Analysis
-
max time kernel
148s -
max time network
108s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
07-06-2022 16:34
Static task
static1
Behavioral task
behavioral1
Sample
1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
Resource
win7-20220414-en
General
-
Target
1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe
-
Size
1.1MB
-
MD5
a2f29e5b9b1dccc27fc086a4cdfaecc0
-
SHA1
39dfffeabf8b89215e6fe5ccf597aa9dec67ee01
-
SHA256
1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9
-
SHA512
864a35064eaf298c3391133473741bdaa2706b5a4721e1121b98a85edf365f2a81303b597a6c62154fd27d3476adbd0603e60f551f62f9810a6b7df55f280994
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
http://klkjwre77638dfqwieuoi888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exegwdepd.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" gwdepd.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" gwdepd.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" gwdepd.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe -
Processes:
1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exegwdepd.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" gwdepd.exe -
Processes:
gwdepd.exe1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" gwdepd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" gwdepd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" gwdepd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" gwdepd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" gwdepd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" gwdepd.exe -
Disables RegEdit via registry modification 2 IoCs
Processes:
1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exegwdepd.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" gwdepd.exe -
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
Processes:
gwdepd.exepid process 1788 gwdepd.exe -
Processes:
resource yara_rule behavioral1/memory/1992-55-0x0000000001F70000-0x0000000002FFE000-memory.dmp upx behavioral1/memory/1992-57-0x0000000001F70000-0x0000000002FFE000-memory.dmp upx behavioral1/memory/1992-65-0x0000000001F70000-0x0000000002FFE000-memory.dmp upx behavioral1/memory/1788-69-0x0000000001F30000-0x0000000002FBE000-memory.dmp upx behavioral1/memory/1788-71-0x0000000001F30000-0x0000000002FBE000-memory.dmp upx behavioral1/memory/1788-73-0x0000000001F30000-0x0000000002FBE000-memory.dmp upx -
Deletes itself 1 IoCs
Processes:
gwdepd.exepid process 1788 gwdepd.exe -
Loads dropped DLL 2 IoCs
Processes:
1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exepid process 1992 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe 1992 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe -
Processes:
1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exegwdepd.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" gwdepd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" gwdepd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" gwdepd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" gwdepd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" gwdepd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" gwdepd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc gwdepd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
gwdepd.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\gwdepd.exe" gwdepd.exe -
Processes:
1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exegwdepd.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" gwdepd.exe -
Drops file in Program Files directory 5 IoCs
Processes:
gwdepd.exedescription ioc process File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\BCSSYNC.EXE gwdepd.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe gwdepd.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe gwdepd.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe gwdepd.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe gwdepd.exe -
Drops file in Windows directory 1 IoCs
Processes:
1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exegwdepd.exepid process 1992 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe 1788 gwdepd.exe 1788 gwdepd.exe 1788 gwdepd.exe 1788 gwdepd.exe 1788 gwdepd.exe 1788 gwdepd.exe 1788 gwdepd.exe 1788 gwdepd.exe 1788 gwdepd.exe 1788 gwdepd.exe 1788 gwdepd.exe 1788 gwdepd.exe 1788 gwdepd.exe -
Suspicious use of AdjustPrivilegeToken 40 IoCs
Processes:
1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exegwdepd.exedescription pid process Token: SeDebugPrivilege 1992 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe Token: SeDebugPrivilege 1992 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe Token: SeDebugPrivilege 1992 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe Token: SeDebugPrivilege 1992 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe Token: SeDebugPrivilege 1992 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe Token: SeDebugPrivilege 1992 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe Token: SeDebugPrivilege 1992 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe Token: SeDebugPrivilege 1992 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe Token: SeDebugPrivilege 1992 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe Token: SeDebugPrivilege 1992 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe Token: SeDebugPrivilege 1992 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe Token: SeDebugPrivilege 1992 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe Token: SeDebugPrivilege 1992 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe Token: SeDebugPrivilege 1992 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe Token: SeDebugPrivilege 1992 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe Token: SeDebugPrivilege 1992 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe Token: SeDebugPrivilege 1992 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe Token: SeDebugPrivilege 1992 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe Token: SeDebugPrivilege 1992 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe Token: SeDebugPrivilege 1992 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe Token: SeDebugPrivilege 1788 gwdepd.exe Token: SeDebugPrivilege 1788 gwdepd.exe Token: SeDebugPrivilege 1788 gwdepd.exe Token: SeDebugPrivilege 1788 gwdepd.exe Token: SeDebugPrivilege 1788 gwdepd.exe Token: SeDebugPrivilege 1788 gwdepd.exe Token: SeDebugPrivilege 1788 gwdepd.exe Token: SeDebugPrivilege 1788 gwdepd.exe Token: SeDebugPrivilege 1788 gwdepd.exe Token: SeDebugPrivilege 1788 gwdepd.exe Token: SeDebugPrivilege 1788 gwdepd.exe Token: SeDebugPrivilege 1788 gwdepd.exe Token: SeDebugPrivilege 1788 gwdepd.exe Token: SeDebugPrivilege 1788 gwdepd.exe Token: SeDebugPrivilege 1788 gwdepd.exe Token: SeDebugPrivilege 1788 gwdepd.exe Token: SeDebugPrivilege 1788 gwdepd.exe Token: SeDebugPrivilege 1788 gwdepd.exe Token: SeDebugPrivilege 1788 gwdepd.exe Token: SeDebugPrivilege 1788 gwdepd.exe -
Suspicious use of WriteProcessMemory 46 IoCs
Processes:
1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exegwdepd.exedescription pid process target process PID 1992 wrote to memory of 1136 1992 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe taskhost.exe PID 1992 wrote to memory of 1240 1992 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe Dwm.exe PID 1992 wrote to memory of 1288 1992 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe Explorer.EXE PID 1992 wrote to memory of 1788 1992 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe gwdepd.exe PID 1992 wrote to memory of 1788 1992 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe gwdepd.exe PID 1992 wrote to memory of 1788 1992 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe gwdepd.exe PID 1992 wrote to memory of 1788 1992 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe gwdepd.exe PID 1788 wrote to memory of 1136 1788 gwdepd.exe taskhost.exe PID 1788 wrote to memory of 1240 1788 gwdepd.exe Dwm.exe PID 1788 wrote to memory of 1288 1788 gwdepd.exe Explorer.EXE PID 1788 wrote to memory of 1136 1788 gwdepd.exe taskhost.exe PID 1788 wrote to memory of 1240 1788 gwdepd.exe Dwm.exe PID 1788 wrote to memory of 1288 1788 gwdepd.exe Explorer.EXE PID 1788 wrote to memory of 1136 1788 gwdepd.exe taskhost.exe PID 1788 wrote to memory of 1240 1788 gwdepd.exe Dwm.exe PID 1788 wrote to memory of 1288 1788 gwdepd.exe Explorer.EXE PID 1788 wrote to memory of 1136 1788 gwdepd.exe taskhost.exe PID 1788 wrote to memory of 1240 1788 gwdepd.exe Dwm.exe PID 1788 wrote to memory of 1288 1788 gwdepd.exe Explorer.EXE PID 1788 wrote to memory of 1136 1788 gwdepd.exe taskhost.exe PID 1788 wrote to memory of 1240 1788 gwdepd.exe Dwm.exe PID 1788 wrote to memory of 1288 1788 gwdepd.exe Explorer.EXE PID 1788 wrote to memory of 1136 1788 gwdepd.exe taskhost.exe PID 1788 wrote to memory of 1240 1788 gwdepd.exe Dwm.exe PID 1788 wrote to memory of 1288 1788 gwdepd.exe Explorer.EXE PID 1788 wrote to memory of 1136 1788 gwdepd.exe taskhost.exe PID 1788 wrote to memory of 1240 1788 gwdepd.exe Dwm.exe PID 1788 wrote to memory of 1288 1788 gwdepd.exe Explorer.EXE PID 1788 wrote to memory of 1136 1788 gwdepd.exe taskhost.exe PID 1788 wrote to memory of 1240 1788 gwdepd.exe Dwm.exe PID 1788 wrote to memory of 1288 1788 gwdepd.exe Explorer.EXE PID 1788 wrote to memory of 1136 1788 gwdepd.exe taskhost.exe PID 1788 wrote to memory of 1240 1788 gwdepd.exe Dwm.exe PID 1788 wrote to memory of 1288 1788 gwdepd.exe Explorer.EXE PID 1788 wrote to memory of 1136 1788 gwdepd.exe taskhost.exe PID 1788 wrote to memory of 1240 1788 gwdepd.exe Dwm.exe PID 1788 wrote to memory of 1288 1788 gwdepd.exe Explorer.EXE PID 1788 wrote to memory of 1136 1788 gwdepd.exe taskhost.exe PID 1788 wrote to memory of 1240 1788 gwdepd.exe Dwm.exe PID 1788 wrote to memory of 1288 1788 gwdepd.exe Explorer.EXE PID 1788 wrote to memory of 1136 1788 gwdepd.exe taskhost.exe PID 1788 wrote to memory of 1240 1788 gwdepd.exe Dwm.exe PID 1788 wrote to memory of 1288 1788 gwdepd.exe Explorer.EXE PID 1788 wrote to memory of 1136 1788 gwdepd.exe taskhost.exe PID 1788 wrote to memory of 1240 1788 gwdepd.exe Dwm.exe PID 1788 wrote to memory of 1288 1788 gwdepd.exe Explorer.EXE -
System policy modification 1 TTPs 2 IoCs
Processes:
1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exegwdepd.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" gwdepd.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe"C:\Users\Admin\AppData\Local\Temp\1c1ccdc58e922bf5c8784cdb85100c1510ab406b3b170190cb202a7a0d0f05f9.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\ProgramData\gwdepd.exe"C:\ProgramData\gwdepd.exe"3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Deletes itself
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Saaaalamm\Mira.hFilesize
557KB
MD56f1656028d98fceaa83d9b6f8cc5459d
SHA17f2e990ad5347f6613683e7efa86f08ebfa9f4a6
SHA2562121af2516f030cebfd88efb6b6c195ecc4573cdbc79595253af54970a0a8a9a
SHA512cc0ede5bd411363d4f6a81e20521af15865decedbfb539702744f8cafc2087533a513f4a7541cb0eb3447411397cd042d00232e9d091a97e09043711379ce71e
-
C:\ProgramData\gwdepd.exeFilesize
522KB
MD525303ab694891ce4669f348c5319c39c
SHA1f475814ddd9472ee575d34c642892b7f00f51742
SHA2564408f8ce3e2607f0cddbe19e26b486b180100eb2ce32df8f423911e4f0d99969
SHA5124b9f56326428bd7981756756c0755351508b5b64945a7d2074cbfe68ea030a7bee28e76c0629ee56d7d80fe08ab3be61a0014411e42c144d95c2e62e69ade66b
-
C:\ProgramData\gwdepd.exeFilesize
522KB
MD525303ab694891ce4669f348c5319c39c
SHA1f475814ddd9472ee575d34c642892b7f00f51742
SHA2564408f8ce3e2607f0cddbe19e26b486b180100eb2ce32df8f423911e4f0d99969
SHA5124b9f56326428bd7981756756c0755351508b5b64945a7d2074cbfe68ea030a7bee28e76c0629ee56d7d80fe08ab3be61a0014411e42c144d95c2e62e69ade66b
-
C:\Windows\SYSTEM.INIFilesize
255B
MD52c6ad7e595aa20caaa366d6bef38c3dc
SHA1b8414554252d66c2dfe3a5b8613cfe4685c594ce
SHA2569523675f72dc03035ef811796bf1c247b9a3193d01bb8923785d42ea17a36085
SHA51274ebb05e7c501c5d4423faf94dc401dca8302d4c06c91aa2b15f45f36d99a0995402f4c8d5459b987b7de13bafe302c14ec957cb861109b6b30d8d878bbc7bb2
-
\ProgramData\gwdepd.exeFilesize
522KB
MD525303ab694891ce4669f348c5319c39c
SHA1f475814ddd9472ee575d34c642892b7f00f51742
SHA2564408f8ce3e2607f0cddbe19e26b486b180100eb2ce32df8f423911e4f0d99969
SHA5124b9f56326428bd7981756756c0755351508b5b64945a7d2074cbfe68ea030a7bee28e76c0629ee56d7d80fe08ab3be61a0014411e42c144d95c2e62e69ade66b
-
\ProgramData\gwdepd.exeFilesize
522KB
MD525303ab694891ce4669f348c5319c39c
SHA1f475814ddd9472ee575d34c642892b7f00f51742
SHA2564408f8ce3e2607f0cddbe19e26b486b180100eb2ce32df8f423911e4f0d99969
SHA5124b9f56326428bd7981756756c0755351508b5b64945a7d2074cbfe68ea030a7bee28e76c0629ee56d7d80fe08ab3be61a0014411e42c144d95c2e62e69ade66b
-
memory/1788-69-0x0000000001F30000-0x0000000002FBE000-memory.dmpFilesize
16.6MB
-
memory/1788-61-0x0000000000000000-mapping.dmp
-
memory/1788-75-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/1788-74-0x00000000004E0000-0x00000000004E2000-memory.dmpFilesize
8KB
-
memory/1788-73-0x0000000001F30000-0x0000000002FBE000-memory.dmpFilesize
16.6MB
-
memory/1788-66-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/1788-72-0x00000000004E0000-0x00000000004E2000-memory.dmpFilesize
8KB
-
memory/1788-71-0x0000000001F30000-0x0000000002FBE000-memory.dmpFilesize
16.6MB
-
memory/1992-64-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/1992-55-0x0000000001F70000-0x0000000002FFE000-memory.dmpFilesize
16.6MB
-
memory/1992-56-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/1992-57-0x0000000001F70000-0x0000000002FFE000-memory.dmpFilesize
16.6MB
-
memory/1992-65-0x0000000001F70000-0x0000000002FFE000-memory.dmpFilesize
16.6MB
-
memory/1992-54-0x0000000074E91000-0x0000000074E93000-memory.dmpFilesize
8KB
-
memory/1992-58-0x00000000030C0000-0x00000000030C2000-memory.dmpFilesize
8KB