sality | a72c4699fc3b7eac096dfc49cd89f7319838ff268fc554da231126fad77bdedb

Windows Service

T1543.003

Processes:

e57537f.exee576f83.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	e57537f.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	e57537f.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	e576f83.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	e576f83.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	e576f83.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	e57537f.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 2 IoCs

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

Processes:

e57537f.exee576f83.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e57537f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e576f83.exe

Windows security bypass 2 TTPs 12 IoCs

Disable or Modify Tools

Modify Registry

Processes:

e57537f.exee576f83.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e57537f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e576f83.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e576f83.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e576f83.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e576f83.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e576f83.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e576f83.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e57537f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e57537f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e57537f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e57537f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e57537f.exe

Executes dropped EXE 4 IoCs

Processes:

e57537f.exee575534.exee576f73.exee576f83.exe

pid process

3696 e57537f.exe
944 e575534.exe
3856 e576f73.exe
3436 e576f83.exe

pid	process
3696	e57537f.exe
944	e575534.exe
3856	e576f73.exe
3436	e576f83.exe

UPX packed file 33 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3696-11-0x0000000000880000-0x000000000193A000-memory.dmp	upx
behavioral2/memory/3696-15-0x0000000000880000-0x000000000193A000-memory.dmp	upx
behavioral2/memory/3696-16-0x0000000000880000-0x000000000193A000-memory.dmp	upx
behavioral2/memory/3696-14-0x0000000000880000-0x000000000193A000-memory.dmp	upx
behavioral2/memory/3696-13-0x0000000000880000-0x000000000193A000-memory.dmp	upx
behavioral2/memory/3696-12-0x0000000000880000-0x000000000193A000-memory.dmp	upx
behavioral2/memory/3696-10-0x0000000000880000-0x000000000193A000-memory.dmp	upx
behavioral2/memory/3696-8-0x0000000000880000-0x000000000193A000-memory.dmp	upx
behavioral2/memory/3696-9-0x0000000000880000-0x000000000193A000-memory.dmp	upx
behavioral2/memory/3696-29-0x0000000000880000-0x000000000193A000-memory.dmp	upx
behavioral2/memory/3696-37-0x0000000000880000-0x000000000193A000-memory.dmp	upx
behavioral2/memory/3696-38-0x0000000000880000-0x000000000193A000-memory.dmp	upx
behavioral2/memory/3696-39-0x0000000000880000-0x000000000193A000-memory.dmp	upx
behavioral2/memory/3696-41-0x0000000000880000-0x000000000193A000-memory.dmp	upx
behavioral2/memory/3696-40-0x0000000000880000-0x000000000193A000-memory.dmp	upx
behavioral2/memory/3696-43-0x0000000000880000-0x000000000193A000-memory.dmp	upx
behavioral2/memory/3696-44-0x0000000000880000-0x000000000193A000-memory.dmp	upx
behavioral2/memory/3696-58-0x0000000000880000-0x000000000193A000-memory.dmp	upx
behavioral2/memory/3696-60-0x0000000000880000-0x000000000193A000-memory.dmp	upx
behavioral2/memory/3696-62-0x0000000000880000-0x000000000193A000-memory.dmp	upx
behavioral2/memory/3696-75-0x0000000000880000-0x000000000193A000-memory.dmp	upx
behavioral2/memory/3696-76-0x0000000000880000-0x000000000193A000-memory.dmp	upx
behavioral2/memory/3696-79-0x0000000000880000-0x000000000193A000-memory.dmp	upx
behavioral2/memory/3696-81-0x0000000000880000-0x000000000193A000-memory.dmp	upx
behavioral2/memory/3696-83-0x0000000000880000-0x000000000193A000-memory.dmp	upx
behavioral2/memory/3696-84-0x0000000000880000-0x000000000193A000-memory.dmp	upx
behavioral2/memory/3696-85-0x0000000000880000-0x000000000193A000-memory.dmp	upx
behavioral2/memory/3696-89-0x0000000000880000-0x000000000193A000-memory.dmp	upx
behavioral2/memory/3696-95-0x0000000000880000-0x000000000193A000-memory.dmp	upx
behavioral2/memory/3696-97-0x0000000000880000-0x000000000193A000-memory.dmp	upx
behavioral2/memory/3696-98-0x0000000000880000-0x000000000193A000-memory.dmp	upx
behavioral2/memory/3436-133-0x0000000000B30000-0x0000000001BEA000-memory.dmp	upx
behavioral2/memory/3436-169-0x0000000000B30000-0x0000000001BEA000-memory.dmp	upx

Windows security modification 2 TTPs 14 IoCs

Disable or Modify Tools

Modify Registry

Processes:

e57537f.exee576f83.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e57537f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	e57537f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e576f83.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e576f83.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e576f83.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e57537f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e57537f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	e576f83.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e576f83.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e576f83.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e57537f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e57537f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e57537f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e576f83.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

System Information Discovery

T1082

Processes:

e57537f.exee576f83.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e57537f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e576f83.exe

Enumerates connected drives 3 TTPs 16 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

e57537f.exee576f83.exe

description	ioc	process
File opened (read-only)	\??\J:	e57537f.exe
File opened (read-only)	\??\K:	e57537f.exe
File opened (read-only)	\??\P:	e57537f.exe
File opened (read-only)	\??\S:	e57537f.exe
File opened (read-only)	\??\E:	e576f83.exe
File opened (read-only)	\??\G:	e57537f.exe
File opened (read-only)	\??\H:	e57537f.exe
File opened (read-only)	\??\I:	e57537f.exe
File opened (read-only)	\??\N:	e57537f.exe
File opened (read-only)	\??\O:	e57537f.exe
File opened (read-only)	\??\Q:	e57537f.exe
File opened (read-only)	\??\E:	e57537f.exe
File opened (read-only)	\??\L:	e57537f.exe
File opened (read-only)	\??\M:	e57537f.exe
File opened (read-only)	\??\G:	e576f83.exe
File opened (read-only)	\??\R:	e57537f.exe

Drops file in Program Files directory 4 IoCs

Processes:

e57537f.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\7z.exe	e57537f.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	e57537f.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	e57537f.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	e57537f.exe

Drops file in Windows directory 3 IoCs

Processes:

e57537f.exee576f83.exe

description	ioc	process
File created	C:\Windows\e5753dd	e57537f.exe
File opened for modification	C:\Windows\SYSTEM.INI	e57537f.exe
File created	C:\Windows\e57a47d	e576f83.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

e57537f.exee576f83.exe

pid process

3696 e57537f.exe
3696 e57537f.exe
3696 e57537f.exe
3696 e57537f.exe
3436 e576f83.exe
3436 e576f83.exe

pid	process
3696	e57537f.exe
3696	e57537f.exe
3696	e57537f.exe
3696	e57537f.exe
3436	e576f83.exe
3436	e576f83.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

e57537f.exe

description	pid	process
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe
Token: SeDebugPrivilege	3696	e57537f.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

rundll32.exerundll32.exee57537f.exee576f83.exe

description	pid	process	target process
PID 4836 wrote to memory of 4768	4836	rundll32.exe	rundll32.exe
PID 4836 wrote to memory of 4768	4836	rundll32.exe	rundll32.exe
PID 4836 wrote to memory of 4768	4836	rundll32.exe	rundll32.exe
PID 4768 wrote to memory of 3696	4768	rundll32.exe	e57537f.exe
PID 4768 wrote to memory of 3696	4768	rundll32.exe	e57537f.exe
PID 4768 wrote to memory of 3696	4768	rundll32.exe	e57537f.exe
PID 3696 wrote to memory of 796	3696	e57537f.exe	fontdrvhost.exe
PID 3696 wrote to memory of 804	3696	e57537f.exe	fontdrvhost.exe
PID 3696 wrote to memory of 380	3696	e57537f.exe	dwm.exe
PID 3696 wrote to memory of 3128	3696	e57537f.exe	sihost.exe
PID 3696 wrote to memory of 3144	3696	e57537f.exe	svchost.exe
PID 3696 wrote to memory of 3212	3696	e57537f.exe	taskhostw.exe
PID 3696 wrote to memory of 3484	3696	e57537f.exe	Explorer.EXE
PID 3696 wrote to memory of 3608	3696	e57537f.exe	svchost.exe
PID 3696 wrote to memory of 3808	3696	e57537f.exe	DllHost.exe
PID 3696 wrote to memory of 3896	3696	e57537f.exe	StartMenuExperienceHost.exe
PID 3696 wrote to memory of 3964	3696	e57537f.exe	RuntimeBroker.exe
PID 3696 wrote to memory of 4080	3696	e57537f.exe	SearchApp.exe
PID 3696 wrote to memory of 4140	3696	e57537f.exe	RuntimeBroker.exe
PID 3696 wrote to memory of 4252	3696	e57537f.exe	RuntimeBroker.exe
PID 3696 wrote to memory of 1796	3696	e57537f.exe	TextInputHost.exe
PID 3696 wrote to memory of 1672	3696	e57537f.exe	backgroundTaskHost.exe
PID 3696 wrote to memory of 3172	3696	e57537f.exe	backgroundTaskHost.exe
PID 3696 wrote to memory of 4836	3696	e57537f.exe	rundll32.exe
PID 3696 wrote to memory of 4768	3696	e57537f.exe	rundll32.exe
PID 3696 wrote to memory of 4768	3696	e57537f.exe	rundll32.exe
PID 4768 wrote to memory of 944	4768	rundll32.exe	e575534.exe
PID 4768 wrote to memory of 944	4768	rundll32.exe	e575534.exe
PID 4768 wrote to memory of 944	4768	rundll32.exe	e575534.exe
PID 4768 wrote to memory of 3856	4768	rundll32.exe	e576f73.exe
PID 4768 wrote to memory of 3856	4768	rundll32.exe	e576f73.exe
PID 4768 wrote to memory of 3856	4768	rundll32.exe	e576f73.exe
PID 4768 wrote to memory of 3436	4768	rundll32.exe	e576f83.exe
PID 4768 wrote to memory of 3436	4768	rundll32.exe	e576f83.exe
PID 4768 wrote to memory of 3436	4768	rundll32.exe	e576f83.exe
PID 3696 wrote to memory of 796	3696	e57537f.exe	fontdrvhost.exe
PID 3696 wrote to memory of 804	3696	e57537f.exe	fontdrvhost.exe
PID 3696 wrote to memory of 380	3696	e57537f.exe	dwm.exe
PID 3696 wrote to memory of 3128	3696	e57537f.exe	sihost.exe
PID 3696 wrote to memory of 3144	3696	e57537f.exe	svchost.exe
PID 3696 wrote to memory of 3212	3696	e57537f.exe	taskhostw.exe
PID 3696 wrote to memory of 3484	3696	e57537f.exe	Explorer.EXE
PID 3696 wrote to memory of 3608	3696	e57537f.exe	svchost.exe
PID 3696 wrote to memory of 3808	3696	e57537f.exe	DllHost.exe
PID 3696 wrote to memory of 3896	3696	e57537f.exe	StartMenuExperienceHost.exe
PID 3696 wrote to memory of 3964	3696	e57537f.exe	RuntimeBroker.exe
PID 3696 wrote to memory of 4080	3696	e57537f.exe	SearchApp.exe
PID 3696 wrote to memory of 4140	3696	e57537f.exe	RuntimeBroker.exe
PID 3696 wrote to memory of 4252	3696	e57537f.exe	RuntimeBroker.exe
PID 3696 wrote to memory of 1796	3696	e57537f.exe	TextInputHost.exe
PID 3696 wrote to memory of 1672	3696	e57537f.exe	backgroundTaskHost.exe
PID 3696 wrote to memory of 944	3696	e57537f.exe	e575534.exe
PID 3696 wrote to memory of 944	3696	e57537f.exe	e575534.exe
PID 3696 wrote to memory of 3312	3696	e57537f.exe	RuntimeBroker.exe
PID 3696 wrote to memory of 2192	3696	e57537f.exe	RuntimeBroker.exe
PID 3696 wrote to memory of 4364	3696	e57537f.exe	DllHost.exe
PID 3696 wrote to memory of 3856	3696	e57537f.exe	e576f73.exe
PID 3696 wrote to memory of 3856	3696	e57537f.exe	e576f73.exe
PID 3696 wrote to memory of 3436	3696	e57537f.exe	e576f83.exe
PID 3696 wrote to memory of 3436	3696	e57537f.exe	e576f83.exe
PID 3436 wrote to memory of 796	3436	e576f83.exe	fontdrvhost.exe
PID 3436 wrote to memory of 804	3436	e576f83.exe	fontdrvhost.exe
PID 3436 wrote to memory of 380	3436	e576f83.exe	dwm.exe
PID 3436 wrote to memory of 3128	3436	e576f83.exe	sihost.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

Processes:

e57537f.exee576f83.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e57537f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e576f83.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:796

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:804

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:380

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3144

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:3212

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3484

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\99d3b9d3f97f1e0af1dd1d1e4ae5bdb0_NeikiAnalytics.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:4836

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\99d3b9d3f97f1e0af1dd1d1e4ae5bdb0_NeikiAnalytics.dll,#1
3⤵
- Suspicious use of WriteProcessMemory
PID:4768

C:\Users\Admin\AppData\Local\Temp\e57537f.exe
C:\Users\Admin\AppData\Local\Temp\e57537f.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3696

C:\Users\Admin\AppData\Local\Temp\e575534.exe
C:\Users\Admin\AppData\Local\Temp\e575534.exe
4⤵
- Executes dropped EXE
PID:944

C:\Users\Admin\AppData\Local\Temp\e576f73.exe
C:\Users\Admin\AppData\Local\Temp\e576f73.exe
4⤵
- Executes dropped EXE
PID:3856

C:\Users\Admin\AppData\Local\Temp\e576f83.exe
C:\Users\Admin\AppData\Local\Temp\e576f83.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3608

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3808

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3896

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3964

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4080

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4140

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4252

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:1796

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:1672

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:3172

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3312

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2192

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:4364

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Modify Registry

5

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

3

T1562

Disable or Modify Tools

3

Credential Access

Discovery

System Information Discovery

2

T1082

Query Registry

T1012

Peripheral Device Discovery