phorphiex | 9106395ddc362fe7b169d97eb7266c85e91b9d1c1934e27e2ea06ac8fa947e2d

Processes:

sysppvrdnvs.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysppvrdnvs.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

5084 powershell.exe
Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

pid	process
5084	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-10-16_ca22db896e169195523be246ee685e4d_cobalt-strike_hijackloader_ryuk.exesysppvrdnvs.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	2024-10-16_ca22db896e169195523be246ee685e4d_cobalt-strike_hijackloader_ryuk.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	sysppvrdnvs.exe

Executes dropped EXE 3 IoCs

Processes:

7D6D.exe2712411754.exesysppvrdnvs.exe

pid process

4924 7D6D.exe
2380 2712411754.exe
3852 sysppvrdnvs.exe

pid	process
4924	7D6D.exe
2380	2712411754.exe
3852	sysppvrdnvs.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

sysppvrdnvs.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysppvrdnvs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Processes:

2712411754.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysppvrdnvs.exe"	2712411754.exe

Drops file in Windows directory 2 IoCs

Processes:

2712411754.exe

description ioc process

File created C:\Windows\sysppvrdnvs.exe 2712411754.exe
File opened for modification C:\Windows\sysppvrdnvs.exe 2712411754.exe
Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exe

pid process

2944 sc.exe
1612 sc.exe
4792 sc.exe
1860 sc.exe
5068 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\sysppvrdnvs.exe	2712411754.exe
File opened for modification	C:\Windows\sysppvrdnvs.exe	2712411754.exe

pid	process
2944	sc.exe
1612	sc.exe
4792	sc.exe
1860	sc.exe
5068	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.exepowershell.exesc.exe2712411754.exesysppvrdnvs.exeIEXPLORE.EXEsc.exesc.exesc.exe7D6D.execmd.exesc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2712411754.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysppvrdnvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7D6D.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000013f787289f1be14e87be8dc204ff715d000000000200000000001066000000010000200000004da2fa3c2847df446e4c62ff7892a1ddc8b6c0f3c01fa62e48d57e68c5572f85000000000e80000000020000200000003e198600ac7c7a8b75b849b294dacc2b4dbae9886c2aa6272c7f4184a083c18720000000afd54b0d24df52565ac672ef64017d3b6edef48d98b796235ce305d9f74c94b640000000bafff79dfde74d5e48f74d615fa7fcc43585f6407c1a6e1c20f0b67d411f41d571f0dee7cda17711efce508b7bf8845461726423eaeb0ab3c9b59d22ad871952	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 704f7778631fdb01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1659370670"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31137635"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1657495421"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1659370670"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80237078631fdb01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31137635"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435803909"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{8E6698C9-8B56-11EF-B319-FA89EA07D49F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31137635"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31137635"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000013f787289f1be14e87be8dc204ff715d00000000020000000000106600000001000020000000316a6ef576b8de2fddaccadc9153db9c0d4d3b2ca2ba38f6ca9b1fb371273b1a000000000e8000000002000020000000d8729c5c4985b1f059c525f1d3c43aab5c55f6ede796cd3a1131416ff645703c200000001de5e23e5c6ab8216ce279162fef70598667c103d6a238e84f2635f2cbee5bf14000000034d15e3685fc6563a20dcc86c515c11286325d8ff61530e043478338d54b5760a859311f839fae588996cf12dc54c7d972d0c58ee36b6a13638c2e9760d4789d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1657495421"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

5084 powershell.exe
5084 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 5084 powershell.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

616 iexplore.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

616 iexplore.exe
616 iexplore.exe
3412 IEXPLORE.EXE
3412 IEXPLORE.EXE

pid	process
5084	powershell.exe
5084	powershell.exe

description	pid	process
Token: SeDebugPrivilege	5084	powershell.exe

pid	process
616	iexplore.exe

pid	process
616	iexplore.exe
616	iexplore.exe
3412	IEXPLORE.EXE
3412	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 38 IoCs

Processes:

2024-10-16_ca22db896e169195523be246ee685e4d_cobalt-strike_hijackloader_ryuk.exe7D6D.exe2712411754.exeiexplore.exesysppvrdnvs.execmd.execmd.exe

description	pid	process	target process
PID 2020 wrote to memory of 4924	2020	2024-10-16_ca22db896e169195523be246ee685e4d_cobalt-strike_hijackloader_ryuk.exe	7D6D.exe
PID 2020 wrote to memory of 4924	2020	2024-10-16_ca22db896e169195523be246ee685e4d_cobalt-strike_hijackloader_ryuk.exe	7D6D.exe
PID 2020 wrote to memory of 4924	2020	2024-10-16_ca22db896e169195523be246ee685e4d_cobalt-strike_hijackloader_ryuk.exe	7D6D.exe
PID 4924 wrote to memory of 2380	4924	7D6D.exe	2712411754.exe
PID 4924 wrote to memory of 2380	4924	7D6D.exe	2712411754.exe
PID 4924 wrote to memory of 2380	4924	7D6D.exe	2712411754.exe
PID 2380 wrote to memory of 3852	2380	2712411754.exe	sysppvrdnvs.exe
PID 2380 wrote to memory of 3852	2380	2712411754.exe	sysppvrdnvs.exe
PID 2380 wrote to memory of 3852	2380	2712411754.exe	sysppvrdnvs.exe
PID 2020 wrote to memory of 616	2020	2024-10-16_ca22db896e169195523be246ee685e4d_cobalt-strike_hijackloader_ryuk.exe	iexplore.exe
PID 2020 wrote to memory of 616	2020	2024-10-16_ca22db896e169195523be246ee685e4d_cobalt-strike_hijackloader_ryuk.exe	iexplore.exe
PID 616 wrote to memory of 3412	616	iexplore.exe	IEXPLORE.EXE
PID 616 wrote to memory of 3412	616	iexplore.exe	IEXPLORE.EXE
PID 616 wrote to memory of 3412	616	iexplore.exe	IEXPLORE.EXE
PID 3852 wrote to memory of 2196	3852	sysppvrdnvs.exe	cmd.exe
PID 3852 wrote to memory of 2196	3852	sysppvrdnvs.exe	cmd.exe
PID 3852 wrote to memory of 2196	3852	sysppvrdnvs.exe	cmd.exe
PID 3852 wrote to memory of 3992	3852	sysppvrdnvs.exe	cmd.exe
PID 3852 wrote to memory of 3992	3852	sysppvrdnvs.exe	cmd.exe
PID 3852 wrote to memory of 3992	3852	sysppvrdnvs.exe	cmd.exe
PID 2196 wrote to memory of 5084	2196	cmd.exe	powershell.exe
PID 2196 wrote to memory of 5084	2196	cmd.exe	powershell.exe
PID 2196 wrote to memory of 5084	2196	cmd.exe	powershell.exe
PID 3992 wrote to memory of 2944	3992	cmd.exe	sc.exe
PID 3992 wrote to memory of 2944	3992	cmd.exe	sc.exe
PID 3992 wrote to memory of 2944	3992	cmd.exe	sc.exe
PID 3992 wrote to memory of 1612	3992	cmd.exe	sc.exe
PID 3992 wrote to memory of 1612	3992	cmd.exe	sc.exe
PID 3992 wrote to memory of 1612	3992	cmd.exe	sc.exe
PID 3992 wrote to memory of 4792	3992	cmd.exe	sc.exe
PID 3992 wrote to memory of 4792	3992	cmd.exe	sc.exe
PID 3992 wrote to memory of 4792	3992	cmd.exe	sc.exe
PID 3992 wrote to memory of 1860	3992	cmd.exe	sc.exe
PID 3992 wrote to memory of 1860	3992	cmd.exe	sc.exe
PID 3992 wrote to memory of 1860	3992	cmd.exe	sc.exe
PID 3992 wrote to memory of 5068	3992	cmd.exe	sc.exe
PID 3992 wrote to memory of 5068	3992	cmd.exe	sc.exe
PID 3992 wrote to memory of 5068	3992	cmd.exe	sc.exe

C:\Users\Admin\AppData\Local\Temp\2024-10-16_ca22db896e169195523be246ee685e4d_cobalt-strike_hijackloader_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-16_ca22db896e169195523be246ee685e4d_cobalt-strike_hijackloader_ryuk.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2020

C:\Users\Admin\AppData\Local\Temp\7D6D.exe
"C:\Users\Admin\AppData\Local\Temp\7D6D.exe"
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4924

C:\Users\Admin\AppData\Local\Temp\2712411754.exe
C:\Users\Admin\AppData\Local\Temp\2712411754.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2380

C:\Windows\sysppvrdnvs.exe
C:\Windows\sysppvrdnvs.exe
4⤵
- Modifies security service
- Windows security bypass
- Checks computer location settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3852

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2196

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
6⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5084

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait
5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3992

C:\Windows\SysWOW64\sc.exe
sc stop UsoSvc
6⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2944

C:\Windows\SysWOW64\sc.exe
sc stop WaaSMedicSvc
6⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1612

C:\Windows\SysWOW64\sc.exe
sc stop wuauserv
6⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4792

C:\Windows\SysWOW64\sc.exe
sc stop DoSvc
6⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1860

C:\Windows\SysWOW64\sc.exe
sc stop BITS /wait
6⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:5068

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://chrome.360.cn/
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:616

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:616 CREDAT:17410 /prefetch:2
3⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

3

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop