gh0strat | a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599

Modify Registry

Processes:

R.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Remote Data\Parameters\ServiceDll = "C:\\Windows\\system32\\240653953.txt"	R.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

TXPlatfor.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatfor.exe

Executes dropped EXE 6 IoCs

Processes:

R.exeN.exeTXPlatfor.exeTXPlatfor.exeHD_a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exeRemote Data.exe

pid	process
4152	R.exe
4848	N.exe
4696	TXPlatfor.exe
5048	TXPlatfor.exe
5616	HD_a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe
1796	Remote Data.exe

Loads dropped DLL 3 IoCs

Processes:

R.exesvchost.exeRemote Data.exe

pid process

4152 R.exe
4540 svchost.exe
1796 Remote Data.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4848-17-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4848-20-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4848-19-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4696-25-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4696-28-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4696-27-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/5048-36-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/5048-39-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/5048-41-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

HD_a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kwallpaper = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\kwallpaper.exe\" -autorun"	HD_a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

Processes:

R.exesvchost.exeN.exe

description	ioc	process
File created	C:\Windows\SysWOW64\240653953.txt	R.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	R.exe
File created	C:\Windows\SysWOW64\Remote Data.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\Remote Data.exe	svchost.exe
File created	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe

Drops file in Program Files directory 1 IoCs

Processes:

a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

5628 PING.EXE

pid	process
5628	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe

pid	process
4620	a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe
4620	a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

TXPlatfor.exe

pid process

5048 TXPlatfor.exe

pid	process
5048	TXPlatfor.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

N.exeTXPlatfor.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	4848	N.exe
Token: SeLoadDriverPrivilege	5048	TXPlatfor.exe
Token: 33	5048	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	5048	TXPlatfor.exe
Token: 33	5048	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	5048	TXPlatfor.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe

pid	process
4620	a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe
4620	a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exeTXPlatfor.exeN.execmd.exesvchost.exe

description	pid	process	target process
PID 4620 wrote to memory of 4152	4620	a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe	R.exe
PID 4620 wrote to memory of 4152	4620	a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe	R.exe
PID 4620 wrote to memory of 4152	4620	a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe	R.exe
PID 4620 wrote to memory of 4848	4620	a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe	N.exe
PID 4620 wrote to memory of 4848	4620	a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe	N.exe
PID 4620 wrote to memory of 4848	4620	a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe	N.exe
PID 4696 wrote to memory of 5048	4696	TXPlatfor.exe	TXPlatfor.exe
PID 4696 wrote to memory of 5048	4696	TXPlatfor.exe	TXPlatfor.exe
PID 4696 wrote to memory of 5048	4696	TXPlatfor.exe	TXPlatfor.exe
PID 4848 wrote to memory of 2568	4848	N.exe	cmd.exe
PID 4848 wrote to memory of 2568	4848	N.exe	cmd.exe
PID 4848 wrote to memory of 2568	4848	N.exe	cmd.exe
PID 4620 wrote to memory of 5616	4620	a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe	HD_a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe
PID 4620 wrote to memory of 5616	4620	a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe	HD_a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe
PID 2568 wrote to memory of 5628	2568	cmd.exe	PING.EXE
PID 2568 wrote to memory of 5628	2568	cmd.exe	PING.EXE
PID 2568 wrote to memory of 5628	2568	cmd.exe	PING.EXE
PID 4540 wrote to memory of 1796	4540	svchost.exe	Remote Data.exe
PID 4540 wrote to memory of 1796	4540	svchost.exe	Remote Data.exe
PID 4540 wrote to memory of 1796	4540	svchost.exe	Remote Data.exe

C:\Users\Admin\AppData\Local\Temp\a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe
"C:\Users\Admin\AppData\Local\Temp\a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4620

C:\Users\Admin\AppData\Local\Temp\R.exe
C:\Users\Admin\AppData\Local\Temp\\R.exe
2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:4152

C:\Users\Admin\AppData\Local\Temp\N.exe
C:\Users\Admin\AppData\Local\Temp\\N.exe
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4848

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
3⤵
- Suspicious use of WriteProcessMemory
PID:2568

C:\Windows\SysWOW64\PING.EXE
ping -n 2 127.0.0.1
4⤵
- Runs ping.exe
PID:5628

C:\Users\Admin\AppData\Local\Temp\HD_a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe
C:\Users\Admin\AppData\Local\Temp\HD_a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5616

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Remote Data"
1⤵
PID:5300

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Remote Data"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4540

C:\Windows\SysWOW64\Remote Data.exe
"C:\Windows\system32\Remote Data.exe" "c:\windows\system32\240653953.txt",MainThread
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796

C:\Windows\SysWOW64\TXPlatfor.exe
C:\Windows\SysWOW64\TXPlatfor.exe -auto
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696

C:\Windows\SysWOW64\TXPlatfor.exe
C:\Windows\SysWOW64\TXPlatfor.exe -acsi
2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:5048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1328 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:4452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry