b344418eea8a870f9a03d5ae14e080736eaeea6625e252b97c1c633fc144de73

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	68a2c42f5e5c03827b424e1429170d79ea0529987ec07f4a2b76ef109bb7a888.exe

Windows security bypass 2 TTPs 2 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	68a2c42f5e5c03827b424e1429170d79ea0529987ec07f4a2b76ef109bb7a888.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\68a2c42f5e5c03827b424e1429170d79ea0529987ec07f4a2b76ef109bb7a888.exe = "0"	68a2c42f5e5c03827b424e1429170d79ea0529987ec07f4a2b76ef109bb7a888.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3892	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	68a2c42f5e5c03827b424e1429170d79ea0529987ec07f4a2b76ef109bb7a888.exe

Windows security modification 2 TTPs 3 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	68a2c42f5e5c03827b424e1429170d79ea0529987ec07f4a2b76ef109bb7a888.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions	68a2c42f5e5c03827b424e1429170d79ea0529987ec07f4a2b76ef109bb7a888.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\68a2c42f5e5c03827b424e1429170d79ea0529987ec07f4a2b76ef109bb7a888.exe = "0"	68a2c42f5e5c03827b424e1429170d79ea0529987ec07f4a2b76ef109bb7a888.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	68a2c42f5e5c03827b424e1429170d79ea0529987ec07f4a2b76ef109bb7a888.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	68a2c42f5e5c03827b424e1429170d79ea0529987ec07f4a2b76ef109bb7a888.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 996 set thread context of 2360	996	68a2c42f5e5c03827b424e1429170d79ea0529987ec07f4a2b76ef109bb7a888.exe	90
PID 2360 set thread context of 3432	2360	ngen.exe	56
PID 2360 set thread context of 3504	2360	ngen.exe	97
PID 3504 set thread context of 3432	3504	fontview.exe	56

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3892	powershell.exe
3892	powershell.exe
2360	ngen.exe
2360	ngen.exe
2360	ngen.exe
2360	ngen.exe
2360	ngen.exe
2360	ngen.exe
2360	ngen.exe
2360	ngen.exe
2360	ngen.exe
2360	ngen.exe
2360	ngen.exe
2360	ngen.exe
2360	ngen.exe
2360	ngen.exe
2360	ngen.exe
2360	ngen.exe
3504	fontview.exe
3504	fontview.exe
3504	fontview.exe
3504	fontview.exe
3504	fontview.exe
3504	fontview.exe
3504	fontview.exe
3504	fontview.exe
3504	fontview.exe
3504	fontview.exe
3504	fontview.exe
3504	fontview.exe
3504	fontview.exe
3504	fontview.exe
3504	fontview.exe
3504	fontview.exe
3504	fontview.exe
3504	fontview.exe
3504	fontview.exe
3504	fontview.exe
3504	fontview.exe
3504	fontview.exe
3504	fontview.exe
3504	fontview.exe
3504	fontview.exe
3504	fontview.exe
3504	fontview.exe
3504	fontview.exe
3504	fontview.exe
3504	fontview.exe
3504	fontview.exe
3504	fontview.exe
3504	fontview.exe
3504	fontview.exe
3504	fontview.exe
3504	fontview.exe
3504	fontview.exe
3504	fontview.exe
3504	fontview.exe
3504	fontview.exe
3504	fontview.exe
3504	fontview.exe
3504	fontview.exe
3504	fontview.exe
3504	fontview.exe
3504	fontview.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2360	ngen.exe
3432	Explorer.EXE
3432	Explorer.EXE
3504	fontview.exe
3504	fontview.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	996	68a2c42f5e5c03827b424e1429170d79ea0529987ec07f4a2b76ef109bb7a888.exe
Token: SeDebugPrivilege	3892	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3432	Explorer.EXE

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 3892	996	68a2c42f5e5c03827b424e1429170d79ea0529987ec07f4a2b76ef109bb7a888.exe	84
PID 996 wrote to memory of 3892	996	68a2c42f5e5c03827b424e1429170d79ea0529987ec07f4a2b76ef109bb7a888.exe	84
PID 996 wrote to memory of 2868	996	68a2c42f5e5c03827b424e1429170d79ea0529987ec07f4a2b76ef109bb7a888.exe	86
PID 996 wrote to memory of 2868	996	68a2c42f5e5c03827b424e1429170d79ea0529987ec07f4a2b76ef109bb7a888.exe	86
PID 996 wrote to memory of 2868	996	68a2c42f5e5c03827b424e1429170d79ea0529987ec07f4a2b76ef109bb7a888.exe	86
PID 996 wrote to memory of 2868	996	68a2c42f5e5c03827b424e1429170d79ea0529987ec07f4a2b76ef109bb7a888.exe	86
PID 996 wrote to memory of 3392	996	68a2c42f5e5c03827b424e1429170d79ea0529987ec07f4a2b76ef109bb7a888.exe	87
PID 996 wrote to memory of 3392	996	68a2c42f5e5c03827b424e1429170d79ea0529987ec07f4a2b76ef109bb7a888.exe	87
PID 996 wrote to memory of 3392	996	68a2c42f5e5c03827b424e1429170d79ea0529987ec07f4a2b76ef109bb7a888.exe	87
PID 996 wrote to memory of 4308	996	68a2c42f5e5c03827b424e1429170d79ea0529987ec07f4a2b76ef109bb7a888.exe	88
PID 996 wrote to memory of 4308	996	68a2c42f5e5c03827b424e1429170d79ea0529987ec07f4a2b76ef109bb7a888.exe	88
PID 996 wrote to memory of 4308	996	68a2c42f5e5c03827b424e1429170d79ea0529987ec07f4a2b76ef109bb7a888.exe	88
PID 996 wrote to memory of 4684	996	68a2c42f5e5c03827b424e1429170d79ea0529987ec07f4a2b76ef109bb7a888.exe	89
PID 996 wrote to memory of 4684	996	68a2c42f5e5c03827b424e1429170d79ea0529987ec07f4a2b76ef109bb7a888.exe	89
PID 996 wrote to memory of 4684	996	68a2c42f5e5c03827b424e1429170d79ea0529987ec07f4a2b76ef109bb7a888.exe	89
PID 996 wrote to memory of 4684	996	68a2c42f5e5c03827b424e1429170d79ea0529987ec07f4a2b76ef109bb7a888.exe	89
PID 996 wrote to memory of 2360	996	68a2c42f5e5c03827b424e1429170d79ea0529987ec07f4a2b76ef109bb7a888.exe	90
PID 996 wrote to memory of 2360	996	68a2c42f5e5c03827b424e1429170d79ea0529987ec07f4a2b76ef109bb7a888.exe	90
PID 996 wrote to memory of 2360	996	68a2c42f5e5c03827b424e1429170d79ea0529987ec07f4a2b76ef109bb7a888.exe	90
PID 996 wrote to memory of 2360	996	68a2c42f5e5c03827b424e1429170d79ea0529987ec07f4a2b76ef109bb7a888.exe	90
PID 996 wrote to memory of 2360	996	68a2c42f5e5c03827b424e1429170d79ea0529987ec07f4a2b76ef109bb7a888.exe	90
PID 996 wrote to memory of 2360	996	68a2c42f5e5c03827b424e1429170d79ea0529987ec07f4a2b76ef109bb7a888.exe	90
PID 996 wrote to memory of 4568	996	68a2c42f5e5c03827b424e1429170d79ea0529987ec07f4a2b76ef109bb7a888.exe	91
PID 996 wrote to memory of 4568	996	68a2c42f5e5c03827b424e1429170d79ea0529987ec07f4a2b76ef109bb7a888.exe	91
PID 996 wrote to memory of 4568	996	68a2c42f5e5c03827b424e1429170d79ea0529987ec07f4a2b76ef109bb7a888.exe	91
PID 3432 wrote to memory of 3504	3432	Explorer.EXE	97
PID 3432 wrote to memory of 3504	3432	Explorer.EXE	97
PID 3432 wrote to memory of 3504	3432	Explorer.EXE	97

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	68a2c42f5e5c03827b424e1429170d79ea0529987ec07f4a2b76ef109bb7a888.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3432
- C:\Users\Admin\AppData\Local\Temp\68a2c42f5e5c03827b424e1429170d79ea0529987ec07f4a2b76ef109bb7a888.exe
  "C:\Users\Admin\AppData\Local\Temp\68a2c42f5e5c03827b424e1429170d79ea0529987ec07f4a2b76ef109bb7a888.exe"
  2⤵
  - UAC bypass
  - Windows security bypass
  - Checks computer location settings
  - Windows security modification
  - Checks whether UAC is enabled
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:996
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\68a2c42f5e5c03827b424e1429170d79ea0529987ec07f4a2b76ef109bb7a888.exe" -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3892
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:2868
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
    3⤵
    PID:3392
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
    3⤵
    PID:4308
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:4684
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:2360
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
    3⤵
    PID:4568
- C:\Windows\SysWOW64\fontview.exe
  "C:\Windows\SysWOW64\fontview.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:3504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry