Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
08-06-2022 18:27
Static task
static1
Behavioral task
behavioral1
Sample
d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe
Resource
win10v2004-20220414-en
General
-
Target
d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe
-
Size
5.9MB
-
MD5
181d846f67268e7f3c9184682404886b
-
SHA1
448baf53c5dc5fc76f42e7ee6f3fde7e7c099539
-
SHA256
d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8
-
SHA512
09cf1a1c780ae07990fc8118a89358bb4cf3b9b6d3d15e98133f96d53056c69a22b0cd69b5fe9e7afdda675dce9b1f1a384ad1f1a5564b2175cd53770510de0b
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sychost.exe" d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe -
Processes:
d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe -
Processes:
d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe -
Modifies Installed Components in the registry 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Processes:
resource yara_rule behavioral1/memory/1376-55-0x0000000001F00000-0x0000000002F8E000-memory.dmp upx behavioral1/memory/1376-70-0x0000000001F00000-0x0000000002F8E000-memory.dmp upx -
Processes:
d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinIcons = "C:\\Windows\\system32\\winicons.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe -
Processes:
d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe -
Drops file in System32 directory 3 IoCs
Processes:
d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exedescription ioc process File opened for modification C:\Windows\SysWOW64\winicons.exe d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File created C:\Windows\SysWOW64\sychost.exe d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File created C:\Windows\SysWOW64\winicons.exe d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exedescription pid process target process PID 1376 set thread context of 1324 1376 d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe -
Drops file in Program Files directory 58 IoCs
Processes:
d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exedescription ioc process File opened for modification C:\Program Files\7-Zip\Lang\he.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\mk.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\hi.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\7z.exe d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\History.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\hy.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\fr.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\hu.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\lv.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\mng.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\ja.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\ky.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\lt.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\7zG.exe d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe -
Drops file in Windows directory 2 IoCs
Processes:
d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exeexplorer.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\sc_reader.exe explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 5 IoCs
Processes:
explorer.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exed39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exepid process 1376 d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe 1376 d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe 1324 d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe 1324 d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe 1324 d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe 1324 d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 672 explorer.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
Processes:
d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exeexplorer.exeAUDIODG.EXEdescription pid process Token: SeDebugPrivilege 1376 d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe Token: SeDebugPrivilege 1376 d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe Token: SeDebugPrivilege 1376 d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe Token: SeDebugPrivilege 1376 d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe Token: SeDebugPrivilege 1376 d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe Token: SeDebugPrivilege 1376 d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe Token: SeDebugPrivilege 1376 d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe Token: SeDebugPrivilege 1376 d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe Token: SeDebugPrivilege 1376 d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe Token: SeDebugPrivilege 1376 d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe Token: SeDebugPrivilege 1376 d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe Token: SeDebugPrivilege 1376 d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe Token: SeDebugPrivilege 1376 d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe Token: SeDebugPrivilege 1376 d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe Token: SeDebugPrivilege 1376 d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe Token: SeDebugPrivilege 1376 d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe Token: SeDebugPrivilege 1376 d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe Token: SeDebugPrivilege 1376 d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe Token: SeDebugPrivilege 1376 d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe Token: SeDebugPrivilege 1376 d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe Token: SeDebugPrivilege 1376 d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe Token: SeShutdownPrivilege 672 explorer.exe Token: SeShutdownPrivilege 672 explorer.exe Token: SeShutdownPrivilege 672 explorer.exe Token: SeShutdownPrivilege 672 explorer.exe Token: SeShutdownPrivilege 672 explorer.exe Token: SeShutdownPrivilege 672 explorer.exe Token: SeShutdownPrivilege 672 explorer.exe Token: SeShutdownPrivilege 672 explorer.exe Token: SeShutdownPrivilege 672 explorer.exe Token: SeShutdownPrivilege 672 explorer.exe Token: 33 1264 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1264 AUDIODG.EXE Token: 33 1264 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1264 AUDIODG.EXE Token: SeShutdownPrivilege 672 explorer.exe Token: SeShutdownPrivilege 672 explorer.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
explorer.exepid process 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe -
Suspicious use of SendNotifyMessage 17 IoCs
Processes:
explorer.exepid process 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exed39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.execmd.exedescription pid process target process PID 1376 wrote to memory of 1108 1376 d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe taskhost.exe PID 1376 wrote to memory of 1164 1376 d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe Dwm.exe PID 1376 wrote to memory of 1200 1376 d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe Explorer.EXE PID 1376 wrote to memory of 1324 1376 d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe PID 1376 wrote to memory of 1324 1376 d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe PID 1376 wrote to memory of 1324 1376 d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe PID 1376 wrote to memory of 1324 1376 d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe PID 1376 wrote to memory of 1324 1376 d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe PID 1376 wrote to memory of 1324 1376 d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe PID 1376 wrote to memory of 1324 1376 d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe PID 1376 wrote to memory of 1324 1376 d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe PID 1376 wrote to memory of 1324 1376 d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe PID 1376 wrote to memory of 1324 1376 d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe PID 1376 wrote to memory of 1324 1376 d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe PID 1324 wrote to memory of 1408 1324 d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe cmd.exe PID 1324 wrote to memory of 1408 1324 d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe cmd.exe PID 1324 wrote to memory of 1408 1324 d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe cmd.exe PID 1324 wrote to memory of 1408 1324 d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe cmd.exe PID 1408 wrote to memory of 1808 1408 cmd.exe reg.exe PID 1408 wrote to memory of 1808 1408 cmd.exe reg.exe PID 1408 wrote to memory of 1808 1408 cmd.exe reg.exe PID 1408 wrote to memory of 1808 1408 cmd.exe reg.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1108
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe"C:\Users\Admin\AppData\Local\Temp\d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exeC:\Users\Admin\AppData\Local\Temp\d39103237fc30b649676191adc04c4289a5254a769119fa477644aa90b4651f8.exe3⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1324
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1164
-
C:\Windows\SysWOW64\cmd.execmd /c reg ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v WinIcons /t REG_SZ /d C:\Windows\system32\winicons.exe /f1⤵
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Windows\SysWOW64\reg.exereg ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v WinIcons /t REG_SZ /d C:\Windows\system32\winicons.exe /f2⤵
- Adds Run key to start application
PID:1808
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:672
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5701⤵
- Suspicious use of AdjustPrivilegeToken
PID:1264
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/672-74-0x000007FEFBA71000-0x000007FEFBA73000-memory.dmpFilesize
8KB
-
memory/1324-69-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1324-75-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1324-71-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1324-62-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1324-61-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1324-63-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1324-66-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1324-65-0x000000000040AA18-mapping.dmp
-
memory/1324-56-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1324-57-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1324-64-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1324-59-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1324-60-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1376-70-0x0000000001F00000-0x0000000002F8E000-memory.dmpFilesize
16.6MB
-
memory/1376-67-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1376-55-0x0000000001F00000-0x0000000002F8E000-memory.dmpFilesize
16.6MB
-
memory/1376-54-0x0000000075361000-0x0000000075363000-memory.dmpFilesize
8KB
-
memory/1408-72-0x0000000000000000-mapping.dmp
-
memory/1808-73-0x0000000000000000-mapping.dmp