gh0strat | c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74

Windows Service

T1543.003

Processes:

c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe

PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox
Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 1 IoCs

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

Processes:

c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe

Windows security bypass 2 TTPs 6 IoCs

Disable or Modify Tools

Modify Registry

Processes:

c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe

Drops file in Drivers directory 1 IoCs

Processes:

TXPlatfor.exe

description ioc process

File created C:\Windows\system32\drivers\QAssist.sys TXPlatfor.exe

description	ioc	process
File created	C:\Windows\system32\drivers\QAssist.sys	TXPlatfor.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

R.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Remote Data\Parameters\ServiceDll = "C:\\Windows\\system32\\259396231.txt"	R.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

TXPlatfor.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatfor.exe

Executes dropped EXE 6 IoCs

Processes:

R.exeN.exeTXPlatfor.exeTXPlatfor.exeHD_c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exeRemote Data.exe

pid	process
2056	R.exe
2632	N.exe
2620	TXPlatfor.exe
2544	TXPlatfor.exe
2420	HD_c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
2180	Remote Data.exe

Loads dropped DLL 9 IoCs

Processes:

c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exeR.exesvchost.exeTXPlatfor.exeRemote Data.exe

pid	process
2824	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
2056	R.exe
1624	svchost.exe
2824	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
2620	TXPlatfor.exe
2824	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
2824	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
1624	svchost.exe
2180	Remote Data.exe

UPX packed file 40 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2824-1-0x00000000021A0000-0x000000000322E000-memory.dmp	upx
behavioral1/memory/2824-4-0x00000000021A0000-0x000000000322E000-memory.dmp	upx
behavioral1/memory/2824-8-0x00000000021A0000-0x000000000322E000-memory.dmp	upx
behavioral1/memory/2824-15-0x00000000021A0000-0x000000000322E000-memory.dmp	upx
behavioral1/memory/2824-16-0x00000000021A0000-0x000000000322E000-memory.dmp	upx
behavioral1/memory/2824-19-0x00000000021A0000-0x000000000322E000-memory.dmp	upx
behavioral1/memory/2824-23-0x00000000021A0000-0x000000000322E000-memory.dmp	upx
behavioral1/memory/2824-24-0x00000000021A0000-0x000000000322E000-memory.dmp	upx
behavioral1/memory/2824-28-0x00000000021A0000-0x000000000322E000-memory.dmp	upx
behavioral1/memory/2632-31-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2632-34-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2632-35-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2632-33-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2824-39-0x00000000021A0000-0x000000000322E000-memory.dmp	upx
behavioral1/memory/2824-40-0x00000000021A0000-0x000000000322E000-memory.dmp	upx
behavioral1/memory/2632-49-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2620-48-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2544-68-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2544-70-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2544-73-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2824-74-0x00000000021A0000-0x000000000322E000-memory.dmp	upx
behavioral1/memory/2824-75-0x00000000021A0000-0x000000000322E000-memory.dmp	upx
behavioral1/memory/2824-76-0x00000000021A0000-0x000000000322E000-memory.dmp	upx
behavioral1/memory/2824-84-0x00000000021A0000-0x000000000322E000-memory.dmp	upx
behavioral1/memory/2824-85-0x00000000021A0000-0x000000000322E000-memory.dmp	upx
behavioral1/memory/2824-86-0x00000000021A0000-0x000000000322E000-memory.dmp	upx
behavioral1/memory/2824-88-0x00000000021A0000-0x000000000322E000-memory.dmp	upx
behavioral1/memory/2824-90-0x00000000021A0000-0x000000000322E000-memory.dmp	upx
behavioral1/memory/2824-94-0x00000000021A0000-0x000000000322E000-memory.dmp	upx
behavioral1/memory/2824-96-0x00000000021A0000-0x000000000322E000-memory.dmp	upx
behavioral1/memory/2824-98-0x00000000021A0000-0x000000000322E000-memory.dmp	upx
behavioral1/memory/2824-99-0x00000000021A0000-0x000000000322E000-memory.dmp	upx
behavioral1/memory/2824-100-0x00000000021A0000-0x000000000322E000-memory.dmp	upx
behavioral1/memory/2824-102-0x00000000021A0000-0x000000000322E000-memory.dmp	upx
behavioral1/memory/2824-104-0x00000000021A0000-0x000000000322E000-memory.dmp	upx
behavioral1/memory/2824-106-0x00000000021A0000-0x000000000322E000-memory.dmp	upx
behavioral1/memory/2824-108-0x00000000021A0000-0x000000000322E000-memory.dmp	upx
behavioral1/memory/2824-110-0x00000000021A0000-0x000000000322E000-memory.dmp	upx
behavioral1/memory/2824-112-0x00000000021A0000-0x000000000322E000-memory.dmp	upx
behavioral1/memory/2824-118-0x00000000021A0000-0x000000000322E000-memory.dmp	upx

Windows security modification 2 TTPs 7 IoCs

Disable or Modify Tools

Modify Registry

Processes:

c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

System Information Discovery

T1082

Processes:

c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe

description	ioc	process
File opened (read-only)	\??\I:	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
File opened (read-only)	\??\T:	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
File opened (read-only)	\??\X:	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
File opened (read-only)	\??\Z:	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
File opened (read-only)	\??\S:	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
File opened (read-only)	\??\H:	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
File opened (read-only)	\??\J:	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
File opened (read-only)	\??\K:	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
File opened (read-only)	\??\L:	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
File opened (read-only)	\??\O:	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
File opened (read-only)	\??\G:	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
File opened (read-only)	\??\M:	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
File opened (read-only)	\??\N:	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
File opened (read-only)	\??\P:	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
File opened (read-only)	\??\W:	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
File opened (read-only)	\??\Y:	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
File opened (read-only)	\??\E:	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
File opened (read-only)	\??\Q:	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
File opened (read-only)	\??\R:	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
File opened (read-only)	\??\U:	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
File opened (read-only)	\??\V:	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

Processes:

c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe

description	ioc	process
File opened for modification	C:\autorun.inf	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
File opened for modification	F:\autorun.inf	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe

Drops file in System32 directory 6 IoCs

Processes:

R.exesvchost.exeN.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\ini.ini	R.exe
File created	C:\Windows\SysWOW64\Remote Data.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\Remote Data.exe	svchost.exe
File created	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe
File created	C:\Windows\SysWOW64\259396231.txt	R.exe

Drops file in Program Files directory 5 IoCs

Processes:

c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7z.exe	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zFM.exe	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zG.exe	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\Uninstall.exe	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe

Drops file in Windows directory 1 IoCs

Processes:

c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe

description ioc process

File opened for modification C:\Windows\SYSTEM.INI c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2808 PING.EXE

description	ioc	process
File opened for modification	C:\Windows\SYSTEM.INI	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe

pid	process
2808	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe

pid	process
2824	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
2824	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

TXPlatfor.exe

pid process

2544 TXPlatfor.exe

pid	process
2544	TXPlatfor.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

Processes:

c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exeN.exeTXPlatfor.exe

description	pid	process
Token: SeDebugPrivilege	2824	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
Token: SeDebugPrivilege	2824	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
Token: SeDebugPrivilege	2824	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
Token: SeDebugPrivilege	2824	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
Token: SeDebugPrivilege	2824	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
Token: SeDebugPrivilege	2824	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
Token: SeDebugPrivilege	2824	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
Token: SeDebugPrivilege	2824	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
Token: SeDebugPrivilege	2824	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
Token: SeDebugPrivilege	2824	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
Token: SeDebugPrivilege	2824	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
Token: SeDebugPrivilege	2824	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
Token: SeDebugPrivilege	2824	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
Token: SeDebugPrivilege	2824	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
Token: SeDebugPrivilege	2824	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
Token: SeDebugPrivilege	2824	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
Token: SeIncBasePriorityPrivilege	2632	N.exe
Token: SeLoadDriverPrivilege	2544	TXPlatfor.exe
Token: 33	2544	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	2544	TXPlatfor.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exeHD_c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe

pid	process
2824	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
2824	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
2420	HD_c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
2420	HD_c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe

Suspicious use of WriteProcessMemory 35 IoCs

Processes:

c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exeTXPlatfor.exeN.execmd.exesvchost.exe

description	pid	process	target process
PID 2824 wrote to memory of 2056	2824	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe	R.exe
PID 2824 wrote to memory of 2056	2824	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe	R.exe
PID 2824 wrote to memory of 2056	2824	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe	R.exe
PID 2824 wrote to memory of 2056	2824	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe	R.exe
PID 2824 wrote to memory of 1064	2824	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe	Dwm.exe
PID 2824 wrote to memory of 2632	2824	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe	N.exe
PID 2824 wrote to memory of 2632	2824	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe	N.exe
PID 2824 wrote to memory of 2632	2824	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe	N.exe
PID 2824 wrote to memory of 2632	2824	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe	N.exe
PID 2824 wrote to memory of 2632	2824	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe	N.exe
PID 2824 wrote to memory of 2632	2824	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe	N.exe
PID 2824 wrote to memory of 2632	2824	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe	N.exe
PID 2620 wrote to memory of 2544	2620	TXPlatfor.exe	TXPlatfor.exe
PID 2620 wrote to memory of 2544	2620	TXPlatfor.exe	TXPlatfor.exe
PID 2620 wrote to memory of 2544	2620	TXPlatfor.exe	TXPlatfor.exe
PID 2620 wrote to memory of 2544	2620	TXPlatfor.exe	TXPlatfor.exe
PID 2620 wrote to memory of 2544	2620	TXPlatfor.exe	TXPlatfor.exe
PID 2620 wrote to memory of 2544	2620	TXPlatfor.exe	TXPlatfor.exe
PID 2620 wrote to memory of 2544	2620	TXPlatfor.exe	TXPlatfor.exe
PID 2632 wrote to memory of 2452	2632	N.exe	cmd.exe
PID 2632 wrote to memory of 2452	2632	N.exe	cmd.exe
PID 2632 wrote to memory of 2452	2632	N.exe	cmd.exe
PID 2632 wrote to memory of 2452	2632	N.exe	cmd.exe
PID 2824 wrote to memory of 2420	2824	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe	HD_c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
PID 2824 wrote to memory of 2420	2824	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe	HD_c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
PID 2824 wrote to memory of 2420	2824	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe	HD_c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
PID 2824 wrote to memory of 2420	2824	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe	HD_c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
PID 2452 wrote to memory of 2808	2452	cmd.exe	PING.EXE
PID 2452 wrote to memory of 2808	2452	cmd.exe	PING.EXE
PID 2452 wrote to memory of 2808	2452	cmd.exe	PING.EXE
PID 2452 wrote to memory of 2808	2452	cmd.exe	PING.EXE
PID 1624 wrote to memory of 2180	1624	svchost.exe	Remote Data.exe
PID 1624 wrote to memory of 2180	1624	svchost.exe	Remote Data.exe
PID 1624 wrote to memory of 2180	1624	svchost.exe	Remote Data.exe
PID 1624 wrote to memory of 2180	1624	svchost.exe	Remote Data.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

Processes:

c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1064

C:\Users\Admin\AppData\Local\Temp\c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
"C:\Users\Admin\AppData\Local\Temp\c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe"
1⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2824

C:\Users\Admin\AppData\Local\Temp\R.exe
C:\Users\Admin\AppData\Local\Temp\\R.exe
2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2056

C:\Users\Admin\AppData\Local\Temp\N.exe
C:\Users\Admin\AppData\Local\Temp\\N.exe
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2632

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
3⤵
- Suspicious use of WriteProcessMemory
PID:2452

C:\Windows\SysWOW64\PING.EXE
ping -n 2 127.0.0.1
4⤵
- Runs ping.exe
PID:2808

C:\Users\Admin\AppData\Local\Temp\HD_c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
C:\Users\Admin\AppData\Local\Temp\HD_c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2420

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Remote Data"
1⤵
PID:2912

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Remote Data"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1624

C:\Windows\SysWOW64\Remote Data.exe
"C:\Windows\system32\Remote Data.exe" "c:\windows\system32\259396231.txt",MainThread
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180

C:\Windows\SysWOW64\TXPlatfor.exe
C:\Windows\SysWOW64\TXPlatfor.exe -auto
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2620

C:\Windows\SysWOW64\TXPlatfor.exe
C:\Windows\SysWOW64\TXPlatfor.exe -acsi
2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2544

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools