ac6ee66d34d41f4ea11ba588769933221775563ea8d7d09d76c3eb21443c6570

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	WindowsHostManagefggr.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	WindowsHostManagefggr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	WindowsHostManagefggr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	WindowsHostManagefggr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	WindowsHostManagefggr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	WindowsHostManagefggr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	WindowsHostManagefggr.exe

Windows security bypass 2 TTPs 1 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	WindowsHostManagefggr.exe

Executes dropped EXE 1 IoCs

pid	Process
4620	WindowsHostManagefggr.exe

Windows security modification 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	WindowsHostManagefggr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions	WindowsHostManagefggr.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
4508	arp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3248	WindowsHostManagefggr.exe
3248	WindowsHostManagefggr.exe
3248	WindowsHostManagefggr.exe
4620	WindowsHostManagefggr.exe
4620	WindowsHostManagefggr.exe
4620	WindowsHostManagefggr.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid
4

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	3248	WindowsHostManagefggr.exe
Token: SeDebugPrivilege	4620	WindowsHostManagefggr.exe
Token: SeIncreaseQuotaPrivilege	4620	WindowsHostManagefggr.exe
Token: SeSecurityPrivilege	4620	WindowsHostManagefggr.exe
Token: SeTakeOwnershipPrivilege	4620	WindowsHostManagefggr.exe
Token: SeLoadDriverPrivilege	4620	WindowsHostManagefggr.exe
Token: SeSystemProfilePrivilege	4620	WindowsHostManagefggr.exe
Token: SeSystemtimePrivilege	4620	WindowsHostManagefggr.exe
Token: SeProfSingleProcessPrivilege	4620	WindowsHostManagefggr.exe
Token: SeIncBasePriorityPrivilege	4620	WindowsHostManagefggr.exe
Token: SeCreatePagefilePrivilege	4620	WindowsHostManagefggr.exe
Token: SeBackupPrivilege	4620	WindowsHostManagefggr.exe
Token: SeRestorePrivilege	4620	WindowsHostManagefggr.exe
Token: SeShutdownPrivilege	4620	WindowsHostManagefggr.exe
Token: SeDebugPrivilege	4620	WindowsHostManagefggr.exe
Token: SeSystemEnvironmentPrivilege	4620	WindowsHostManagefggr.exe
Token: SeRemoteShutdownPrivilege	4620	WindowsHostManagefggr.exe
Token: SeUndockPrivilege	4620	WindowsHostManagefggr.exe
Token: SeManageVolumePrivilege	4620	WindowsHostManagefggr.exe
Token: 33	4620	WindowsHostManagefggr.exe
Token: 34	4620	WindowsHostManagefggr.exe
Token: 35	4620	WindowsHostManagefggr.exe
Token: 36	4620	WindowsHostManagefggr.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3248 wrote to memory of 2952	3248	WindowsHostManagefggr.exe	43
PID 3248 wrote to memory of 4620	3248	WindowsHostManagefggr.exe	90
PID 4620 wrote to memory of 2952	4620	WindowsHostManagefggr.exe	43
PID 4620 wrote to memory of 4508	4620	WindowsHostManagefggr.exe	92

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2952

C:\Users\Admin\AppData\Local\Temp\WindowsHostManagefggr.exe
"C:\Users\Admin\AppData\Local\Temp\WindowsHostManagefggr.exe"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Windows security bypass
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Users\Admin\AppData\Roaming\WindowsHostManagefggr.exe
  "C:\Users\Admin\AppData\Roaming\WindowsHostManagefggr.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Windows\SYSTEM32\arp.exe
    "arp" -a
    3⤵
    - Network Service Discovery
    PID:4508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry