sality | 94fa93dd606301e6fcc63082b7c02c11cb157c320c12ed838995399c2e7d12b0

Windows Service

T1543.003

Processes:

e575321.exee577f03.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	e575321.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	e575321.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	e575321.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	e577f03.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	e577f03.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	e577f03.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 2 IoCs

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

Processes:

e575321.exee577f03.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e575321.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e577f03.exe

Windows security bypass 2 TTPs 12 IoCs

Disable or Modify Tools

Modify Registry

Processes:

e577f03.exee575321.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e577f03.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e577f03.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e575321.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e575321.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e575321.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e575321.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e577f03.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e577f03.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e577f03.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e577f03.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e575321.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e575321.exe

Executes dropped EXE 3 IoCs

Processes:

e575321.exee575554.exee577f03.exe

pid process

2028 e575321.exe
4288 e575554.exe
2720 e577f03.exe

pid	process
2028	e575321.exe
4288	e575554.exe
2720	e577f03.exe

UPX packed file 27 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2028-6-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2028-9-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2028-12-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2028-13-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2028-28-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2028-20-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2028-10-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2028-14-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2028-11-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2028-32-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2028-37-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2028-36-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2028-38-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2028-40-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2028-39-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2028-46-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2028-55-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2028-56-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2028-58-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2028-60-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2028-62-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2028-63-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2028-66-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2028-68-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2028-76-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/2720-116-0x00000000007A0000-0x000000000185A000-memory.dmp	upx
behavioral2/memory/2720-148-0x00000000007A0000-0x000000000185A000-memory.dmp	upx

Windows security modification 2 TTPs 14 IoCs

Disable or Modify Tools

Modify Registry

Processes:

e575321.exee577f03.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e575321.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e575321.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e575321.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e577f03.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e577f03.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e575321.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e577f03.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e575321.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e575321.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	e577f03.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	e575321.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e577f03.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e577f03.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e577f03.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

System Information Discovery

T1082

Processes:

e575321.exee577f03.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e575321.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e577f03.exe

Enumerates connected drives 3 TTPs 14 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

e575321.exee577f03.exe

description	ioc	process
File opened (read-only)	\??\L:	e575321.exe
File opened (read-only)	\??\G:	e577f03.exe
File opened (read-only)	\??\J:	e575321.exe
File opened (read-only)	\??\M:	e575321.exe
File opened (read-only)	\??\E:	e575321.exe
File opened (read-only)	\??\G:	e575321.exe
File opened (read-only)	\??\E:	e577f03.exe
File opened (read-only)	\??\I:	e575321.exe
File opened (read-only)	\??\K:	e575321.exe
File opened (read-only)	\??\H:	e577f03.exe
File opened (read-only)	\??\I:	e577f03.exe
File opened (read-only)	\??\J:	e577f03.exe
File opened (read-only)	\??\H:	e575321.exe
File opened (read-only)	\??\N:	e575321.exe

Drops file in Program Files directory 3 IoCs

Processes:

e575321.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\7z.exe	e575321.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	e575321.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	e575321.exe

Drops file in Windows directory 3 IoCs

Processes:

e575321.exee577f03.exe

description	ioc	process
File created	C:\Windows\e57537f	e575321.exe
File opened for modification	C:\Windows\SYSTEM.INI	e575321.exe
File created	C:\Windows\e57a6a0	e577f03.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

e575321.exee577f03.exe

pid process

2028 e575321.exe
2028 e575321.exe
2028 e575321.exe
2028 e575321.exe
2720 e577f03.exe
2720 e577f03.exe

pid	process
2028	e575321.exe
2028	e575321.exe
2028	e575321.exe
2028	e575321.exe
2720	e577f03.exe
2720	e577f03.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

e575321.exe

description	pid	process
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe
Token: SeDebugPrivilege	2028	e575321.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

rundll32.exerundll32.exee575321.exee577f03.exe

description	pid	process	target process
PID 1624 wrote to memory of 1256	1624	rundll32.exe	rundll32.exe
PID 1624 wrote to memory of 1256	1624	rundll32.exe	rundll32.exe
PID 1624 wrote to memory of 1256	1624	rundll32.exe	rundll32.exe
PID 1256 wrote to memory of 2028	1256	rundll32.exe	e575321.exe
PID 1256 wrote to memory of 2028	1256	rundll32.exe	e575321.exe
PID 1256 wrote to memory of 2028	1256	rundll32.exe	e575321.exe
PID 2028 wrote to memory of 784	2028	e575321.exe	fontdrvhost.exe
PID 2028 wrote to memory of 788	2028	e575321.exe	fontdrvhost.exe
PID 2028 wrote to memory of 64	2028	e575321.exe	dwm.exe
PID 2028 wrote to memory of 2660	2028	e575321.exe	sihost.exe
PID 2028 wrote to memory of 2672	2028	e575321.exe	svchost.exe
PID 2028 wrote to memory of 2800	2028	e575321.exe	taskhostw.exe
PID 2028 wrote to memory of 3484	2028	e575321.exe	Explorer.EXE
PID 2028 wrote to memory of 3668	2028	e575321.exe	svchost.exe
PID 2028 wrote to memory of 3848	2028	e575321.exe	DllHost.exe
PID 2028 wrote to memory of 3940	2028	e575321.exe	StartMenuExperienceHost.exe
PID 2028 wrote to memory of 4004	2028	e575321.exe	RuntimeBroker.exe
PID 2028 wrote to memory of 4084	2028	e575321.exe	SearchApp.exe
PID 2028 wrote to memory of 2116	2028	e575321.exe	RuntimeBroker.exe
PID 2028 wrote to memory of 444	2028	e575321.exe	RuntimeBroker.exe
PID 2028 wrote to memory of 3452	2028	e575321.exe	TextInputHost.exe
PID 2028 wrote to memory of 2960	2028	e575321.exe	backgroundTaskHost.exe
PID 2028 wrote to memory of 3920	2028	e575321.exe	backgroundTaskHost.exe
PID 2028 wrote to memory of 1624	2028	e575321.exe	rundll32.exe
PID 2028 wrote to memory of 1256	2028	e575321.exe	rundll32.exe
PID 2028 wrote to memory of 1256	2028	e575321.exe	rundll32.exe
PID 1256 wrote to memory of 4288	1256	rundll32.exe	e575554.exe
PID 1256 wrote to memory of 4288	1256	rundll32.exe	e575554.exe
PID 1256 wrote to memory of 4288	1256	rundll32.exe	e575554.exe
PID 2028 wrote to memory of 784	2028	e575321.exe	fontdrvhost.exe
PID 2028 wrote to memory of 788	2028	e575321.exe	fontdrvhost.exe
PID 2028 wrote to memory of 64	2028	e575321.exe	dwm.exe
PID 2028 wrote to memory of 2660	2028	e575321.exe	sihost.exe
PID 2028 wrote to memory of 2672	2028	e575321.exe	svchost.exe
PID 2028 wrote to memory of 2800	2028	e575321.exe	taskhostw.exe
PID 2028 wrote to memory of 3484	2028	e575321.exe	Explorer.EXE
PID 2028 wrote to memory of 3668	2028	e575321.exe	svchost.exe
PID 2028 wrote to memory of 3848	2028	e575321.exe	DllHost.exe
PID 2028 wrote to memory of 3940	2028	e575321.exe	StartMenuExperienceHost.exe
PID 2028 wrote to memory of 4004	2028	e575321.exe	RuntimeBroker.exe
PID 2028 wrote to memory of 4084	2028	e575321.exe	SearchApp.exe
PID 2028 wrote to memory of 2116	2028	e575321.exe	RuntimeBroker.exe
PID 2028 wrote to memory of 444	2028	e575321.exe	RuntimeBroker.exe
PID 2028 wrote to memory of 3452	2028	e575321.exe	TextInputHost.exe
PID 2028 wrote to memory of 2960	2028	e575321.exe	backgroundTaskHost.exe
PID 2028 wrote to memory of 3920	2028	e575321.exe	backgroundTaskHost.exe
PID 2028 wrote to memory of 1624	2028	e575321.exe	rundll32.exe
PID 2028 wrote to memory of 4288	2028	e575321.exe	e575554.exe
PID 2028 wrote to memory of 4288	2028	e575321.exe	e575554.exe
PID 2028 wrote to memory of 5052	2028	e575321.exe	RuntimeBroker.exe
PID 2028 wrote to memory of 3960	2028	e575321.exe	RuntimeBroker.exe
PID 1256 wrote to memory of 2720	1256	rundll32.exe	e577f03.exe
PID 1256 wrote to memory of 2720	1256	rundll32.exe	e577f03.exe
PID 1256 wrote to memory of 2720	1256	rundll32.exe	e577f03.exe
PID 2720 wrote to memory of 784	2720	e577f03.exe	fontdrvhost.exe
PID 2720 wrote to memory of 788	2720	e577f03.exe	fontdrvhost.exe
PID 2720 wrote to memory of 64	2720	e577f03.exe	dwm.exe
PID 2720 wrote to memory of 2660	2720	e577f03.exe	sihost.exe
PID 2720 wrote to memory of 2672	2720	e577f03.exe	svchost.exe
PID 2720 wrote to memory of 2800	2720	e577f03.exe	taskhostw.exe
PID 2720 wrote to memory of 3484	2720	e577f03.exe	Explorer.EXE
PID 2720 wrote to memory of 3668	2720	e577f03.exe	svchost.exe
PID 2720 wrote to memory of 3848	2720	e577f03.exe	DllHost.exe
PID 2720 wrote to memory of 3940	2720	e577f03.exe	StartMenuExperienceHost.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

Processes:

e575321.exee577f03.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e575321.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e577f03.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:784

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:788

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:64

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2672

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2800

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3484

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\58d16dd6109d1ddc16fd5859e9135cb0_NeikiAnalytics.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1624

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\58d16dd6109d1ddc16fd5859e9135cb0_NeikiAnalytics.dll,#1
3⤵
- Suspicious use of WriteProcessMemory
PID:1256

C:\Users\Admin\AppData\Local\Temp\e575321.exe
C:\Users\Admin\AppData\Local\Temp\e575321.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2028

C:\Users\Admin\AppData\Local\Temp\e575554.exe
C:\Users\Admin\AppData\Local\Temp\e575554.exe
4⤵
- Executes dropped EXE
PID:4288

C:\Users\Admin\AppData\Local\Temp\e577f03.exe
C:\Users\Admin\AppData\Local\Temp\e577f03.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3668

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3848

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3940

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4004

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4084

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2116

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:444

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:3452

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:2960

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:3920

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:5052

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3960

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Modify Registry

5

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

3

T1562

Disable or Modify Tools

3

Credential Access

Discovery

System Information Discovery

2

T1082

Query Registry

T1012

Peripheral Device Discovery