latentbot | 55caca52abf37a49b12a02e66216185dce838bb0222921647148ee495c1d1c08

Windows Service

T1543.003

Processes:

reg.exereg.exereg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\TIEGHZKC55.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TIEGHZKC55.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\TIEGHZKC55.exe = "C:\\Users\\Admin\\AppData\\Roaming\\TIEGHZKC55.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

WinSec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	WinSec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\iexplore = "C:\\Users\\Admin\\AppData\\Roaming\\TIEGHZKC55.exe"	WinSec.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

WinSec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{16E69CAB-EF79-AF1E-EBAD-5E74AFCB5F97}	WinSec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{16E69CAB-EF79-AF1E-EBAD-5E74AFCB5F97}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\TIEGHZKC55.exe"	WinSec.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{16E69CAB-EF79-AF1E-EBAD-5E74AFCB5F97}	WinSec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Active Setup\Installed Components\{16E69CAB-EF79-AF1E-EBAD-5E74AFCB5F97}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\TIEGHZKC55.exe"	WinSec.exe

Executes dropped EXE 2 IoCs

Processes:

TIEGHZKC55.exeWinSec.exe

pid process

1760 TIEGHZKC55.exe
2644 WinSec.exe
Loads dropped DLL 3 IoCs

Processes:

c4bd87c3284cab7b4a4d4039af0f933e.exeTIEGHZKC55.exe

pid process

2060 c4bd87c3284cab7b4a4d4039af0f933e.exe
2060 c4bd87c3284cab7b4a4d4039af0f933e.exe
1760 TIEGHZKC55.exe

pid	process
1760	TIEGHZKC55.exe
2644	WinSec.exe

pid	process
2060	c4bd87c3284cab7b4a4d4039af0f933e.exe
2060	c4bd87c3284cab7b4a4d4039af0f933e.exe
1760	TIEGHZKC55.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

WinSec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\iexplore = "C:\\Users\\Admin\\AppData\\Roaming\\TIEGHZKC55.exe"	WinSec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\iexplore = "C:\\Users\\Admin\\AppData\\Roaming\\TIEGHZKC55.exe"	WinSec.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

TIEGHZKC55.exe

description pid process target process

PID 1760 set thread context of 2644 1760 TIEGHZKC55.exe WinSec.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry key 1 TTPs 4 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exereg.exereg.exe

pid process

2964 reg.exe
2744 reg.exe
2912 reg.exe
2552 reg.exe

description	pid	process	target process
PID 1760 set thread context of 2644	1760	TIEGHZKC55.exe	WinSec.exe

pid	process
2964	reg.exe
2744	reg.exe
2912	reg.exe
2552	reg.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

Processes:

WinSec.exe

description	pid	process
Token: 1	2644	WinSec.exe
Token: SeCreateTokenPrivilege	2644	WinSec.exe
Token: SeAssignPrimaryTokenPrivilege	2644	WinSec.exe
Token: SeLockMemoryPrivilege	2644	WinSec.exe
Token: SeIncreaseQuotaPrivilege	2644	WinSec.exe
Token: SeMachineAccountPrivilege	2644	WinSec.exe
Token: SeTcbPrivilege	2644	WinSec.exe
Token: SeSecurityPrivilege	2644	WinSec.exe
Token: SeTakeOwnershipPrivilege	2644	WinSec.exe
Token: SeLoadDriverPrivilege	2644	WinSec.exe
Token: SeSystemProfilePrivilege	2644	WinSec.exe
Token: SeSystemtimePrivilege	2644	WinSec.exe
Token: SeProfSingleProcessPrivilege	2644	WinSec.exe
Token: SeIncBasePriorityPrivilege	2644	WinSec.exe
Token: SeCreatePagefilePrivilege	2644	WinSec.exe
Token: SeCreatePermanentPrivilege	2644	WinSec.exe
Token: SeBackupPrivilege	2644	WinSec.exe
Token: SeRestorePrivilege	2644	WinSec.exe
Token: SeShutdownPrivilege	2644	WinSec.exe
Token: SeDebugPrivilege	2644	WinSec.exe
Token: SeAuditPrivilege	2644	WinSec.exe
Token: SeSystemEnvironmentPrivilege	2644	WinSec.exe
Token: SeChangeNotifyPrivilege	2644	WinSec.exe
Token: SeRemoteShutdownPrivilege	2644	WinSec.exe
Token: SeUndockPrivilege	2644	WinSec.exe
Token: SeSyncAgentPrivilege	2644	WinSec.exe
Token: SeEnableDelegationPrivilege	2644	WinSec.exe
Token: SeManageVolumePrivilege	2644	WinSec.exe
Token: SeImpersonatePrivilege	2644	WinSec.exe
Token: SeCreateGlobalPrivilege	2644	WinSec.exe
Token: 31	2644	WinSec.exe
Token: 32	2644	WinSec.exe
Token: 33	2644	WinSec.exe
Token: 34	2644	WinSec.exe
Token: 35	2644	WinSec.exe
Token: SeDebugPrivilege	2644	WinSec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

WinSec.exe

pid process

2644 WinSec.exe
2644 WinSec.exe
2644 WinSec.exe

pid	process
2644	WinSec.exe
2644	WinSec.exe
2644	WinSec.exe

Suspicious use of WriteProcessMemory 46 IoCs

Processes:

c4bd87c3284cab7b4a4d4039af0f933e.exeTIEGHZKC55.exeWinSec.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 2060 wrote to memory of 1760	2060	c4bd87c3284cab7b4a4d4039af0f933e.exe	TIEGHZKC55.exe
PID 2060 wrote to memory of 1760	2060	c4bd87c3284cab7b4a4d4039af0f933e.exe	TIEGHZKC55.exe
PID 2060 wrote to memory of 1760	2060	c4bd87c3284cab7b4a4d4039af0f933e.exe	TIEGHZKC55.exe
PID 2060 wrote to memory of 1760	2060	c4bd87c3284cab7b4a4d4039af0f933e.exe	TIEGHZKC55.exe
PID 1760 wrote to memory of 2644	1760	TIEGHZKC55.exe	WinSec.exe
PID 1760 wrote to memory of 2644	1760	TIEGHZKC55.exe	WinSec.exe
PID 1760 wrote to memory of 2644	1760	TIEGHZKC55.exe	WinSec.exe
PID 1760 wrote to memory of 2644	1760	TIEGHZKC55.exe	WinSec.exe
PID 1760 wrote to memory of 2644	1760	TIEGHZKC55.exe	WinSec.exe
PID 1760 wrote to memory of 2644	1760	TIEGHZKC55.exe	WinSec.exe
PID 1760 wrote to memory of 2644	1760	TIEGHZKC55.exe	WinSec.exe
PID 1760 wrote to memory of 2644	1760	TIEGHZKC55.exe	WinSec.exe
PID 1760 wrote to memory of 2644	1760	TIEGHZKC55.exe	WinSec.exe
PID 1760 wrote to memory of 2644	1760	TIEGHZKC55.exe	WinSec.exe
PID 2644 wrote to memory of 2456	2644	WinSec.exe	cmd.exe
PID 2644 wrote to memory of 2456	2644	WinSec.exe	cmd.exe
PID 2644 wrote to memory of 2456	2644	WinSec.exe	cmd.exe
PID 2644 wrote to memory of 2456	2644	WinSec.exe	cmd.exe
PID 2644 wrote to memory of 2460	2644	WinSec.exe	cmd.exe
PID 2644 wrote to memory of 2460	2644	WinSec.exe	cmd.exe
PID 2644 wrote to memory of 2460	2644	WinSec.exe	cmd.exe
PID 2644 wrote to memory of 2460	2644	WinSec.exe	cmd.exe
PID 2644 wrote to memory of 2604	2644	WinSec.exe	cmd.exe
PID 2644 wrote to memory of 2604	2644	WinSec.exe	cmd.exe
PID 2644 wrote to memory of 2604	2644	WinSec.exe	cmd.exe
PID 2644 wrote to memory of 2604	2644	WinSec.exe	cmd.exe
PID 2644 wrote to memory of 2544	2644	WinSec.exe	cmd.exe
PID 2644 wrote to memory of 2544	2644	WinSec.exe	cmd.exe
PID 2644 wrote to memory of 2544	2644	WinSec.exe	cmd.exe
PID 2644 wrote to memory of 2544	2644	WinSec.exe	cmd.exe
PID 2456 wrote to memory of 2552	2456	cmd.exe	reg.exe
PID 2456 wrote to memory of 2552	2456	cmd.exe	reg.exe
PID 2456 wrote to memory of 2552	2456	cmd.exe	reg.exe
PID 2456 wrote to memory of 2552	2456	cmd.exe	reg.exe
PID 2460 wrote to memory of 2912	2460	cmd.exe	reg.exe
PID 2460 wrote to memory of 2912	2460	cmd.exe	reg.exe
PID 2460 wrote to memory of 2912	2460	cmd.exe	reg.exe
PID 2460 wrote to memory of 2912	2460	cmd.exe	reg.exe
PID 2604 wrote to memory of 2964	2604	cmd.exe	reg.exe
PID 2604 wrote to memory of 2964	2604	cmd.exe	reg.exe
PID 2604 wrote to memory of 2964	2604	cmd.exe	reg.exe
PID 2604 wrote to memory of 2964	2604	cmd.exe	reg.exe
PID 2544 wrote to memory of 2744	2544	cmd.exe	reg.exe
PID 2544 wrote to memory of 2744	2544	cmd.exe	reg.exe
PID 2544 wrote to memory of 2744	2544	cmd.exe	reg.exe
PID 2544 wrote to memory of 2744	2544	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\c4bd87c3284cab7b4a4d4039af0f933e.exe
"C:\Users\Admin\AppData\Local\Temp\c4bd87c3284cab7b4a4d4039af0f933e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2060

C:\Users\Admin\AppData\Local\Temp\TIEGHZKC55.exe
"C:\Users\Admin\AppData\Local\Temp\TIEGHZKC55.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1760

C:\Users\Admin\AppData\Roaming\WinSec.exe
C:\Users\Admin\AppData\Roaming\WinSec.exe
3⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2644

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
4⤵
- Suspicious use of WriteProcessMemory
PID:2456

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
5⤵
- Modifies firewall policy service
- Modifies registry key
PID:2552

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\TIEGHZKC55.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\TIEGHZKC55.exe:*:Enabled:Windows Messanger" /f
4⤵
- Suspicious use of WriteProcessMemory
PID:2460

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\TIEGHZKC55.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\TIEGHZKC55.exe:*:Enabled:Windows Messanger" /f
5⤵
- Modifies firewall policy service
- Modifies registry key
PID:2912

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
4⤵
- Suspicious use of WriteProcessMemory
PID:2604

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
5⤵
- Modifies firewall policy service
- Modifies registry key
PID:2964

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\TIEGHZKC55.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\TIEGHZKC55.exe:*:Enabled:Windows Messanger" /f
4⤵
- Suspicious use of WriteProcessMemory
PID:2544

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\TIEGHZKC55.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\TIEGHZKC55.exe:*:Enabled:Windows Messanger" /f
5⤵
- Modifies firewall policy service
- Modifies registry key
PID:2744

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

5

Credential Access

Discovery

System Information Discovery