sality | bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81

Windows Service

T1543.003

Processes:

WdExt.exebf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	WdExt.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	WdExt.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	WdExt.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 2 IoCs

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

Processes:

bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exeWdExt.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WdExt.exe

Windows security bypass 2 TTPs 12 IoCs

Disable or Modify Tools

Modify Registry

Processes:

WdExt.exebf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	WdExt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	WdExt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	WdExt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	WdExt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	WdExt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	WdExt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe

Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 25 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2580-77-0x0000000001E20000-0x0000000002EDA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2580-76-0x0000000001E20000-0x0000000002EDA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2580-80-0x0000000001E20000-0x0000000002EDA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2580-82-0x0000000001E20000-0x0000000002EDA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2580-1-0x0000000001E20000-0x0000000002EDA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2580-81-0x0000000001E20000-0x0000000002EDA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2580-85-0x0000000001E20000-0x0000000002EDA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2580-84-0x0000000001E20000-0x0000000002EDA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2580-83-0x0000000001E20000-0x0000000002EDA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2580-79-0x0000000001E20000-0x0000000002EDA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2580-78-0x0000000001E20000-0x0000000002EDA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2580-662-0x0000000001E20000-0x0000000002EDA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2580-671-0x0000000001E20000-0x0000000002EDA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2580-721-0x0000000001E20000-0x0000000002EDA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1416-731-0x0000000001FE0000-0x000000000309A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1416-780-0x0000000001FE0000-0x000000000309A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1416-811-0x0000000001FE0000-0x000000000309A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1416-822-0x0000000001FE0000-0x000000000309A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1416-814-0x0000000001FE0000-0x000000000309A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1416-813-0x0000000001FE0000-0x000000000309A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1416-812-0x0000000001FE0000-0x000000000309A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1416-810-0x0000000001FE0000-0x000000000309A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1416-748-0x0000000001FE0000-0x000000000309A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1416-767-0x0000000001FE0000-0x000000000309A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1416-1908-0x0000000001FE0000-0x000000000309A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine

UPX dump on OEP (original entry point) 28 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2580-77-0x0000000001E20000-0x0000000002EDA000-memory.dmp	UPX
behavioral1/memory/2580-76-0x0000000001E20000-0x0000000002EDA000-memory.dmp	UPX
behavioral1/memory/2580-80-0x0000000001E20000-0x0000000002EDA000-memory.dmp	UPX
behavioral1/memory/2580-82-0x0000000001E20000-0x0000000002EDA000-memory.dmp	UPX
behavioral1/memory/2580-1-0x0000000001E20000-0x0000000002EDA000-memory.dmp	UPX
behavioral1/memory/2580-81-0x0000000001E20000-0x0000000002EDA000-memory.dmp	UPX
behavioral1/memory/2580-85-0x0000000001E20000-0x0000000002EDA000-memory.dmp	UPX
behavioral1/memory/2580-84-0x0000000001E20000-0x0000000002EDA000-memory.dmp	UPX
behavioral1/memory/2580-83-0x0000000001E20000-0x0000000002EDA000-memory.dmp	UPX
behavioral1/memory/2580-79-0x0000000001E20000-0x0000000002EDA000-memory.dmp	UPX
behavioral1/memory/2580-78-0x0000000001E20000-0x0000000002EDA000-memory.dmp	UPX
behavioral1/memory/2580-662-0x0000000001E20000-0x0000000002EDA000-memory.dmp	UPX
behavioral1/memory/2580-671-0x0000000001E20000-0x0000000002EDA000-memory.dmp	UPX
behavioral1/memory/2580-721-0x0000000001E20000-0x0000000002EDA000-memory.dmp	UPX
behavioral1/memory/2580-720-0x0000000000400000-0x000000000044B000-memory.dmp	UPX
behavioral1/memory/1416-730-0x0000000000400000-0x000000000044B000-memory.dmp	UPX
behavioral1/memory/1416-731-0x0000000001FE0000-0x000000000309A000-memory.dmp	UPX
behavioral1/memory/1416-780-0x0000000001FE0000-0x000000000309A000-memory.dmp	UPX
behavioral1/memory/1416-811-0x0000000001FE0000-0x000000000309A000-memory.dmp	UPX
behavioral1/memory/1416-822-0x0000000001FE0000-0x000000000309A000-memory.dmp	UPX
behavioral1/memory/1416-814-0x0000000001FE0000-0x000000000309A000-memory.dmp	UPX
behavioral1/memory/1416-813-0x0000000001FE0000-0x000000000309A000-memory.dmp	UPX
behavioral1/memory/1416-812-0x0000000001FE0000-0x000000000309A000-memory.dmp	UPX
behavioral1/memory/1416-810-0x0000000001FE0000-0x000000000309A000-memory.dmp	UPX
behavioral1/memory/1416-748-0x0000000001FE0000-0x000000000309A000-memory.dmp	UPX
behavioral1/memory/1416-767-0x0000000001FE0000-0x000000000309A000-memory.dmp	UPX
behavioral1/memory/1416-1906-0x0000000000400000-0x000000000044B000-memory.dmp	UPX
behavioral1/memory/1416-1908-0x0000000001FE0000-0x000000000309A000-memory.dmp	UPX

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

3004 cmd.exe
Executes dropped EXE 4 IoCs

Processes:

WdExt.exelaunch.exewtmps.exemscaps.exe

pid process

1416 WdExt.exe
2156 launch.exe
2124 wtmps.exe
1520 mscaps.exe

pid	process
3004	cmd.exe

pid	process
1416	WdExt.exe
2156	launch.exe
2124	wtmps.exe
1520	mscaps.exe

Loads dropped DLL 8 IoCs

Processes:

bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.execmd.exeWdExt.execmd.execmd.exe

pid	process
2580	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe
1852	cmd.exe
1852	cmd.exe
1416	WdExt.exe
2584	cmd.exe
2584	cmd.exe
1608	cmd.exe
1608	cmd.exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2580-77-0x0000000001E20000-0x0000000002EDA000-memory.dmp	upx
behavioral1/memory/2580-76-0x0000000001E20000-0x0000000002EDA000-memory.dmp	upx
behavioral1/memory/2580-80-0x0000000001E20000-0x0000000002EDA000-memory.dmp	upx
behavioral1/memory/2580-82-0x0000000001E20000-0x0000000002EDA000-memory.dmp	upx
behavioral1/memory/2580-1-0x0000000001E20000-0x0000000002EDA000-memory.dmp	upx
behavioral1/memory/2580-81-0x0000000001E20000-0x0000000002EDA000-memory.dmp	upx
behavioral1/memory/2580-85-0x0000000001E20000-0x0000000002EDA000-memory.dmp	upx
behavioral1/memory/2580-84-0x0000000001E20000-0x0000000002EDA000-memory.dmp	upx
behavioral1/memory/2580-83-0x0000000001E20000-0x0000000002EDA000-memory.dmp	upx
behavioral1/memory/2580-79-0x0000000001E20000-0x0000000002EDA000-memory.dmp	upx
behavioral1/memory/2580-78-0x0000000001E20000-0x0000000002EDA000-memory.dmp	upx
behavioral1/memory/2580-662-0x0000000001E20000-0x0000000002EDA000-memory.dmp	upx
behavioral1/memory/2580-671-0x0000000001E20000-0x0000000002EDA000-memory.dmp	upx
behavioral1/memory/2580-721-0x0000000001E20000-0x0000000002EDA000-memory.dmp	upx
behavioral1/memory/1416-731-0x0000000001FE0000-0x000000000309A000-memory.dmp	upx
behavioral1/memory/1416-780-0x0000000001FE0000-0x000000000309A000-memory.dmp	upx
behavioral1/memory/1416-811-0x0000000001FE0000-0x000000000309A000-memory.dmp	upx
behavioral1/memory/1416-822-0x0000000001FE0000-0x000000000309A000-memory.dmp	upx
behavioral1/memory/1416-814-0x0000000001FE0000-0x000000000309A000-memory.dmp	upx
behavioral1/memory/1416-813-0x0000000001FE0000-0x000000000309A000-memory.dmp	upx
behavioral1/memory/1416-812-0x0000000001FE0000-0x000000000309A000-memory.dmp	upx
behavioral1/memory/1416-810-0x0000000001FE0000-0x000000000309A000-memory.dmp	upx
behavioral1/memory/1416-748-0x0000000001FE0000-0x000000000309A000-memory.dmp	upx
behavioral1/memory/1416-767-0x0000000001FE0000-0x000000000309A000-memory.dmp	upx
behavioral1/memory/1416-1908-0x0000000001FE0000-0x000000000309A000-memory.dmp	upx

Windows security modification 2 TTPs 14 IoCs

Disable or Modify Tools

Modify Registry

Processes:

bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exeWdExt.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	WdExt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	WdExt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	WdExt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	WdExt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	WdExt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	WdExt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	WdExt.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Processes:

launch.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Defender Extension = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Defender\\launch.exe\""	launch.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

System Information Discovery

T1082

Processes:

bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exeWdExt.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WdExt.exe

Drops file in System32 directory 2 IoCs

Processes:

wtmps.exe

description ioc process

File created C:\Windows\SysWOW64\mscaps.exe wtmps.exe
File opened for modification C:\Windows\SysWOW64\mscaps.exe wtmps.exe

description	ioc	process
File created	C:\Windows\SysWOW64\mscaps.exe	wtmps.exe
File opened for modification	C:\Windows\SysWOW64\mscaps.exe	wtmps.exe

Drops file in Windows directory 3 IoCs

Processes:

bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exeWdExt.exe

description	ioc	process
File created	C:\Windows\f7618de	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe
File opened for modification	C:\Windows\SYSTEM.INI	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe
File created	C:\Windows\f7625f8	WdExt.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exeWdExt.exelaunch.exe

pid	process
2580	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe
2580	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe
1416	WdExt.exe
1416	WdExt.exe
2156	launch.exe
2156	launch.exe
2156	launch.exe
2156	launch.exe
2156	launch.exe
2156	launch.exe
2156	launch.exe
2156	launch.exe
2156	launch.exe
2156	launch.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

Processes:

bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exeWdExt.exe

description	pid	process
Token: SeDebugPrivilege	2580	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe
Token: SeDebugPrivilege	2580	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe
Token: SeDebugPrivilege	2580	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe
Token: SeDebugPrivilege	2580	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe
Token: SeDebugPrivilege	2580	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe
Token: SeDebugPrivilege	2580	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe
Token: SeDebugPrivilege	2580	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe
Token: SeDebugPrivilege	2580	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe
Token: SeDebugPrivilege	2580	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe
Token: SeDebugPrivilege	2580	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe
Token: SeDebugPrivilege	2580	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe
Token: SeDebugPrivilege	2580	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe
Token: SeDebugPrivilege	2580	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe
Token: SeDebugPrivilege	2580	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe
Token: SeDebugPrivilege	2580	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe
Token: SeDebugPrivilege	2580	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe
Token: SeDebugPrivilege	2580	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe
Token: SeDebugPrivilege	2580	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe
Token: SeDebugPrivilege	2580	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe
Token: SeDebugPrivilege	2580	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe
Token: SeDebugPrivilege	1416	WdExt.exe
Token: SeDebugPrivilege	1416	WdExt.exe
Token: SeDebugPrivilege	1416	WdExt.exe
Token: SeDebugPrivilege	1416	WdExt.exe
Token: SeDebugPrivilege	1416	WdExt.exe
Token: SeDebugPrivilege	1416	WdExt.exe
Token: SeDebugPrivilege	1416	WdExt.exe
Token: SeDebugPrivilege	1416	WdExt.exe
Token: SeDebugPrivilege	1416	WdExt.exe
Token: SeDebugPrivilege	1416	WdExt.exe
Token: SeDebugPrivilege	1416	WdExt.exe
Token: SeDebugPrivilege	1416	WdExt.exe
Token: SeDebugPrivilege	1416	WdExt.exe
Token: SeDebugPrivilege	1416	WdExt.exe
Token: SeDebugPrivilege	1416	WdExt.exe
Token: SeDebugPrivilege	1416	WdExt.exe
Token: SeDebugPrivilege	1416	WdExt.exe
Token: SeDebugPrivilege	1416	WdExt.exe
Token: SeDebugPrivilege	1416	WdExt.exe
Token: SeDebugPrivilege	1416	WdExt.exe

Suspicious use of WriteProcessMemory 55 IoCs

Processes:

bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.execmd.exeWdExt.execmd.exelaunch.execmd.exewtmps.exe

description	pid	process	target process
PID 2580 wrote to memory of 1104	2580	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe	taskhost.exe
PID 2580 wrote to memory of 1156	2580	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe	Dwm.exe
PID 2580 wrote to memory of 1188	2580	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe	Explorer.EXE
PID 2580 wrote to memory of 2036	2580	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe	DllHost.exe
PID 2580 wrote to memory of 1852	2580	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe	cmd.exe
PID 2580 wrote to memory of 1852	2580	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe	cmd.exe
PID 2580 wrote to memory of 1852	2580	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe	cmd.exe
PID 2580 wrote to memory of 1852	2580	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe	cmd.exe
PID 2580 wrote to memory of 3004	2580	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe	cmd.exe
PID 2580 wrote to memory of 3004	2580	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe	cmd.exe
PID 2580 wrote to memory of 3004	2580	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe	cmd.exe
PID 2580 wrote to memory of 3004	2580	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe	cmd.exe
PID 1852 wrote to memory of 1416	1852	cmd.exe	WdExt.exe
PID 1852 wrote to memory of 1416	1852	cmd.exe	WdExt.exe
PID 1852 wrote to memory of 1416	1852	cmd.exe	WdExt.exe
PID 1852 wrote to memory of 1416	1852	cmd.exe	WdExt.exe
PID 1416 wrote to memory of 1104	1416	WdExt.exe	taskhost.exe
PID 1416 wrote to memory of 1156	1416	WdExt.exe	Dwm.exe
PID 1416 wrote to memory of 1188	1416	WdExt.exe	Explorer.EXE
PID 1416 wrote to memory of 2036	1416	WdExt.exe	DllHost.exe
PID 1416 wrote to memory of 1852	1416	WdExt.exe	cmd.exe
PID 1416 wrote to memory of 1852	1416	WdExt.exe	cmd.exe
PID 1416 wrote to memory of 652	1416	WdExt.exe	conhost.exe
PID 1416 wrote to memory of 2584	1416	WdExt.exe	cmd.exe
PID 1416 wrote to memory of 2584	1416	WdExt.exe	cmd.exe
PID 1416 wrote to memory of 2584	1416	WdExt.exe	cmd.exe
PID 1416 wrote to memory of 2584	1416	WdExt.exe	cmd.exe
PID 2584 wrote to memory of 2156	2584	cmd.exe	launch.exe
PID 2584 wrote to memory of 2156	2584	cmd.exe	launch.exe
PID 2584 wrote to memory of 2156	2584	cmd.exe	launch.exe
PID 2584 wrote to memory of 2156	2584	cmd.exe	launch.exe
PID 2584 wrote to memory of 2156	2584	cmd.exe	launch.exe
PID 2584 wrote to memory of 2156	2584	cmd.exe	launch.exe
PID 2584 wrote to memory of 2156	2584	cmd.exe	launch.exe
PID 2156 wrote to memory of 1608	2156	launch.exe	cmd.exe
PID 2156 wrote to memory of 1608	2156	launch.exe	cmd.exe
PID 2156 wrote to memory of 1608	2156	launch.exe	cmd.exe
PID 2156 wrote to memory of 1608	2156	launch.exe	cmd.exe
PID 2156 wrote to memory of 1608	2156	launch.exe	cmd.exe
PID 2156 wrote to memory of 1608	2156	launch.exe	cmd.exe
PID 2156 wrote to memory of 1608	2156	launch.exe	cmd.exe
PID 1608 wrote to memory of 2124	1608	cmd.exe	wtmps.exe
PID 1608 wrote to memory of 2124	1608	cmd.exe	wtmps.exe
PID 1608 wrote to memory of 2124	1608	cmd.exe	wtmps.exe
PID 1608 wrote to memory of 2124	1608	cmd.exe	wtmps.exe
PID 1608 wrote to memory of 2124	1608	cmd.exe	wtmps.exe
PID 1608 wrote to memory of 2124	1608	cmd.exe	wtmps.exe
PID 1608 wrote to memory of 2124	1608	cmd.exe	wtmps.exe
PID 2124 wrote to memory of 1520	2124	wtmps.exe	mscaps.exe
PID 2124 wrote to memory of 1520	2124	wtmps.exe	mscaps.exe
PID 2124 wrote to memory of 1520	2124	wtmps.exe	mscaps.exe
PID 2124 wrote to memory of 1520	2124	wtmps.exe	mscaps.exe
PID 2124 wrote to memory of 1520	2124	wtmps.exe	mscaps.exe
PID 2124 wrote to memory of 1520	2124	wtmps.exe	mscaps.exe
PID 2124 wrote to memory of 1520	2124	wtmps.exe	mscaps.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

Processes:

bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exeWdExt.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WdExt.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1104

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1156

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1188

C:\Users\Admin\AppData\Local\Temp\bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe
"C:\Users\Admin\AppData\Local\Temp\bf70cd422fb3771839abe10d861f022f311c28ad9f52aa9d1219462164531a81.exe"
2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2580

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat" "
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1852

C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe"
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1416

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "
5⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2584

C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe" /i 1416
6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2156

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat" "
7⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1608

C:\Users\Admin\AppData\Local\Temp\wtmps.exe
"C:\Users\Admin\AppData\Local\Temp\wtmps.exe"
8⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2124

C:\Windows\SysWOW64\mscaps.exe
"C:\Windows\system32\mscaps.exe" /C:\Users\Admin\AppData\Local\Temp\wtmps.exe
9⤵
- Executes dropped EXE
PID:1520

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "
3⤵
- Deletes itself
PID:3004

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2036

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-153936832621193301-1719058546-1229732239106210292-1892165686-1230743719-1805460691"
1⤵
PID:652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry