arkei | ad2c6c8d68058c316b1f3c343b59c0c14526f4a7c84ed771b2d90f590fc3c535

Windows Service

T1543.003

Disable or Modify Tools

Processes:

ce5706f1a1dd859a8233397c2490680b.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	ce5706f1a1dd859a8233397c2490680b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	ce5706f1a1dd859a8233397c2490680b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	ce5706f1a1dd859a8233397c2490680b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	ce5706f1a1dd859a8233397c2490680b.exe

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

Modify Registry

Processes:

ce5706f1a1dd859a8233397c2490680b.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	ce5706f1a1dd859a8233397c2490680b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\ce5706f1a1dd859a8233397c2490680b.exe = "0"	ce5706f1a1dd859a8233397c2490680b.exe

Nirsoft 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\84870415-fc5c-41af-a856-d4ffa3dea4d9\AdvancedRun.exe	Nirsoft

Executes dropped EXE 2 IoCs

Processes:

AdvancedRun.exeAdvancedRun.exe

pid process

2516 AdvancedRun.exe
2512 AdvancedRun.exe
Loads dropped DLL 4 IoCs

Processes:

ce5706f1a1dd859a8233397c2490680b.exeAdvancedRun.exe

pid process

2204 ce5706f1a1dd859a8233397c2490680b.exe
2204 ce5706f1a1dd859a8233397c2490680b.exe
2516 AdvancedRun.exe
2516 AdvancedRun.exe

pid	process
2516	AdvancedRun.exe
2512	AdvancedRun.exe

pid	process
2204	ce5706f1a1dd859a8233397c2490680b.exe
2204	ce5706f1a1dd859a8233397c2490680b.exe
2516	AdvancedRun.exe
2516	AdvancedRun.exe

Windows security modification 2 TTPs 8 IoCs

evasion trojan

Disable or Modify Tools

Modify Registry

Processes:

ce5706f1a1dd859a8233397c2490680b.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	ce5706f1a1dd859a8233397c2490680b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions	ce5706f1a1dd859a8233397c2490680b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\ce5706f1a1dd859a8233397c2490680b.exe = "0"	ce5706f1a1dd859a8233397c2490680b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Real-Time Protection	ce5706f1a1dd859a8233397c2490680b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	ce5706f1a1dd859a8233397c2490680b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0"	ce5706f1a1dd859a8233397c2490680b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	ce5706f1a1dd859a8233397c2490680b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	ce5706f1a1dd859a8233397c2490680b.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

ce5706f1a1dd859a8233397c2490680b.exe

description pid process target process

PID 2204 set thread context of 2432 2204 ce5706f1a1dd859a8233397c2490680b.exe ce5706f1a1dd859a8233397c2490680b.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2420 2432 WerFault.exe ce5706f1a1dd859a8233397c2490680b.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

AdvancedRun.exeAdvancedRun.exepowershell.exe

pid process

2516 AdvancedRun.exe
2516 AdvancedRun.exe
2512 AdvancedRun.exe
2512 AdvancedRun.exe
2636 powershell.exe

description	pid	process	target process
PID 2204 set thread context of 2432	2204	ce5706f1a1dd859a8233397c2490680b.exe	ce5706f1a1dd859a8233397c2490680b.exe

pid	pid_target	process	target process
2420	2432	WerFault.exe	ce5706f1a1dd859a8233397c2490680b.exe

pid	process
2516	AdvancedRun.exe
2516	AdvancedRun.exe
2512	AdvancedRun.exe
2512	AdvancedRun.exe
2636	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

AdvancedRun.exeAdvancedRun.exece5706f1a1dd859a8233397c2490680b.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2516	AdvancedRun.exe
Token: SeImpersonatePrivilege	2516	AdvancedRun.exe
Token: SeDebugPrivilege	2512	AdvancedRun.exe
Token: SeImpersonatePrivilege	2512	AdvancedRun.exe
Token: SeDebugPrivilege	2204	ce5706f1a1dd859a8233397c2490680b.exe
Token: SeDebugPrivilege	2636	powershell.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

ce5706f1a1dd859a8233397c2490680b.exeAdvancedRun.exece5706f1a1dd859a8233397c2490680b.exe

description	pid	process	target process
PID 2204 wrote to memory of 2516	2204	ce5706f1a1dd859a8233397c2490680b.exe	AdvancedRun.exe
PID 2204 wrote to memory of 2516	2204	ce5706f1a1dd859a8233397c2490680b.exe	AdvancedRun.exe
PID 2204 wrote to memory of 2516	2204	ce5706f1a1dd859a8233397c2490680b.exe	AdvancedRun.exe
PID 2204 wrote to memory of 2516	2204	ce5706f1a1dd859a8233397c2490680b.exe	AdvancedRun.exe
PID 2516 wrote to memory of 2512	2516	AdvancedRun.exe	AdvancedRun.exe
PID 2516 wrote to memory of 2512	2516	AdvancedRun.exe	AdvancedRun.exe
PID 2516 wrote to memory of 2512	2516	AdvancedRun.exe	AdvancedRun.exe
PID 2516 wrote to memory of 2512	2516	AdvancedRun.exe	AdvancedRun.exe
PID 2204 wrote to memory of 2636	2204	ce5706f1a1dd859a8233397c2490680b.exe	powershell.exe
PID 2204 wrote to memory of 2636	2204	ce5706f1a1dd859a8233397c2490680b.exe	powershell.exe
PID 2204 wrote to memory of 2636	2204	ce5706f1a1dd859a8233397c2490680b.exe	powershell.exe
PID 2204 wrote to memory of 2636	2204	ce5706f1a1dd859a8233397c2490680b.exe	powershell.exe
PID 2204 wrote to memory of 2432	2204	ce5706f1a1dd859a8233397c2490680b.exe	ce5706f1a1dd859a8233397c2490680b.exe
PID 2204 wrote to memory of 2432	2204	ce5706f1a1dd859a8233397c2490680b.exe	ce5706f1a1dd859a8233397c2490680b.exe
PID 2204 wrote to memory of 2432	2204	ce5706f1a1dd859a8233397c2490680b.exe	ce5706f1a1dd859a8233397c2490680b.exe
PID 2204 wrote to memory of 2432	2204	ce5706f1a1dd859a8233397c2490680b.exe	ce5706f1a1dd859a8233397c2490680b.exe
PID 2204 wrote to memory of 2432	2204	ce5706f1a1dd859a8233397c2490680b.exe	ce5706f1a1dd859a8233397c2490680b.exe
PID 2204 wrote to memory of 2432	2204	ce5706f1a1dd859a8233397c2490680b.exe	ce5706f1a1dd859a8233397c2490680b.exe
PID 2204 wrote to memory of 2432	2204	ce5706f1a1dd859a8233397c2490680b.exe	ce5706f1a1dd859a8233397c2490680b.exe
PID 2204 wrote to memory of 2432	2204	ce5706f1a1dd859a8233397c2490680b.exe	ce5706f1a1dd859a8233397c2490680b.exe
PID 2204 wrote to memory of 2432	2204	ce5706f1a1dd859a8233397c2490680b.exe	ce5706f1a1dd859a8233397c2490680b.exe
PID 2204 wrote to memory of 2432	2204	ce5706f1a1dd859a8233397c2490680b.exe	ce5706f1a1dd859a8233397c2490680b.exe
PID 2204 wrote to memory of 2432	2204	ce5706f1a1dd859a8233397c2490680b.exe	ce5706f1a1dd859a8233397c2490680b.exe
PID 2432 wrote to memory of 2420	2432	ce5706f1a1dd859a8233397c2490680b.exe	WerFault.exe
PID 2432 wrote to memory of 2420	2432	ce5706f1a1dd859a8233397c2490680b.exe	WerFault.exe
PID 2432 wrote to memory of 2420	2432	ce5706f1a1dd859a8233397c2490680b.exe	WerFault.exe
PID 2432 wrote to memory of 2420	2432	ce5706f1a1dd859a8233397c2490680b.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\ce5706f1a1dd859a8233397c2490680b.exe
"C:\Users\Admin\AppData\Local\Temp\ce5706f1a1dd859a8233397c2490680b.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2204

C:\Users\Admin\AppData\Local\Temp\84870415-fc5c-41af-a856-d4ffa3dea4d9\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\84870415-fc5c-41af-a856-d4ffa3dea4d9\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\84870415-fc5c-41af-a856-d4ffa3dea4d9\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2516

C:\Users\Admin\AppData\Local\Temp\84870415-fc5c-41af-a856-d4ffa3dea4d9\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\84870415-fc5c-41af-a856-d4ffa3dea4d9\AdvancedRun.exe" /SpecialRun 4101d8 2516
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2512

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ce5706f1a1dd859a8233397c2490680b.exe" -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2636

C:\Users\Admin\AppData\Local\Temp\ce5706f1a1dd859a8233397c2490680b.exe
"C:\Users\Admin\AppData\Local\Temp\ce5706f1a1dd859a8233397c2490680b.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 44
3⤵
- Program crash
PID:2420

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

3

Impair Defenses

3

T1562

Disable or Modify Tools

3

Credential Access

Discovery

System Information Discovery