9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe

Detects executables packed with or use KoiVM 1 IoCs

resource	yara_rule
behavioral1/memory/2552-3-0x0000000000CE0000-0x0000000000D7A000-memory.dmp	INDICATOR_EXE_Packed_KoiVM

Adds policy Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\Registry\User\S-1-5-21-268080393-3149932598-1824759070-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	grpconv.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2224	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\MHF4TB = "C:\\Program Files (x86)\\Windows Mail\\wab.exe"	grpconv.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe

Suspicious use of SetThreadContext 7 IoCs

description	pid	Process	procid_target
PID 2552 set thread context of 2652	2552	9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe	30
PID 2652 set thread context of 2552	2652	wab.exe	27
PID 2652 set thread context of 2552	2652	wab.exe	27
PID 2652 set thread context of 2552	2652	wab.exe	27
PID 2652 set thread context of 1184	2652	wab.exe	21
PID 2652 set thread context of 2984	2652	wab.exe	34
PID 2984 set thread context of 2552	2984	grpconv.exe	27

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2224	powershell.exe
2652	wab.exe
2652	wab.exe
2652	wab.exe
2652	wab.exe
2652	wab.exe
2652	wab.exe
2652	wab.exe
2652	wab.exe
2652	wab.exe
2652	wab.exe
2652	wab.exe
2984	grpconv.exe
2984	grpconv.exe
2984	grpconv.exe
2984	grpconv.exe

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
2652	wab.exe
2652	wab.exe
2652	wab.exe
2652	wab.exe
1184	Explorer.EXE
1184	Explorer.EXE
2984	grpconv.exe
2984	grpconv.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2224	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 2224	2552	9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe	28
PID 2552 wrote to memory of 2224	2552	9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe	28
PID 2552 wrote to memory of 2224	2552	9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe	28
PID 2552 wrote to memory of 2652	2552	9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe	30
PID 2552 wrote to memory of 2652	2552	9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe	30
PID 2552 wrote to memory of 2652	2552	9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe	30
PID 2552 wrote to memory of 2652	2552	9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe	30
PID 2552 wrote to memory of 2652	2552	9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe	30
PID 2552 wrote to memory of 2652	2552	9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe	30
PID 2552 wrote to memory of 2652	2552	9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe	30
PID 2552 wrote to memory of 2668	2552	9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe	31
PID 2552 wrote to memory of 2668	2552	9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe	31
PID 2552 wrote to memory of 2668	2552	9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe	31
PID 1184 wrote to memory of 2984	1184	Explorer.EXE	34
PID 1184 wrote to memory of 2984	1184	Explorer.EXE	34
PID 1184 wrote to memory of 2984	1184	Explorer.EXE	34
PID 1184 wrote to memory of 2984	1184	Explorer.EXE	34

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Users\Admin\AppData\Local\Temp\9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe
  "C:\Users\Admin\AppData\Local\Temp\9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe"
  2⤵
  - UAC bypass
  - Checks whether UAC is enabled
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2552
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\9c581c4cec9f25a55ee985d08ad3ba40a268aff6ea05aebff399c31f86b98065.exe" -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2224
- - C:\Program Files (x86)\Windows Mail\wab.exe
    "C:\Program Files (x86)\Windows Mail\wab.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:2652
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 2552 -s 768
    3⤵
    PID:2668
- C:\Windows\SysWOW64\grpconv.exe
  "C:\Windows\SysWOW64\grpconv.exe"
  2⤵
  - Adds policy Run key to start application
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery