4bcbb8983fe7425976c5a1789deff73fb138e80981f5ebfef1f835bcc6757760

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	f846950431f463a0a7e663ea7003e31c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	phwfuatf.bat

Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	f846950431f463a0a7e663ea7003e31c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	f846950431f463a0a7e663ea7003e31c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	f846950431f463a0a7e663ea7003e31c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	f846950431f463a0a7e663ea7003e31c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	phwfuatf.bat
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	phwfuatf.bat
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	phwfuatf.bat

Modifies Windows Defender TamperProtection settings 3 TTPs 2 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	phwfuatf.bat
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	f846950431f463a0a7e663ea7003e31c.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Control Panel\International\Geo\Nation	f846950431f463a0a7e663ea7003e31c.exe
Key value queried	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Control Panel\International\Geo\Nation	phwfuatf.bat

Executes dropped EXE 1 IoCs

pid	Process
6008	phwfuatf.bat

Windows security modification 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	f846950431f463a0a7e663ea7003e31c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	phwfuatf.bat

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
25	api.ipify.org
26	api.ipify.org

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4132	sc.exe
5700	sc.exe
1208	sc.exe
5144	sc.exe
4936	sc.exe
4964	sc.exe
5012	sc.exe
5908	sc.exe
1100	sc.exe
4068	sc.exe
5892	sc.exe
4196	sc.exe
1828	sc.exe
3304	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5028	timeout.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000_Classes\Local Settings	f846950431f463a0a7e663ea7003e31c.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3000	f846950431f463a0a7e663ea7003e31c.exe
3000	f846950431f463a0a7e663ea7003e31c.exe
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat
6008	phwfuatf.bat

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3000	f846950431f463a0a7e663ea7003e31c.exe
Token: SeDebugPrivilege	6008	phwfuatf.bat
Token: SeSecurityPrivilege	1140	wevtutil.exe
Token: SeBackupPrivilege	1140	wevtutil.exe
Token: SeDebugPrivilege	5932	powershell.exe
Token: SeDebugPrivilege	3400	powershell.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 1208	3000	f846950431f463a0a7e663ea7003e31c.exe	87
PID 3000 wrote to memory of 1208	3000	f846950431f463a0a7e663ea7003e31c.exe	87
PID 3000 wrote to memory of 5144	3000	f846950431f463a0a7e663ea7003e31c.exe	89
PID 3000 wrote to memory of 5144	3000	f846950431f463a0a7e663ea7003e31c.exe	89
PID 3000 wrote to memory of 6008	3000	f846950431f463a0a7e663ea7003e31c.exe	92
PID 3000 wrote to memory of 6008	3000	f846950431f463a0a7e663ea7003e31c.exe	92
PID 3000 wrote to memory of 5904	3000	f846950431f463a0a7e663ea7003e31c.exe	93
PID 3000 wrote to memory of 5904	3000	f846950431f463a0a7e663ea7003e31c.exe	93
PID 6008 wrote to memory of 1100	6008	phwfuatf.bat	95
PID 6008 wrote to memory of 1100	6008	phwfuatf.bat	95
PID 6008 wrote to memory of 4068	6008	phwfuatf.bat	96
PID 6008 wrote to memory of 4068	6008	phwfuatf.bat	96
PID 5904 wrote to memory of 4628	5904	cmd.exe	99
PID 5904 wrote to memory of 4628	5904	cmd.exe	99
PID 5904 wrote to memory of 4672	5904	cmd.exe	100
PID 5904 wrote to memory of 4672	5904	cmd.exe	100
PID 5904 wrote to memory of 5028	5904	cmd.exe	102
PID 5904 wrote to memory of 5028	5904	cmd.exe	102
PID 6008 wrote to memory of 1224	6008	phwfuatf.bat	104
PID 6008 wrote to memory of 1224	6008	phwfuatf.bat	104
PID 6008 wrote to memory of 4936	6008	phwfuatf.bat	106
PID 6008 wrote to memory of 4936	6008	phwfuatf.bat	106
PID 1224 wrote to memory of 4964	1224	cmd.exe	108
PID 1224 wrote to memory of 4964	1224	cmd.exe	108
PID 6008 wrote to memory of 1632	6008	phwfuatf.bat	109
PID 6008 wrote to memory of 1632	6008	phwfuatf.bat	109
PID 6008 wrote to memory of 5012	6008	phwfuatf.bat	111
PID 6008 wrote to memory of 5012	6008	phwfuatf.bat	111
PID 1632 wrote to memory of 5892	1632	cmd.exe	113
PID 1632 wrote to memory of 5892	1632	cmd.exe	113
PID 6008 wrote to memory of 3496	6008	phwfuatf.bat	114
PID 6008 wrote to memory of 3496	6008	phwfuatf.bat	114
PID 3496 wrote to memory of 4196	3496	cmd.exe	116
PID 3496 wrote to memory of 4196	3496	cmd.exe	116
PID 5904 wrote to memory of 3160	5904	cmd.exe	117
PID 5904 wrote to memory of 3160	5904	cmd.exe	117
PID 5904 wrote to memory of 1140	5904	cmd.exe	118
PID 5904 wrote to memory of 1140	5904	cmd.exe	118
PID 6008 wrote to memory of 1456	6008	phwfuatf.bat	119
PID 6008 wrote to memory of 1456	6008	phwfuatf.bat	119
PID 1456 wrote to memory of 1828	1456	cmd.exe	121
PID 1456 wrote to memory of 1828	1456	cmd.exe	121
PID 6008 wrote to memory of 3304	6008	phwfuatf.bat	122
PID 6008 wrote to memory of 3304	6008	phwfuatf.bat	122
PID 6008 wrote to memory of 4140	6008	phwfuatf.bat	126
PID 6008 wrote to memory of 4140	6008	phwfuatf.bat	126
PID 4140 wrote to memory of 4132	4140	cmd.exe	128
PID 4140 wrote to memory of 4132	4140	cmd.exe	128
PID 5904 wrote to memory of 6032	5904	cmd.exe	130
PID 5904 wrote to memory of 6032	5904	cmd.exe	130
PID 6008 wrote to memory of 5932	6008	phwfuatf.bat	131
PID 6008 wrote to memory of 5932	6008	phwfuatf.bat	131
PID 6008 wrote to memory of 3400	6008	phwfuatf.bat	134
PID 6008 wrote to memory of 3400	6008	phwfuatf.bat	134
PID 6008 wrote to memory of 4492	6008	phwfuatf.bat	136
PID 6008 wrote to memory of 4492	6008	phwfuatf.bat	136
PID 6008 wrote to memory of 5052	6008	phwfuatf.bat	138
PID 6008 wrote to memory of 5052	6008	phwfuatf.bat	138
PID 4492 wrote to memory of 5700	4492	cmd.exe	140
PID 4492 wrote to memory of 5700	4492	cmd.exe	140
PID 5052 wrote to memory of 5908	5052	cmd.exe	141
PID 5052 wrote to memory of 5908	5052	cmd.exe	141

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4628	attrib.exe
3160	attrib.exe
6032	attrib.exe

C:\Users\Admin\AppData\Local\Temp\f846950431f463a0a7e663ea7003e31c.exe
"C:\Users\Admin\AppData\Local\Temp\f846950431f463a0a7e663ea7003e31c.exe"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Modifies Windows Defender TamperProtection settings
- Checks computer location settings
- Windows security modification
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config WerSvc start=disabled
  2⤵
  - Launches sc.exe
  PID:1208
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config wdfilter start=disabled
  2⤵
  - Launches sc.exe
  PID:5144
- C:\Users\Admin\AppData\Local\Temp\phwfuatf.bat
  "C:\Users\Admin\AppData\Local\Temp\phwfuatf.bat" ok
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  - Modifies Windows Defender Real-time Protection settings
  - Modifies Windows Defender TamperProtection settings
  - Checks computer location settings
  - Executes dropped EXE
  - Windows security modification
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6008
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config WerSvc start=disabled
    3⤵
    - Launches sc.exe
    PID:1100
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config wdfilter start=disabled
    3⤵
    - Launches sc.exe
    PID:4068
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc stop wdfilter
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1224
  - - C:\Windows\system32\sc.exe
      sc stop wdfilter
      4⤵
      Launches sc.exe
      PID:4964
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config WinDefend start=disabled
    3⤵
    - Launches sc.exe
    PID:4936
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc stop WerSvc
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1632
  - - C:\Windows\system32\sc.exe
      sc stop WerSvc
      4⤵
      Launches sc.exe
      PID:5892
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config WdNisSvc start=disabled
    3⤵
    - Launches sc.exe
    PID:5012
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc stop WinDefend
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3496
  - - C:\Windows\system32\sc.exe
      sc stop WinDefend
      4⤵
      Launches sc.exe
      PID:4196
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc stop WdNisSvc
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1456
  - - C:\Windows\system32\sc.exe
      sc stop WdNisSvc
      4⤵
      Launches sc.exe
      PID:1828
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config XblGameSave start=disabled
    3⤵
    - Launches sc.exe
    PID:3304
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc stop XblGameSave
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4140
  - - C:\Windows\system32\sc.exe
      sc stop XblGameSave
      4⤵
      Launches sc.exe
      PID:4132
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" New-NetQosPolicy -Name "XXXXX" -AppPathNameMatchCondition "C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.exe" -ThrottleRateActionBitsPerSecond 8
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5932
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" New-NetQosPolicy -Name "YYYYY" -AppPathNameMatchCondition "C:\Program Files (x86)\Common Files\BattlEye\BEService.exe" -ThrottleRateActionBitsPerSecond 8
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3400
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc stop wdfilter
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4492
  - - C:\Windows\system32\sc.exe
      sc stop wdfilter
      4⤵
      Launches sc.exe
      PID:5700
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc stop faceit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5052
  - - C:\Windows\system32\sc.exe
      sc stop faceit
      4⤵
      Launches sc.exe
      PID:5908
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\64fae90a-4c8e-4e85-8573-681720263820.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5904
- - C:\Windows\system32\attrib.exe
    attrib -r -s -h "C:\Users\Admin\AppData\Local\Temp\f846950431f463a0a7e663ea7003e31c.exe"
    3⤵
    - Views/modifies file attributes
    PID:4628
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "HiberbootEnabled" /t REG_DWORD /d 0 /f
    3⤵
    PID:4672
- - C:\Windows\system32\timeout.exe
    timeout /T 1
    3⤵
    - Delays execution with timeout.exe
    PID:5028
- - C:\Windows\system32\attrib.exe
    attrib -r -s -h "C:\Users\Admin\AppData\Local\Temp\f846950431f463a0a7e663ea7003e31c.exe"
    3⤵
    - Views/modifies file attributes
    PID:3160
- - C:\Windows\system32\wevtutil.exe
    wevtutil el
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1140
- - C:\Windows\system32\attrib.exe
    attrib -r -s -h "C:\Users\Admin\AppData\Local\Temp\64fae90a-4c8e-4e85-8573-681720263820.bat"
    3⤵
    - Views/modifies file attributes
    PID:6032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry