1ef6c1a4dfdc39b63bfe650ca81ab89510de6c0d3d7c608ac5be80033e559326

Windows Service

Disable or Modify Tools

T1562.001

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION	dControl.exe

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

Windows Service

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	dControl.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "2"	dControl.exe

Downloads MZ/PE file

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpcmdrun.exe	dControl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpcmdrun.exe\Debugger = "C:\\Windows\\System32\\systray.exe"	dControl.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MPCMDRUN.EXE	dControl.exe

Registers COM server for autorun 1 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32	MsMpEng.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2428-0-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/4100-23-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/4100-45-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/2428-22-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/1552-107-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/1552-109-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/1552-110-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/1552-111-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/1552-112-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/1552-138-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/3360-448-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/2408-774-0x0000000000400000-0x00000000004CD000-memory.dmp	upx

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\DisableAntiSpyware = "1"	dControl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\DisableAntiVirus = "1"	dControl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection	dControl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	dControl.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe

AutoIT Executable 10 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/4100-45-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/2428-22-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/1552-107-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/1552-109-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/1552-110-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/1552-111-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/1552-112-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/1552-138-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/3360-448-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/2408-774-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	dControl.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	dControl.exe
File opened for modification	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	dControl.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe
File created	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\MpCmdRun-9D-53C9D589-6B66-4F30-9BAB-9A0193B0BAFC.lock	MpCmdRun.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe
File created	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\mpam-472f8c15.exe	MpCmdRun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1384	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	MsMpEng.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	MsMpEng.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	MsMpEng.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\EXTENSION VALIDATION\{2781761E-28E0-4109-99FE-B9D127C57AFE}	MsMpEng.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\EXTENSION VALIDATION\{2781761E-28E0-4109-99FE-B9D127C57AFE}	MsMpEng.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Defender	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	MsMpEng.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows Defender	MpCmdRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MsMpEng.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows Defender\LastKnownGoodProxy = "1"	MpCmdRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache	MpCmdRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MsMpEng.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\CLSID	MsMpEng.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\*\SHELLEX\CONTEXTMENUHANDLERS\EPP	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32	MsMpEng.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\Implemented Categories\Disabled - {56FFCC30-D398-11D0-B2AE-00A0C908FA49}	MsMpEng.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\DRIVE\SHELLEX\CONTEXTMENUHANDLERS\EPP	MsMpEng.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\DIRECTORY\SHELLEX\CONTEXTMENUHANDLERS\EPP	MsMpEng.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\Implemented Categories\Disabled - {56FFCC30-D398-11D0-B2AE-00A0C908FA49}	MsMpEng.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2428	dControl.exe
2428	dControl.exe
2428	dControl.exe
2428	dControl.exe
2428	dControl.exe
2428	dControl.exe
4100	dControl.exe
4100	dControl.exe
4100	dControl.exe
4100	dControl.exe
4100	dControl.exe
4100	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
3360	dControl.exe
3360	dControl.exe
3360	dControl.exe
3360	dControl.exe
3360	dControl.exe
3360	dControl.exe
1552	dControl.exe
1552	dControl.exe
1384	powershell.exe
1384	powershell.exe
1552	dControl.exe
1552	dControl.exe
1384	powershell.exe
1384	powershell.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1552	dControl.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
624	Process not Found
1876	MsMpEng.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeDebugPrivilege	2428	dControl.exe
Token: SeAssignPrimaryTokenPrivilege	2428	dControl.exe
Token: SeIncreaseQuotaPrivilege	2428	dControl.exe
Token: 0	2428	dControl.exe
Token: SeDebugPrivilege	4100	dControl.exe
Token: SeAssignPrimaryTokenPrivilege	4100	dControl.exe
Token: SeIncreaseQuotaPrivilege	4100	dControl.exe
Token: SeDebugPrivilege	1552	dControl.exe
Token: SeAssignPrimaryTokenPrivilege	1552	dControl.exe
Token: SeIncreaseQuotaPrivilege	1552	dControl.exe
Token: 0	1552	dControl.exe
Token: SeAssignPrimaryTokenPrivilege	1876	MsMpEng.exe
Token: SeIncreaseQuotaPrivilege	1876	MsMpEng.exe
Token: SeTcbPrivilege	1876	MsMpEng.exe
Token: SeSecurityPrivilege	1876	MsMpEng.exe
Token: SeTakeOwnershipPrivilege	1876	MsMpEng.exe
Token: SeLoadDriverPrivilege	1876	MsMpEng.exe
Token: SeIncBasePriorityPrivilege	1876	MsMpEng.exe
Token: SeBackupPrivilege	1876	MsMpEng.exe
Token: SeRestorePrivilege	1876	MsMpEng.exe
Token: SeShutdownPrivilege	1876	MsMpEng.exe
Token: SeDebugPrivilege	1876	MsMpEng.exe
Token: SeSystemEnvironmentPrivilege	1876	MsMpEng.exe
Token: SeChangeNotifyPrivilege	1876	MsMpEng.exe
Token: SeImpersonatePrivilege	1876	MsMpEng.exe
Token: SeDebugPrivilege	1876	MsMpEng.exe
Token: SeBackupPrivilege	1876	MsMpEng.exe
Token: SeRestorePrivilege	1876	MsMpEng.exe
Token: SeDebugPrivilege	1384	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	1384	powershell.exe
Token: SeIncreaseQuotaPrivilege	1384	powershell.exe
Token: SeSecurityPrivilege	1384	powershell.exe
Token: SeTakeOwnershipPrivilege	1384	powershell.exe
Token: SeLoadDriverPrivilege	1384	powershell.exe
Token: SeSystemtimePrivilege	1384	powershell.exe
Token: SeBackupPrivilege	1384	powershell.exe
Token: SeRestorePrivilege	1384	powershell.exe
Token: SeShutdownPrivilege	1384	powershell.exe
Token: SeSystemEnvironmentPrivilege	1384	powershell.exe
Token: SeUndockPrivilege	1384	powershell.exe
Token: SeManageVolumePrivilege	1384	powershell.exe
Token: SeDebugPrivilege	1552	dControl.exe
Token: SeAssignPrimaryTokenPrivilege	1552	dControl.exe
Token: SeIncreaseQuotaPrivilege	1552	dControl.exe
Token: 0	1552	dControl.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe
1552	dControl.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 3360	1552	dControl.exe	87
PID 1552 wrote to memory of 3360	1552	dControl.exe	87
PID 1552 wrote to memory of 3360	1552	dControl.exe	87
PID 1552 wrote to memory of 4308	1552	dControl.exe	88
PID 1552 wrote to memory of 4308	1552	dControl.exe	88
PID 1952 wrote to memory of 3116	1952	explorer.exe	91
PID 1952 wrote to memory of 3116	1952	explorer.exe	91
PID 1876 wrote to memory of 3796	1876	MsMpEng.exe	96
PID 1876 wrote to memory of 3796	1876	MsMpEng.exe	96
PID 1876 wrote to memory of 2432	1876	MsMpEng.exe	100
PID 1876 wrote to memory of 2432	1876	MsMpEng.exe	100
PID 1876 wrote to memory of 1940	1876	MsMpEng.exe	102
PID 1876 wrote to memory of 1940	1876	MsMpEng.exe	102
PID 1940 wrote to memory of 2644	1940	MpCmdRun.exe	104
PID 1940 wrote to memory of 2644	1940	MpCmdRun.exe	104
PID 1876 wrote to memory of 1180	1876	MsMpEng.exe	105
PID 1876 wrote to memory of 1180	1876	MsMpEng.exe	105
PID 1552 wrote to memory of 1384	1552	dControl.exe	107
PID 1552 wrote to memory of 1384	1552	dControl.exe	107
PID 1552 wrote to memory of 2408	1552	dControl.exe	114
PID 1552 wrote to memory of 2408	1552	dControl.exe	114
PID 1552 wrote to memory of 2408	1552	dControl.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\dControl.exe
"C:\Users\Admin\AppData\Local\Temp\dControl.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2428
- C:\Users\Admin\AppData\Local\Temp\dControl.exe
  C:\Users\Admin\AppData\Local\Temp\dControl.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4100
- - C:\Users\Admin\AppData\Local\Temp\dControl.exe
    "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /TI
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Modifies security service
    - Sets file execution options in registry
    - Windows security modification
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1552
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Program Files\Windows Defender\MSASCuiL.exe
      4⤵
      PID:3084
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3352|
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3360
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:4308
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1384
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" ms-settings:windowsdefender
      4⤵
      PID:2336
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3352|
      4⤵
      PID:2408

\??\c:\windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2388

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
1⤵
PID:4668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:3548

\??\c:\windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3404

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
1⤵
PID:4276

\??\c:\windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1012

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Program Files\Windows Defender\MSASCuiL.exe
  "C:\Program Files\Windows Defender\MSASCuiL.exe"
  2⤵
  PID:3116

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Registers COM server for autorun
- Adds Run key to start application
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -EnableService
  2⤵
  PID:4408
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:3796
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:4956
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -UnmanagedUpdate
  2⤵
  PID:2432
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    PID:2644
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" GetDeviceTicket -AccessKey 037FDCAB-FDF8-EEB3-001D-841B0D36637B
  2⤵
  - Drops file in Windows directory
  PID:1180

\??\c:\windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1924

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry