7c2acb3028bf8aaafdd5f24e68320427107d0598c07f61e2ac1a6e81f3357d87

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	z4AMOSTRA.exe

Windows security bypass 2 TTPs 2 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	z4AMOSTRA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\z4AMOSTRA.exe = "0"	z4AMOSTRA.exe

Adds policy Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\Registry\User\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	SecEdit.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
612	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	z4AMOSTRA.exe

Windows security modification 2 TTPs 3 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	z4AMOSTRA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions	z4AMOSTRA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\z4AMOSTRA.exe = "0"	z4AMOSTRA.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KZCDJJ = "C:\\Program Files (x86)\\Windows Mail\\wab.exe"	SecEdit.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	z4AMOSTRA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	z4AMOSTRA.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 212 set thread context of 3260	212	z4AMOSTRA.exe	89
PID 3260 set thread context of 3512	3260	wab.exe	56
PID 3260 set thread context of 844	3260	wab.exe	96
PID 844 set thread context of 3512	844	SecEdit.exe	56
PID 844 set thread context of 2196	844	SecEdit.exe	97

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\Registry\User\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	SecEdit.exe

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
612	powershell.exe
612	powershell.exe
3260	wab.exe
3260	wab.exe
3260	wab.exe
3260	wab.exe
3260	wab.exe
3260	wab.exe
3260	wab.exe
3260	wab.exe
3260	wab.exe
3260	wab.exe
3260	wab.exe
3260	wab.exe
3260	wab.exe
3260	wab.exe
3260	wab.exe
3260	wab.exe
844	SecEdit.exe
844	SecEdit.exe
844	SecEdit.exe
844	SecEdit.exe
844	SecEdit.exe
844	SecEdit.exe
844	SecEdit.exe
844	SecEdit.exe
844	SecEdit.exe
844	SecEdit.exe
844	SecEdit.exe
844	SecEdit.exe
844	SecEdit.exe
844	SecEdit.exe
844	SecEdit.exe
844	SecEdit.exe
844	SecEdit.exe
844	SecEdit.exe
844	SecEdit.exe
844	SecEdit.exe
844	SecEdit.exe
844	SecEdit.exe
844	SecEdit.exe
844	SecEdit.exe
844	SecEdit.exe
844	SecEdit.exe
844	SecEdit.exe
844	SecEdit.exe
844	SecEdit.exe
844	SecEdit.exe
844	SecEdit.exe
844	SecEdit.exe
844	SecEdit.exe
844	SecEdit.exe
844	SecEdit.exe
844	SecEdit.exe
844	SecEdit.exe
844	SecEdit.exe
844	SecEdit.exe
844	SecEdit.exe
844	SecEdit.exe
844	SecEdit.exe
844	SecEdit.exe
844	SecEdit.exe

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
3260	wab.exe
3512	Explorer.EXE
3512	Explorer.EXE
844	SecEdit.exe
844	SecEdit.exe
844	SecEdit.exe
844	SecEdit.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	212	z4AMOSTRA.exe
Token: SeDebugPrivilege	612	powershell.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3512	Explorer.EXE

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 212 wrote to memory of 612	212	z4AMOSTRA.exe	87
PID 212 wrote to memory of 612	212	z4AMOSTRA.exe	87
PID 212 wrote to memory of 3260	212	z4AMOSTRA.exe	89
PID 212 wrote to memory of 3260	212	z4AMOSTRA.exe	89
PID 212 wrote to memory of 3260	212	z4AMOSTRA.exe	89
PID 212 wrote to memory of 3260	212	z4AMOSTRA.exe	89
PID 212 wrote to memory of 3260	212	z4AMOSTRA.exe	89
PID 212 wrote to memory of 3260	212	z4AMOSTRA.exe	89
PID 3512 wrote to memory of 844	3512	Explorer.EXE	96
PID 3512 wrote to memory of 844	3512	Explorer.EXE	96
PID 3512 wrote to memory of 844	3512	Explorer.EXE	96
PID 844 wrote to memory of 2196	844	SecEdit.exe	97
PID 844 wrote to memory of 2196	844	SecEdit.exe	97

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	z4AMOSTRA.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Users\Admin\AppData\Local\Temp\z4AMOSTRA.exe
  "C:\Users\Admin\AppData\Local\Temp\z4AMOSTRA.exe"
  2⤵
  - UAC bypass
  - Windows security bypass
  - Checks computer location settings
  - Windows security modification
  - Checks whether UAC is enabled
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:212
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\z4AMOSTRA.exe" -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:612
- - C:\Program Files (x86)\Windows Mail\wab.exe
    "C:\Program Files (x86)\Windows Mail\wab.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:3260
- C:\Windows\SysWOW64\SecEdit.exe
  "C:\Windows\SysWOW64\SecEdit.exe"
  2⤵
  - Adds policy Run key to start application
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:844
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:2196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry