4bcbb8983fe7425976c5a1789deff73fb138e80981f5ebfef1f835bcc6757760

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	f846950431f463a0a7e663ea7003e31c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	4wavfsu3.bat

Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	f846950431f463a0a7e663ea7003e31c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	f846950431f463a0a7e663ea7003e31c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	f846950431f463a0a7e663ea7003e31c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	4wavfsu3.bat
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	4wavfsu3.bat
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	4wavfsu3.bat
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	f846950431f463a0a7e663ea7003e31c.exe

Modifies Windows Defender TamperProtection settings 3 TTPs 2 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	4wavfsu3.bat
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	f846950431f463a0a7e663ea7003e31c.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-83325578-304917428-1200496059-1000\Control Panel\International\Geo\Nation	f846950431f463a0a7e663ea7003e31c.exe
Key value queried	\REGISTRY\USER\S-1-5-21-83325578-304917428-1200496059-1000\Control Panel\International\Geo\Nation	4wavfsu3.bat

Executes dropped EXE 1 IoCs

pid	Process
1304	4wavfsu3.bat

Windows security modification 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	f846950431f463a0a7e663ea7003e31c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	4wavfsu3.bat

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
28	api.ipify.org
29	api.ipify.org

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4600	sc.exe
3332	sc.exe
1352	sc.exe
4524	sc.exe
844	sc.exe
2972	sc.exe
3156	sc.exe
4996	sc.exe
1456	sc.exe
1348	sc.exe
2392	sc.exe
1564	sc.exe
2212	sc.exe
1092	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4844	timeout.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-83325578-304917428-1200496059-1000_Classes\Local Settings	f846950431f463a0a7e663ea7003e31c.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4480	f846950431f463a0a7e663ea7003e31c.exe
4480	f846950431f463a0a7e663ea7003e31c.exe
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat
1304	4wavfsu3.bat

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4480	f846950431f463a0a7e663ea7003e31c.exe
Token: SeDebugPrivilege	1304	4wavfsu3.bat
Token: SeSecurityPrivilege	4420	wevtutil.exe
Token: SeBackupPrivilege	4420	wevtutil.exe
Token: SeDebugPrivilege	3976	powershell.exe
Token: SeDebugPrivilege	3944	powershell.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 3332	4480	f846950431f463a0a7e663ea7003e31c.exe	87
PID 4480 wrote to memory of 3332	4480	f846950431f463a0a7e663ea7003e31c.exe	87
PID 4480 wrote to memory of 1352	4480	f846950431f463a0a7e663ea7003e31c.exe	89
PID 4480 wrote to memory of 1352	4480	f846950431f463a0a7e663ea7003e31c.exe	89
PID 4480 wrote to memory of 1304	4480	f846950431f463a0a7e663ea7003e31c.exe	93
PID 4480 wrote to memory of 1304	4480	f846950431f463a0a7e663ea7003e31c.exe	93
PID 4480 wrote to memory of 1144	4480	f846950431f463a0a7e663ea7003e31c.exe	94
PID 4480 wrote to memory of 1144	4480	f846950431f463a0a7e663ea7003e31c.exe	94
PID 1304 wrote to memory of 4524	1304	4wavfsu3.bat	97
PID 1304 wrote to memory of 4524	1304	4wavfsu3.bat	97
PID 1304 wrote to memory of 844	1304	4wavfsu3.bat	96
PID 1304 wrote to memory of 844	1304	4wavfsu3.bat	96
PID 1144 wrote to memory of 4832	1144	cmd.exe	100
PID 1144 wrote to memory of 4832	1144	cmd.exe	100
PID 1144 wrote to memory of 432	1144	cmd.exe	101
PID 1144 wrote to memory of 432	1144	cmd.exe	101
PID 1144 wrote to memory of 4844	1144	cmd.exe	102
PID 1144 wrote to memory of 4844	1144	cmd.exe	102
PID 1304 wrote to memory of 5100	1304	4wavfsu3.bat	104
PID 1304 wrote to memory of 5100	1304	4wavfsu3.bat	104
PID 1304 wrote to memory of 2392	1304	4wavfsu3.bat	106
PID 1304 wrote to memory of 2392	1304	4wavfsu3.bat	106
PID 5100 wrote to memory of 1348	5100	cmd.exe	108
PID 5100 wrote to memory of 1348	5100	cmd.exe	108
PID 1144 wrote to memory of 3248	1144	cmd.exe	109
PID 1144 wrote to memory of 3248	1144	cmd.exe	109
PID 1144 wrote to memory of 4420	1144	cmd.exe	110
PID 1144 wrote to memory of 4420	1144	cmd.exe	110
PID 1304 wrote to memory of 4792	1304	4wavfsu3.bat	111
PID 1304 wrote to memory of 4792	1304	4wavfsu3.bat	111
PID 1304 wrote to memory of 1456	1304	4wavfsu3.bat	113
PID 1304 wrote to memory of 1456	1304	4wavfsu3.bat	113
PID 1304 wrote to memory of 4500	1304	4wavfsu3.bat	115
PID 1304 wrote to memory of 4500	1304	4wavfsu3.bat	115
PID 1304 wrote to memory of 3156	1304	4wavfsu3.bat	117
PID 1304 wrote to memory of 3156	1304	4wavfsu3.bat	117
PID 4792 wrote to memory of 1564	4792	cmd.exe	119
PID 4792 wrote to memory of 1564	4792	cmd.exe	119
PID 4500 wrote to memory of 2972	4500	cmd.exe	120
PID 4500 wrote to memory of 2972	4500	cmd.exe	120
PID 1304 wrote to memory of 224	1304	4wavfsu3.bat	121
PID 1304 wrote to memory of 224	1304	4wavfsu3.bat	121
PID 224 wrote to memory of 4996	224	cmd.exe	123
PID 224 wrote to memory of 4996	224	cmd.exe	123
PID 1304 wrote to memory of 2760	1304	4wavfsu3.bat	126
PID 1304 wrote to memory of 2760	1304	4wavfsu3.bat	126
PID 1144 wrote to memory of 3664	1144	cmd.exe	130
PID 1144 wrote to memory of 3664	1144	cmd.exe	130
PID 1304 wrote to memory of 3976	1304	4wavfsu3.bat	131
PID 1304 wrote to memory of 3976	1304	4wavfsu3.bat	131
PID 1304 wrote to memory of 3944	1304	4wavfsu3.bat	134
PID 1304 wrote to memory of 3944	1304	4wavfsu3.bat	134
PID 1304 wrote to memory of 4016	1304	4wavfsu3.bat	136
PID 1304 wrote to memory of 4016	1304	4wavfsu3.bat	136
PID 1304 wrote to memory of 4248	1304	4wavfsu3.bat	138
PID 1304 wrote to memory of 4248	1304	4wavfsu3.bat	138
PID 4016 wrote to memory of 4600	4016	cmd.exe	140
PID 4016 wrote to memory of 4600	4016	cmd.exe	140
PID 4248 wrote to memory of 1092	4248	cmd.exe	141
PID 4248 wrote to memory of 1092	4248	cmd.exe	141

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4832	attrib.exe
3248	attrib.exe
3664	attrib.exe

C:\Users\Admin\AppData\Local\Temp\f846950431f463a0a7e663ea7003e31c.exe
"C:\Users\Admin\AppData\Local\Temp\f846950431f463a0a7e663ea7003e31c.exe"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Modifies Windows Defender TamperProtection settings
- Checks computer location settings
- Windows security modification
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config WerSvc start=disabled
  2⤵
  - Launches sc.exe
  PID:3332
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config wdfilter start=disabled
  2⤵
  - Launches sc.exe
  PID:1352
- C:\Users\Admin\AppData\Local\Temp\4wavfsu3.bat
  "C:\Users\Admin\AppData\Local\Temp\4wavfsu3.bat" ok
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  - Modifies Windows Defender Real-time Protection settings
  - Modifies Windows Defender TamperProtection settings
  - Checks computer location settings
  - Executes dropped EXE
  - Windows security modification
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1304
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config wdfilter start=disabled
    3⤵
    - Launches sc.exe
    PID:844
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config WerSvc start=disabled
    3⤵
    - Launches sc.exe
    PID:4524
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc stop wdfilter
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5100
  - - C:\Windows\system32\sc.exe
      sc stop wdfilter
      4⤵
      Launches sc.exe
      PID:1348
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config WinDefend start=disabled
    3⤵
    - Launches sc.exe
    PID:2392
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc stop WerSvc
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4792
  - - C:\Windows\system32\sc.exe
      sc stop WerSvc
      4⤵
      Launches sc.exe
      PID:1564
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config WdNisSvc start=disabled
    3⤵
    - Launches sc.exe
    PID:1456
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc stop WinDefend
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4500
  - - C:\Windows\system32\sc.exe
      sc stop WinDefend
      4⤵
      Launches sc.exe
      PID:2972
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config XblGameSave start=disabled
    3⤵
    - Launches sc.exe
    PID:3156
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc stop WdNisSvc
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:224
  - - C:\Windows\system32\sc.exe
      sc stop WdNisSvc
      4⤵
      Launches sc.exe
      PID:4996
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc stop XblGameSave
    3⤵
    PID:2760
  - - C:\Windows\system32\sc.exe
      sc stop XblGameSave
      4⤵
      Launches sc.exe
      PID:2212
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" New-NetQosPolicy -Name "XXXXX" -AppPathNameMatchCondition "C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.exe" -ThrottleRateActionBitsPerSecond 8
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3976
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" New-NetQosPolicy -Name "YYYYY" -AppPathNameMatchCondition "C:\Program Files (x86)\Common Files\BattlEye\BEService.exe" -ThrottleRateActionBitsPerSecond 8
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3944
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc stop wdfilter
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4016
  - - C:\Windows\system32\sc.exe
      sc stop wdfilter
      4⤵
      Launches sc.exe
      PID:4600
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc stop faceit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4248
  - - C:\Windows\system32\sc.exe
      sc stop faceit
      4⤵
      Launches sc.exe
      PID:1092
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\87375733-0e69-40c6-beb2-d90a3a2d0c4f.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1144
- - C:\Windows\system32\attrib.exe
    attrib -r -s -h "C:\Users\Admin\AppData\Local\Temp\f846950431f463a0a7e663ea7003e31c.exe"
    3⤵
    - Views/modifies file attributes
    PID:4832
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "HiberbootEnabled" /t REG_DWORD /d 0 /f
    3⤵
    PID:432
- - C:\Windows\system32\timeout.exe
    timeout /T 1
    3⤵
    - Delays execution with timeout.exe
    PID:4844
- - C:\Windows\system32\attrib.exe
    attrib -r -s -h "C:\Users\Admin\AppData\Local\Temp\f846950431f463a0a7e663ea7003e31c.exe"
    3⤵
    - Views/modifies file attributes
    PID:3248
- - C:\Windows\system32\wevtutil.exe
    wevtutil el
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4420
- - C:\Windows\system32\attrib.exe
    attrib -r -s -h "C:\Users\Admin\AppData\Local\Temp\87375733-0e69-40c6-beb2-d90a3a2d0c4f.bat"
    3⤵
    - Views/modifies file attributes
    PID:3664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry