sality | da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
Sality family
sality

UAC bypass 3 TTPs 1 IoCs

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe

Windows security bypass 2 TTPs 6 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	wscript.exe

Windows security modification 2 TTPs 7 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

System Information Discovery

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\L:	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\R:	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
File opened (read-only)	\??\H:	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
File opened (read-only)	\??\U:	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
File opened (read-only)	\??\V:	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\S:	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
File opened (read-only)	\??\J:	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
File opened (read-only)	\??\Y:	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\N:	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
File opened (read-only)	\??\O:	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
File opened (read-only)	\??\Q:	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\P:	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
File opened (read-only)	\??\X:	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
File opened (read-only)	\??\T:	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\autorun.inf	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
File opened for modification	F:\autorun.inf	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe

UPX packed file 39 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4176-16-0x0000000002480000-0x000000000353A000-memory.dmp	upx
behavioral2/memory/4176-23-0x0000000002480000-0x000000000353A000-memory.dmp	upx
behavioral2/memory/4176-22-0x0000000002480000-0x000000000353A000-memory.dmp	upx
behavioral2/memory/4176-3-0x0000000002480000-0x000000000353A000-memory.dmp	upx
behavioral2/memory/4176-33-0x0000000002480000-0x000000000353A000-memory.dmp	upx
behavioral2/memory/4176-24-0x0000000002480000-0x000000000353A000-memory.dmp	upx
behavioral2/memory/4176-36-0x0000000002480000-0x000000000353A000-memory.dmp	upx
behavioral2/memory/4176-37-0x0000000002480000-0x000000000353A000-memory.dmp	upx
behavioral2/memory/4176-39-0x0000000002480000-0x000000000353A000-memory.dmp	upx
behavioral2/memory/4176-17-0x0000000002480000-0x000000000353A000-memory.dmp	upx
behavioral2/memory/4176-51-0x0000000002480000-0x000000000353A000-memory.dmp	upx
behavioral2/memory/4176-52-0x0000000002480000-0x000000000353A000-memory.dmp	upx
behavioral2/memory/4176-55-0x0000000002480000-0x000000000353A000-memory.dmp	upx
behavioral2/memory/4176-57-0x0000000002480000-0x000000000353A000-memory.dmp	upx
behavioral2/memory/4176-56-0x0000000002480000-0x000000000353A000-memory.dmp	upx
behavioral2/memory/4176-59-0x0000000002480000-0x000000000353A000-memory.dmp	upx
behavioral2/memory/4176-63-0x0000000002480000-0x000000000353A000-memory.dmp	upx
behavioral2/memory/4176-64-0x0000000002480000-0x000000000353A000-memory.dmp	upx
behavioral2/memory/4176-67-0x0000000002480000-0x000000000353A000-memory.dmp	upx
behavioral2/memory/4176-68-0x0000000002480000-0x000000000353A000-memory.dmp	upx
behavioral2/memory/4176-70-0x0000000002480000-0x000000000353A000-memory.dmp	upx
behavioral2/memory/4176-71-0x0000000002480000-0x000000000353A000-memory.dmp	upx
behavioral2/memory/4176-74-0x0000000002480000-0x000000000353A000-memory.dmp	upx
behavioral2/memory/4176-82-0x0000000002480000-0x000000000353A000-memory.dmp	upx
behavioral2/memory/4176-84-0x0000000002480000-0x000000000353A000-memory.dmp	upx
behavioral2/memory/4176-86-0x0000000002480000-0x000000000353A000-memory.dmp	upx
behavioral2/memory/4176-87-0x0000000002480000-0x000000000353A000-memory.dmp	upx
behavioral2/memory/4176-89-0x0000000002480000-0x000000000353A000-memory.dmp	upx
behavioral2/memory/4176-91-0x0000000002480000-0x000000000353A000-memory.dmp	upx
behavioral2/memory/4176-90-0x0000000002480000-0x000000000353A000-memory.dmp	upx
behavioral2/memory/4176-94-0x0000000002480000-0x000000000353A000-memory.dmp	upx
behavioral2/memory/4176-96-0x0000000002480000-0x000000000353A000-memory.dmp	upx
behavioral2/memory/4176-98-0x0000000002480000-0x000000000353A000-memory.dmp	upx
behavioral2/memory/4176-99-0x0000000002480000-0x000000000353A000-memory.dmp	upx
behavioral2/memory/4176-101-0x0000000002480000-0x000000000353A000-memory.dmp	upx
behavioral2/memory/4176-102-0x0000000002480000-0x000000000353A000-memory.dmp	upx
behavioral2/memory/4176-104-0x0000000002480000-0x000000000353A000-memory.dmp	upx
behavioral2/memory/4176-105-0x0000000002480000-0x000000000353A000-memory.dmp	upx
behavioral2/memory/4176-177-0x0000000002480000-0x000000000353A000-memory.dmp	upx

Drops file in Program Files directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zG.exe	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
File created	C:\Program Files (x86)\MSECACHE\WICU3\Unicode\MsiZap.exe	msiexec.exe
File created	C:\Program Files (x86)\MSECACHE\WICU3\Ansi\MsiZap.exe	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
File created	C:\Program Files (x86)\Windows Installer Clean Up\msicuu.exe	msiexec.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
File created	C:\Program Files (x86)\MSECACHE\WICU3\msicuu.exe	wscript.exe
File opened for modification	C:\Program Files (x86)\MSECACHE\WICU3\msicuu.exe	wscript.exe
File created	C:\Program Files (x86)\MSECACHE\WICU3\MsiZapA.exe	wscript.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
File created	C:\Program Files (x86)\Windows Installer Clean Up\MsiZap.exe	msiexec.exe
File created	C:\Program Files (x86)\Windows Installer Clean Up\readme.txt	msiexec.exe
File created	C:\Program Files (x86)\MSECACHE\WICU3\msicuu.msi	wscript.exe
File created	C:\Program Files (x86)\MSECACHE\WICU3\MsiZapU.exe	wscript.exe
File created	C:\Program Files (x86)\MSECACHE\WICU3\readme.txt	wscript.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Installer\SourceHash{121634B0-2F4B-11D3-ADA3-00C04F52DD52}	msiexec.exe
File created	C:\Windows\Installer\e583287.msi	msiexec.exe
File opened for modification	C:\Windows\SYSTEM.INI	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
File created	C:\Windows\Installer\e583285.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\e579635	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
File opened for modification	C:\Windows\Installer\e583285.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI336F.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000009fc5eef0dbaffe7c0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800009fc5eef00000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809009fc5eef0000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d9fc5eef0000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000009fc5eef000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
4648	msiexec.exe
4648	msiexec.exe
4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
Token: SeDebugPrivilege	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1736	msiexec.exe
1736	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4176 wrote to memory of 1336	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	82
PID 4176 wrote to memory of 1336	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	82
PID 4176 wrote to memory of 1336	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	82
PID 4176 wrote to memory of 780	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	8
PID 4176 wrote to memory of 784	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	9
PID 4176 wrote to memory of 376	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	13
PID 4176 wrote to memory of 2584	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	42
PID 4176 wrote to memory of 2596	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	43
PID 4176 wrote to memory of 2708	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	45
PID 4176 wrote to memory of 3508	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	56
PID 4176 wrote to memory of 3668	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	57
PID 4176 wrote to memory of 3864	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	58
PID 4176 wrote to memory of 3964	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	59
PID 4176 wrote to memory of 4068	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	60
PID 4176 wrote to memory of 2472	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	61
PID 4176 wrote to memory of 4116	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	62
PID 4176 wrote to memory of 1696	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	75
PID 4176 wrote to memory of 2168	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	76
PID 4176 wrote to memory of 1336	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	82
PID 4176 wrote to memory of 1336	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	82
PID 1336 wrote to memory of 1736	1336	wscript.exe	83
PID 1336 wrote to memory of 1736	1336	wscript.exe	83
PID 1336 wrote to memory of 1736	1336	wscript.exe	83
PID 4176 wrote to memory of 780	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	8
PID 4176 wrote to memory of 784	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	9
PID 4176 wrote to memory of 376	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	13
PID 4176 wrote to memory of 2584	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	42
PID 4176 wrote to memory of 2596	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	43
PID 4176 wrote to memory of 2708	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	45
PID 4176 wrote to memory of 3508	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	56
PID 4176 wrote to memory of 3668	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	57
PID 4176 wrote to memory of 3864	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	58
PID 4176 wrote to memory of 3964	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	59
PID 4176 wrote to memory of 4068	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	60
PID 4176 wrote to memory of 2472	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	61
PID 4176 wrote to memory of 4116	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	62
PID 4176 wrote to memory of 1696	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	75
PID 4176 wrote to memory of 2168	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	76
PID 4176 wrote to memory of 1736	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	83
PID 4176 wrote to memory of 1736	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	83
PID 4176 wrote to memory of 780	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	8
PID 4176 wrote to memory of 784	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	9
PID 4176 wrote to memory of 376	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	13
PID 4176 wrote to memory of 2584	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	42
PID 4176 wrote to memory of 2596	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	43
PID 4176 wrote to memory of 2708	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	45
PID 4176 wrote to memory of 3508	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	56
PID 4176 wrote to memory of 3668	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	57
PID 4176 wrote to memory of 3864	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	58
PID 4176 wrote to memory of 3964	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	59
PID 4176 wrote to memory of 4068	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	60
PID 4176 wrote to memory of 2472	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	61
PID 4176 wrote to memory of 4116	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	62
PID 4176 wrote to memory of 1696	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	75
PID 4176 wrote to memory of 2168	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	76
PID 4176 wrote to memory of 780	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	8
PID 4176 wrote to memory of 784	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	9
PID 4176 wrote to memory of 376	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	13
PID 4176 wrote to memory of 2584	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	42
PID 4176 wrote to memory of 2596	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	43
PID 4176 wrote to memory of 2708	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	45
PID 4176 wrote to memory of 3508	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	56
PID 4176 wrote to memory of 3668	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	57
PID 4176 wrote to memory of 3864	4176	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe	58

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:780

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:784

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:376

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2596

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2708

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3508
- C:\Users\Admin\AppData\Local\Temp\da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe
  "C:\Users\Admin\AppData\Local\Temp\da45741ee5792531c2227ad1aaf7f19008855dfdb849882d989a17733bf2b8a0N.exe"
  2⤵
  - Modifies firewall policy service
  - UAC bypass
  - Windows security bypass
  - Windows security modification
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4176
- - C:\Windows\SysWOW64\wscript.exe
    wscript StartMsi.vbs
    3⤵
    - Checks computer location settings
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1336
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Program Files (x86)\MSECACHE\WICU3\msicuu.msi"
      4⤵
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:1736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3668

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3864

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3964

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4068

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2472

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4116

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:1696

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2168

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:4648
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:920

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:700

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:5032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery