d7b3062e9518033fe239bd2220a89f502026269e4b012b1453470f3a5146d483

pid	Process
5740	bcdedit.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Active Setup\Installed Components	Explorer.EXE

Deletes backup catalog 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

Inhibit System Recovery

pid	Process
956	wbadmin.exe

Deletes system backups 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

Inhibit System Recovery

persistence privilege_escalation

pid	Process
1660	wbadmin.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

Registry Run Keys / Startup Folder

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FLP_LOCK.ps1	PowerShell.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\FLP_LOCK = "powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\FLP_LOCK.ps1\""	PowerShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FLP_LOCK = "powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\FLP_LOCK.ps1\""	PowerShell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3348	PowerShell.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2812	cmd.exe
3104	cmd.exe
3480	cmd.exe
2132	cmd.exe
3560	cmd.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

Inhibit System Recovery

Direct Volume Access

T1006

pid	Process
5300	vssadmin.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3611646547-550105268-947503007-1000\{71CF24D3-B5B9-4BD3-8B46-72323521F9E5}	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3348	PowerShell.exe
3348	PowerShell.exe
3348	PowerShell.exe
3348	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	3348	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	3348	PowerShell.exe
Token: SeSecurityPrivilege	3348	PowerShell.exe
Token: SeTakeOwnershipPrivilege	3348	PowerShell.exe
Token: SeLoadDriverPrivilege	3348	PowerShell.exe
Token: SeSystemProfilePrivilege	3348	PowerShell.exe
Token: SeSystemtimePrivilege	3348	PowerShell.exe
Token: SeProfSingleProcessPrivilege	3348	PowerShell.exe
Token: SeIncBasePriorityPrivilege	3348	PowerShell.exe
Token: SeCreatePagefilePrivilege	3348	PowerShell.exe
Token: SeBackupPrivilege	3348	PowerShell.exe
Token: SeRestorePrivilege	3348	PowerShell.exe
Token: SeShutdownPrivilege	3348	PowerShell.exe
Token: SeDebugPrivilege	3348	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	3348	PowerShell.exe
Token: SeRemoteShutdownPrivilege	3348	PowerShell.exe
Token: SeUndockPrivilege	3348	PowerShell.exe
Token: SeManageVolumePrivilege	3348	PowerShell.exe
Token: 33	3348	PowerShell.exe
Token: 34	3348	PowerShell.exe
Token: 35	3348	PowerShell.exe
Token: 36	3348	PowerShell.exe
Token: SeShutdownPrivilege	4320	Explorer.EXE
Token: SeCreatePagefilePrivilege	4320	Explorer.EXE
Token: SeShutdownPrivilege	4320	Explorer.EXE
Token: SeCreatePagefilePrivilege	4320	Explorer.EXE

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5788 wrote to memory of 4320	5788	userinit.exe	91

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\FLP (1).ps1"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3348
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c vssadmin delete shadows /all /quiet
  2⤵
  - Executes a command shell one-liner
  PID:3560
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:5300
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c wmic shadowcopy delete /nointeractive
  2⤵
  - Executes a command shell one-liner
  PID:2812
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete /nointeractive
    3⤵
    PID:1152
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c wbadmin delete catalog -quiet
  2⤵
  - Executes a command shell one-liner
  PID:3104
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:956
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c wbadmin delete backup -keepversions:0 -quiet
  2⤵
  - Executes a command shell one-liner
  PID:3480
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete backup -keepversions:0 -quiet
    3⤵
    - Deletes system backups
    PID:1660
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c bcdedit /set {default} recoveryenabled No
  2⤵
  - Executes a command shell one-liner
  PID:2132
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5740

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:5788
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:4320

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2008

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:5264

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:5564

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1780

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:5336

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:1256

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:2916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery