Analysis
-
max time kernel
150s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-06-2022 15:19
Static task
static1
Behavioral task
behavioral1
Sample
30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe
Resource
win7-20220414-en
General
-
Target
30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe
-
Size
124KB
-
MD5
4aaf75b56c518b82039bef2396941bdc
-
SHA1
fd53de3ac5b4cf593de2e9edad450efb145f20ac
-
SHA256
30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d
-
SHA512
3f708f09192d3279d0ca13fd7b4b1f70061bbf6973291f2b11d33c01621c38937c92b0b2f4834438db370be1d3d9e98e48feff76cab5e26af7460b7edac73fdb
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.execaycwq.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" caycwq.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" caycwq.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" caycwq.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe -
Processes:
30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.execaycwq.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" caycwq.exe -
Processes:
caycwq.exe30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" caycwq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" caycwq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" caycwq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc\UacDisableNotify = "1" caycwq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" caycwq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" caycwq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc\AntiVirusOverride = "1" caycwq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc\AntiVirusDisableNotify = "1" caycwq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" caycwq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc\FirewallOverride = "1" caycwq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc\UpdatesDisableNotify = "1" caycwq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc\FirewallDisableNotify = "1" caycwq.exe -
Executes dropped EXE 1 IoCs
Processes:
caycwq.exepid process 1592 caycwq.exe -
Processes:
resource yara_rule behavioral1/memory/1684-55-0x0000000002040000-0x00000000030CE000-memory.dmp upx behavioral1/memory/1684-60-0x0000000002040000-0x00000000030CE000-memory.dmp upx behavioral1/memory/1592-59-0x0000000000AE0000-0x0000000001B6E000-memory.dmp upx behavioral1/memory/1684-65-0x0000000002040000-0x00000000030CE000-memory.dmp upx behavioral1/memory/1592-68-0x0000000000AE0000-0x0000000001B6E000-memory.dmp upx -
Loads dropped DLL 1 IoCs
Processes:
caycwq.exepid process 1592 caycwq.exe -
Processes:
caycwq.exe30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" caycwq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" caycwq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" caycwq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc\AntiVirusDisableNotify = "1" caycwq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc caycwq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc\FirewallOverride = "1" caycwq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc\UpdatesDisableNotify = "1" caycwq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc\UacDisableNotify = "1" caycwq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" caycwq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" caycwq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" caycwq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc\AntiVirusOverride = "1" caycwq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc\FirewallDisableNotify = "1" caycwq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe -
Processes:
30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.execaycwq.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" caycwq.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
caycwq.exedescription ioc process File opened (read-only) \??\K: caycwq.exe File opened (read-only) \??\O: caycwq.exe File opened (read-only) \??\Q: caycwq.exe File opened (read-only) \??\T: caycwq.exe File opened (read-only) \??\V: caycwq.exe File opened (read-only) \??\M: caycwq.exe File opened (read-only) \??\N: caycwq.exe File opened (read-only) \??\R: caycwq.exe File opened (read-only) \??\S: caycwq.exe File opened (read-only) \??\U: caycwq.exe File opened (read-only) \??\E: caycwq.exe File opened (read-only) \??\H: caycwq.exe File opened (read-only) \??\J: caycwq.exe File opened (read-only) \??\P: caycwq.exe File opened (read-only) \??\W: caycwq.exe File opened (read-only) \??\Z: caycwq.exe File opened (read-only) \??\F: caycwq.exe File opened (read-only) \??\G: caycwq.exe File opened (read-only) \??\I: caycwq.exe File opened (read-only) \??\L: caycwq.exe File opened (read-only) \??\X: caycwq.exe File opened (read-only) \??\Y: caycwq.exe -
Drops file in System32 directory 3 IoCs
Processes:
30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.execaycwq.exedescription ioc process File created C:\Windows\SysWOW64\caycwq.exe 30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe File opened for modification C:\Windows\SysWOW64\caycwq.exe 30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe File created C:\Windows\SysWOW64\gei33.dll caycwq.exe -
Drops file in Program Files directory 7 IoCs
Processes:
caycwq.exedescription ioc process File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe caycwq.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe caycwq.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe caycwq.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe caycwq.exe File created C:\Program Files\7-Zip\lpk.dll caycwq.exe File opened for modification C:\Program Files\7-Zip\lpk.dll caycwq.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe caycwq.exe -
Drops file in Windows directory 1 IoCs
Processes:
30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI 30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe -
Modifies data under HKEY_USERS 28 IoCs
Processes:
caycwq.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Aoqcbk\S3_3 = "4260979152" caycwq.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\GlobalUserOffline = "0" caycwq.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Aoqcbk\S1_0 = "3299283285" caycwq.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Aoqcbk\S4_2 = "2829496998" caycwq.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Aoqcbk\S1_3 = "2577324613" caycwq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\1460008425 caycwq.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Aoqcbk\S1_1 = "2139237134" caycwq.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Aoqcbk\S2_2 = "2829494469" caycwq.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Aoqcbk\S3_1 = "1431319418" caycwq.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Aoqcbk\S3_0 = "17001001" caycwq.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Aoqcbk\S4_0 = "0" caycwq.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Aoqcbk\1460008425\-101443598 = "0700687474703A2F2F6A7374686F6D65732E636F6D2F696D616765732F6C6F676F2E67696600687474703A2F2F61646979616D616E6C696369676B6F66746563696D2E636F6D2F696D616765732F6C6F676F2E67696600687474703A2F2F616B6F72646B6574727A796E2E7567752E706C2F6C6F676F2E67696600687474703A2F2F616B6361696E736161742E636F6D2F696D672F6C6F676F2E67696600687474703A2F2F616B646172692E636F6D2F696D616765732F6C6F676F2E67696600687474703A2F2F616C736861727170617065722E6E65742F6C6F676F2E67696600687474703A2F2F61706164616E617075622E636F6D2F6C6F676F2E676966" caycwq.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Aoqcbk\S4_3 = "4244245497" caycwq.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Aoqcbk caycwq.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Aoqcbk\1460008425\1414748499 = "155" caycwq.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Aoqcbk\1460008425\1364026700 = "35" caycwq.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Aoqcbk\1460008425\-1516192097 = "256" caycwq.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Aoqcbk\S2_0 = "9832" caycwq.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Aoqcbk\S1_2 = "1359675385" caycwq.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Aoqcbk\S3_2 = "2846218383" caycwq.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Aoqcbk\1460008425 caycwq.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Aoqcbk\1460008425\-1465470298 = "0" caycwq.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Aoqcbk\1460008425\-50721799 = "0" caycwq.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Aoqcbk\1460008425\1313304901 = "4B0C1ACCFEF76671CC19B2472947B89ADBC1B3E1DD905C5AB2843C3A84EDCF6F17A4547E0E9250886096036CFAC3A46EE12558210578AE55D6C0F02593FED47E0CC870C0A0F906762622E4855C635CC4EF7D18DBDAC4B2A8E728A18980F31AA51B9984A39616D681334370FCD3CA6786870A5E9E662CFE328DB70D6B0182B0BE" caycwq.exe Key created \REGISTRY\USER\.DEFAULT\Software caycwq.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Aoqcbk\S2_1 = "1414745114" caycwq.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Aoqcbk\S4_1 = "1414748499" caycwq.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Aoqcbk\S2_3 = "4244248541" caycwq.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.execaycwq.exepid process 1684 30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe 1592 caycwq.exe 1592 caycwq.exe 1592 caycwq.exe 1592 caycwq.exe 1592 caycwq.exe 1592 caycwq.exe 1592 caycwq.exe 1592 caycwq.exe 1592 caycwq.exe 1592 caycwq.exe 1592 caycwq.exe 1592 caycwq.exe 1592 caycwq.exe 1592 caycwq.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exepid process 1684 30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe -
Suspicious use of AdjustPrivilegeToken 20 IoCs
Processes:
30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exedescription pid process Token: SeDebugPrivilege 1684 30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe Token: SeDebugPrivilege 1684 30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe Token: SeDebugPrivilege 1684 30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe Token: SeDebugPrivilege 1684 30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe Token: SeDebugPrivilege 1684 30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe Token: SeDebugPrivilege 1684 30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe Token: SeDebugPrivilege 1684 30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe Token: SeDebugPrivilege 1684 30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe Token: SeDebugPrivilege 1684 30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe Token: SeDebugPrivilege 1684 30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe Token: SeDebugPrivilege 1684 30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe Token: SeDebugPrivilege 1684 30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe Token: SeDebugPrivilege 1684 30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe Token: SeDebugPrivilege 1684 30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe Token: SeDebugPrivilege 1684 30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe Token: SeDebugPrivilege 1684 30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe Token: SeDebugPrivilege 1684 30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe Token: SeDebugPrivilege 1684 30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe Token: SeDebugPrivilege 1684 30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe Token: SeDebugPrivilege 1684 30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe -
Suspicious use of WriteProcessMemory 46 IoCs
Processes:
30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.execaycwq.exedescription pid process target process PID 1684 wrote to memory of 1148 1684 30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe taskhost.exe PID 1684 wrote to memory of 1248 1684 30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe Dwm.exe PID 1684 wrote to memory of 1292 1684 30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe Explorer.EXE PID 1592 wrote to memory of 1148 1592 caycwq.exe taskhost.exe PID 1592 wrote to memory of 1248 1592 caycwq.exe Dwm.exe PID 1592 wrote to memory of 1292 1592 caycwq.exe Explorer.EXE PID 1592 wrote to memory of 1684 1592 caycwq.exe 30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe PID 1592 wrote to memory of 1148 1592 caycwq.exe taskhost.exe PID 1592 wrote to memory of 1248 1592 caycwq.exe Dwm.exe PID 1592 wrote to memory of 1292 1592 caycwq.exe Explorer.EXE PID 1592 wrote to memory of 1148 1592 caycwq.exe taskhost.exe PID 1592 wrote to memory of 1248 1592 caycwq.exe Dwm.exe PID 1592 wrote to memory of 1292 1592 caycwq.exe Explorer.EXE PID 1592 wrote to memory of 1148 1592 caycwq.exe taskhost.exe PID 1592 wrote to memory of 1248 1592 caycwq.exe Dwm.exe PID 1592 wrote to memory of 1292 1592 caycwq.exe Explorer.EXE PID 1592 wrote to memory of 1148 1592 caycwq.exe taskhost.exe PID 1592 wrote to memory of 1248 1592 caycwq.exe Dwm.exe PID 1592 wrote to memory of 1292 1592 caycwq.exe Explorer.EXE PID 1592 wrote to memory of 1148 1592 caycwq.exe taskhost.exe PID 1592 wrote to memory of 1248 1592 caycwq.exe Dwm.exe PID 1592 wrote to memory of 1292 1592 caycwq.exe Explorer.EXE PID 1592 wrote to memory of 1148 1592 caycwq.exe taskhost.exe PID 1592 wrote to memory of 1248 1592 caycwq.exe Dwm.exe PID 1592 wrote to memory of 1292 1592 caycwq.exe Explorer.EXE PID 1592 wrote to memory of 1148 1592 caycwq.exe taskhost.exe PID 1592 wrote to memory of 1248 1592 caycwq.exe Dwm.exe PID 1592 wrote to memory of 1292 1592 caycwq.exe Explorer.EXE PID 1592 wrote to memory of 1148 1592 caycwq.exe taskhost.exe PID 1592 wrote to memory of 1248 1592 caycwq.exe Dwm.exe PID 1592 wrote to memory of 1292 1592 caycwq.exe Explorer.EXE PID 1592 wrote to memory of 1148 1592 caycwq.exe taskhost.exe PID 1592 wrote to memory of 1248 1592 caycwq.exe Dwm.exe PID 1592 wrote to memory of 1292 1592 caycwq.exe Explorer.EXE PID 1592 wrote to memory of 1148 1592 caycwq.exe taskhost.exe PID 1592 wrote to memory of 1248 1592 caycwq.exe Dwm.exe PID 1592 wrote to memory of 1292 1592 caycwq.exe Explorer.EXE PID 1592 wrote to memory of 1148 1592 caycwq.exe taskhost.exe PID 1592 wrote to memory of 1248 1592 caycwq.exe Dwm.exe PID 1592 wrote to memory of 1292 1592 caycwq.exe Explorer.EXE PID 1592 wrote to memory of 1148 1592 caycwq.exe taskhost.exe PID 1592 wrote to memory of 1248 1592 caycwq.exe Dwm.exe PID 1592 wrote to memory of 1292 1592 caycwq.exe Explorer.EXE PID 1592 wrote to memory of 1148 1592 caycwq.exe taskhost.exe PID 1592 wrote to memory of 1248 1592 caycwq.exe Dwm.exe PID 1592 wrote to memory of 1292 1592 caycwq.exe Explorer.EXE -
System policy modification 1 TTPs 2 IoCs
Processes:
30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.execaycwq.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" caycwq.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe"C:\Users\Admin\AppData\Local\Temp\30509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\SysWOW64\caycwq.exeC:\Windows\SysWOW64\caycwq.exe1⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SYSTEM.INIFilesize
254B
MD59ae0bfa97c36000ce465dbdef354b2b4
SHA1a370f791c4183669dca22fb3fa89a276e21a221b
SHA2566ec8ae90725d31b956d0fa460ff2e73d415f827d1a57151635f42d7575aed90c
SHA512a3fb17ba456b6268ca8c518a8f63f7189e8f2937a2be42a79aab9ab6def1a14e687efc4f67c689aad6b03709a5660ffa8e8dd715cc853a167b1b23140126ab4f
-
C:\Windows\SysWOW64\caycwq.exeFilesize
124KB
MD54aaf75b56c518b82039bef2396941bdc
SHA1fd53de3ac5b4cf593de2e9edad450efb145f20ac
SHA25630509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d
SHA5123f708f09192d3279d0ca13fd7b4b1f70061bbf6973291f2b11d33c01621c38937c92b0b2f4834438db370be1d3d9e98e48feff76cab5e26af7460b7edac73fdb
-
C:\Windows\SysWOW64\caycwq.exeFilesize
124KB
MD54aaf75b56c518b82039bef2396941bdc
SHA1fd53de3ac5b4cf593de2e9edad450efb145f20ac
SHA25630509b309eab2e55e4ca7c62f3f129eb82fa428aa7891d2ddfb6a7ba852fe78d
SHA5123f708f09192d3279d0ca13fd7b4b1f70061bbf6973291f2b11d33c01621c38937c92b0b2f4834438db370be1d3d9e98e48feff76cab5e26af7460b7edac73fdb
-
\Windows\SysWOW64\gei33.dllFilesize
134KB
MD50126196eb29bba67faa5f3e2fbff6cf7
SHA1e6ccbfd4e2fab4a80855c641844ea45145278146
SHA2568bc50d8964d5ac502128a8e800162d96e1a7f76a6594d4672478d24a8fedfb89
SHA512c4e25c82948c6719458a8b239063e34f5e5843a05ff654a27f345194ed16d821e97d5df0ba2200db51261edb3c70d860588af5ebb23d626fb581603c19af01bd
-
memory/1592-59-0x0000000000AE0000-0x0000000001B6E000-memory.dmpFilesize
16.6MB
-
memory/1592-63-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/1592-68-0x0000000000AE0000-0x0000000001B6E000-memory.dmpFilesize
16.6MB
-
memory/1592-69-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/1684-61-0x00000000003F0000-0x00000000003F2000-memory.dmpFilesize
8KB
-
memory/1684-54-0x00000000752D1000-0x00000000752D3000-memory.dmpFilesize
8KB
-
memory/1684-60-0x0000000002040000-0x00000000030CE000-memory.dmpFilesize
16.6MB
-
memory/1684-64-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/1684-65-0x0000000002040000-0x00000000030CE000-memory.dmpFilesize
16.6MB
-
memory/1684-56-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/1684-55-0x0000000002040000-0x00000000030CE000-memory.dmpFilesize
16.6MB