gh0strat | 45b30496e345f89057fa65703d821f5307ebcf135bb5d92be4ca6de263165347

Modify Registry

T1112

Processes:

R.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Remote Data\Parameters\ServiceDll = "C:\\Windows\\system32\\240638750.txt"	R.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

Processes:

TXPlatfor.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatfor.exe

Executes dropped EXE 6 IoCs

Processes:

R.exeN.exeTXPlatfor.exeHD_45b30496e345f89057fa65703d821f5307ebcf135bb5d92be4ca6de263165347.exeTXPlatfor.exeRemote Data.exe

pid	process
4764	R.exe
3552	N.exe
4456	TXPlatfor.exe
4428	HD_45b30496e345f89057fa65703d821f5307ebcf135bb5d92be4ca6de263165347.exe
2984	TXPlatfor.exe
2160	Remote Data.exe

Loads dropped DLL 3 IoCs

Processes:

R.exesvchost.exeRemote Data.exe

pid process

4764 R.exe
3720 svchost.exe
2160 Remote Data.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3552-19-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3552-23-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3552-20-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3552-17-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4456-28-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4456-26-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4456-29-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2984-39-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2984-38-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2984-36-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2984-42-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2984-46-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2984-47-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

HD_45b30496e345f89057fa65703d821f5307ebcf135bb5d92be4ca6de263165347.exe

description ioc process

File opened for modification \??\PhysicalDrive0 HD_45b30496e345f89057fa65703d821f5307ebcf135bb5d92be4ca6de263165347.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	HD_45b30496e345f89057fa65703d821f5307ebcf135bb5d92be4ca6de263165347.exe

Drops file in System32 directory 6 IoCs

Processes:

N.exeR.exesvchost.exe

description	ioc	process
File created	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe
File created	C:\Windows\SysWOW64\240638750.txt	R.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	R.exe
File created	C:\Windows\SysWOW64\Remote Data.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\Remote Data.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2400 PING.EXE

pid	process
2400	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

45b30496e345f89057fa65703d821f5307ebcf135bb5d92be4ca6de263165347.exe

pid	process
2000	45b30496e345f89057fa65703d821f5307ebcf135bb5d92be4ca6de263165347.exe
2000	45b30496e345f89057fa65703d821f5307ebcf135bb5d92be4ca6de263165347.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

TXPlatfor.exe

pid process

2984 TXPlatfor.exe

pid	process
2984	TXPlatfor.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

N.exeTXPlatfor.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	3552	N.exe
Token: SeLoadDriverPrivilege	2984	TXPlatfor.exe
Token: 33	2984	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	2984	TXPlatfor.exe
Token: 33	2984	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	2984	TXPlatfor.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

45b30496e345f89057fa65703d821f5307ebcf135bb5d92be4ca6de263165347.exe

pid	process
2000	45b30496e345f89057fa65703d821f5307ebcf135bb5d92be4ca6de263165347.exe
2000	45b30496e345f89057fa65703d821f5307ebcf135bb5d92be4ca6de263165347.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

45b30496e345f89057fa65703d821f5307ebcf135bb5d92be4ca6de263165347.exeN.exeTXPlatfor.execmd.exesvchost.exe

description	pid	process	target process
PID 2000 wrote to memory of 4764	2000	45b30496e345f89057fa65703d821f5307ebcf135bb5d92be4ca6de263165347.exe	R.exe
PID 2000 wrote to memory of 4764	2000	45b30496e345f89057fa65703d821f5307ebcf135bb5d92be4ca6de263165347.exe	R.exe
PID 2000 wrote to memory of 4764	2000	45b30496e345f89057fa65703d821f5307ebcf135bb5d92be4ca6de263165347.exe	R.exe
PID 2000 wrote to memory of 3552	2000	45b30496e345f89057fa65703d821f5307ebcf135bb5d92be4ca6de263165347.exe	N.exe
PID 2000 wrote to memory of 3552	2000	45b30496e345f89057fa65703d821f5307ebcf135bb5d92be4ca6de263165347.exe	N.exe
PID 2000 wrote to memory of 3552	2000	45b30496e345f89057fa65703d821f5307ebcf135bb5d92be4ca6de263165347.exe	N.exe
PID 3552 wrote to memory of 3800	3552	N.exe	cmd.exe
PID 3552 wrote to memory of 3800	3552	N.exe	cmd.exe
PID 3552 wrote to memory of 3800	3552	N.exe	cmd.exe
PID 2000 wrote to memory of 4428	2000	45b30496e345f89057fa65703d821f5307ebcf135bb5d92be4ca6de263165347.exe	HD_45b30496e345f89057fa65703d821f5307ebcf135bb5d92be4ca6de263165347.exe
PID 2000 wrote to memory of 4428	2000	45b30496e345f89057fa65703d821f5307ebcf135bb5d92be4ca6de263165347.exe	HD_45b30496e345f89057fa65703d821f5307ebcf135bb5d92be4ca6de263165347.exe
PID 2000 wrote to memory of 4428	2000	45b30496e345f89057fa65703d821f5307ebcf135bb5d92be4ca6de263165347.exe	HD_45b30496e345f89057fa65703d821f5307ebcf135bb5d92be4ca6de263165347.exe
PID 4456 wrote to memory of 2984	4456	TXPlatfor.exe	TXPlatfor.exe
PID 4456 wrote to memory of 2984	4456	TXPlatfor.exe	TXPlatfor.exe
PID 4456 wrote to memory of 2984	4456	TXPlatfor.exe	TXPlatfor.exe
PID 3800 wrote to memory of 2400	3800	cmd.exe	PING.EXE
PID 3800 wrote to memory of 2400	3800	cmd.exe	PING.EXE
PID 3800 wrote to memory of 2400	3800	cmd.exe	PING.EXE
PID 3720 wrote to memory of 2160	3720	svchost.exe	Remote Data.exe
PID 3720 wrote to memory of 2160	3720	svchost.exe	Remote Data.exe
PID 3720 wrote to memory of 2160	3720	svchost.exe	Remote Data.exe

C:\Users\Admin\AppData\Local\Temp\45b30496e345f89057fa65703d821f5307ebcf135bb5d92be4ca6de263165347.exe
"C:\Users\Admin\AppData\Local\Temp\45b30496e345f89057fa65703d821f5307ebcf135bb5d92be4ca6de263165347.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Users\Admin\AppData\Local\Temp\R.exe
  C:\Users\Admin\AppData\Local\Temp\\R.exe
  2⤵
  - Sets DLL path for service in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  PID:4764
- C:\Users\Admin\AppData\Local\Temp\N.exe
  C:\Users\Admin\AppData\Local\Temp\\N.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3552
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3800
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      Runs ping.exe
      PID:2400
- C:\Users\Admin\AppData\Local\Temp\HD_45b30496e345f89057fa65703d821f5307ebcf135bb5d92be4ca6de263165347.exe
  C:\Users\Admin\AppData\Local\Temp\HD_45b30496e345f89057fa65703d821f5307ebcf135bb5d92be4ca6de263165347.exe
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  PID:4428

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Remote Data"
1⤵
PID:3608

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Remote Data"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Windows\SysWOW64\Remote Data.exe
  "C:\Windows\system32\Remote Data.exe" "c:\windows\system32\240638750.txt",MainThread
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2160

C:\Windows\SysWOW64\TXPlatfor.exe
C:\Windows\SysWOW64\TXPlatfor.exe -auto
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Windows\SysWOW64\TXPlatfor.exe
  C:\Windows\SysWOW64\TXPlatfor.exe -acsi
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:2984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4372,i,3724086843943218842,1026644135694712596,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:8
1⤵
PID:3800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery