4492	436	dControl.exe	108
PID 436 wrote to memory of 4492	436	dControl.exe	108
PID 1228 wrote to memory of 1144	1228	firefox.exe	111
PID 1228 wrote to memory of 1144	1228	firefox.exe	111
PID 1228 wrote to memory of 1144	1228	firefox.exe	111
PID 1228 wrote to memory of 1144	1228	firefox.exe	111
PID 1228 wrote to memory of 1144	1228	firefox.exe	111
PID 1228 wrote to memory of 1144	1228	firefox.exe	111
PID 1228 wrote to memory of 1144	1228	firefox.exe	111
PID 1228 wrote to memory of 1144	1228	firefox.exe	111
PID 1228 wrote to memory of 1144	1228	firefox.exe	111
PID 1228 wrote to memory of 1144	1228	firefox.exe	111
PID 1228 wrote to memory of 1144	1228	firefox.exe	111
PID 1144 wrote to memory of 2016	1144	firefox.exe	112
PID 1144 wrote to memory of 2016	1144	firefox.exe	112
PID 1144 wrote to memory of 1896	1144	firefox.exe	113
PID 1144 wrote to memory of 1896	1144	firefox.exe	113
PID 1144 wrote to memory of 1896	1144	firefox.exe	113
PID 1144 wrote to memory of 1896	1144	firefox.exe	113
PID 1144 wrote to memory of 1896	1144	firefox.exe	113
PID 1144 wrote to memory of 1896	1144	firefox.exe	113
PID 1144 wrote to memory of 1896	1144	firefox.exe	113
PID 1144 wrote to memory of 1896	1144	firefox.exe	113
PID 1144 wrote to memory of 1896	1144	firefox.exe	113
PID 1144 wrote to memory of 1896	1144	firefox.exe	113
PID 1144 wrote to memory of 1896	1144	firefox.exe	113
PID 1144 wrote to memory of 1896	1144	firefox.exe	113
PID 1144 wrote to memory of 1896	1144	firefox.exe	113
PID 1144 wrote to memory of 1896	1144	firefox.exe	113
PID 1144 wrote to memory of 1896	1144	firefox.exe	113
PID 1144 wrote to memory of 1896	1144	firefox.exe	113
PID 1144 wrote to memory of 1896	1144	firefox.exe	113
PID 1144 wrote to memory of 1896	1144	firefox.exe	113
PID 1144 wrote to memory of 1896	1144	firefox.exe	113
PID 1144 wrote to memory of 1896	1144	firefox.exe	113
PID 1144 wrote to memory of 1896	1144	firefox.exe	113
PID 1144 wrote to memory of 1896	1144	firefox.exe	113
PID 1144 wrote to memory of 1896	1144	firefox.exe	113
PID 1144 wrote to memory of 1896	1144	firefox.exe	113
PID 1144 wrote to memory of 1896	1144	firefox.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\windows defender disabler\dControl.exe
"C:\Users\Admin\AppData\Local\Temp\windows defender disabler\dControl.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2156
- C:\Users\Admin\AppData\Local\Temp\windows defender disabler\dControl.exe
  "C:\Users\Admin\AppData\Local\Temp\windows defender disabler\dControl.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5016
- - C:\Users\Admin\AppData\Local\Temp\windows defender disabler\dControl.exe
    "C:\Users\Admin\AppData\Local\Temp\windows defender disabler\dControl.exe" /TI
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Modifies security service
    - Sets file execution options in registry
    - Windows security modification
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:436
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Program Files\Windows Defender\MSASCui.exe
      4⤵
      PID:3076
  - - C:\Users\Admin\AppData\Local\Temp\windows defender disabler\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\windows defender disabler\dControl.exe" /EXP |3388|
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4384
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Program Files\Windows Defender\MSASCuiL.exe
      4⤵
      PID:2296
  - - C:\Users\Admin\AppData\Local\Temp\windows defender disabler\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\windows defender disabler\dControl.exe" /EXP |3388|
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4556
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:3396
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4492

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Program Files\Windows Defender\MSASCui.exe
  "C:\Program Files\Windows Defender\MSASCui.exe"
  2⤵
  PID:4288

\??\c:\windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:668

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
1⤵
PID:3004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4952

\??\c:\windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1572

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Program Files\Windows Defender\MSASCuiL.exe
  "C:\Program Files\Windows Defender\MSASCuiL.exe"
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2148

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Registers COM server for autorun
- Adds Run key to start application
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -EnableService
  2⤵
  PID:3092
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4184
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:424
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -UnmanagedUpdate
  2⤵
  PID:4820
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    PID:1752
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" GetDeviceTicket -AccessKey 7C3D8930-1F72-CD02-B9A5-91A222A7F783
  2⤵
  - Drops file in Windows directory
  PID:816
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
  2⤵
  PID:4784

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1144
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1144.0.1996401457\514399318" -parentBuildID 20221007134813 -prefsHandle 1700 -prefMapHandle 1688 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a20ae54c-b5ac-4ab3-ba13-2c84aff93837} 1144 "\\.\pipe\gecko-crash-server-pipe.1144" 1792 23d186d7058 gpu
    3⤵
    PID:2016
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1144.1.1631566022\544344084" -parentBuildID 20221007134813 -prefsHandle 2144 -prefMapHandle 2140 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {390eef76-7a6e-4813-a3ba-7af2f281a2c0} 1144 "\\.\pipe\gecko-crash-server-pipe.1144" 2180 23d18606258 socket
    3⤵
    - Checks processor information in registry
    PID:1896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1144.2.433132183\1902359421" -childID 1 -isForBrowser -prefsHandle 3244 -prefMapHandle 2680 -prefsLen 20866 -prefMapSize 233444 -jsInitHandle 1240 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {186db7d5-7a12-4f9c-a63e-a8334fbd31e4} 1144 "\\.\pipe\gecko-crash-server-pipe.1144" 3236 23d1c79f758 tab
    3⤵
    PID:4296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1144.3.817374305\844644209" -childID 2 -isForBrowser -prefsHandle 1152 -prefMapHandle 1148 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1240 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9c407b98-4bee-42bd-bc79-7e7782f69734} 1144 "\\.\pipe\gecko-crash-server-pipe.1144" 3720 23d1b159a58 tab
    3⤵
    PID:4732
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1144.4.1338132453\1125454888" -childID 3 -isForBrowser -prefsHandle 4348 -prefMapHandle 4344 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1240 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {55e70194-54d8-4e03-8670-626e71a53f5f} 1144 "\\.\pipe\gecko-crash-server-pipe.1144" 4356 23d1ea35e58 tab
    3⤵
    PID:4172
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1144.5.2112741115\101786136" -childID 4 -isForBrowser -prefsHandle 4900 -prefMapHandle 4896 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1240 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2ad1d4f9-0572-4d49-bd53-ca78d2f2c656} 1144 "\\.\pipe\gecko-crash-server-pipe.1144" 4884 23d1aeddb58 tab
    3⤵
    PID:5460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1144.7.2129896307\1275940375" -childID 6 -isForBrowser -prefsHandle 5232 -prefMapHandle 5236 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1240 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a14e8e1e-1351-4c36-806e-8f531627d1d0} 1144 "\\.\pipe\gecko-crash-server-pipe.1144" 5224 23d1aedab58 tab
    3⤵
    PID:5476
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1144.6.565442325\766847211" -childID 5 -isForBrowser -prefsHandle 5036 -prefMapHandle 5040 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1240 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {40127b9a-6b97-4f2f-b4e1-66347fa0e0e3} 1144 "\\.\pipe\gecko-crash-server-pipe.1144" 5028 23d1aeda258 tab
    3⤵
    PID:5468

\??\c:\windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry