Analysis
-
max time kernel
150s -
max time network
89s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
14-07-2022 06:40
Static task
static1
Behavioral task
behavioral1
Sample
4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe
Resource
win7-20220414-en
General
-
Target
4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe
-
Size
221KB
-
MD5
90af628b9c7875599eb32e093310c8b1
-
SHA1
56163f9470a0880b516a9347335bb61864301274
-
SHA256
4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664
-
SHA512
30292178bb237ceee8faf3b06250e28b95ee24d91bcf0f5d0509f38a04a87ac7bd609437fb41ca62ed1dadef1a08b0a029b8b3b85d7009239b622db7ffcb47b9
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
http://klkjwre77638dfqwieuoi888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
Processes:
4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe -
Processes:
4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe -
Processes:
4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe -
Disables Task Manager via registry modification
-
Processes:
resource yara_rule behavioral1/memory/848-55-0x0000000001D40000-0x0000000002DCE000-memory.dmp upx behavioral1/memory/848-57-0x0000000001D40000-0x0000000002DCE000-memory.dmp upx behavioral1/memory/848-61-0x0000000001D40000-0x0000000002DCE000-memory.dmp upx -
Processes:
4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe -
Processes:
4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe -
Drops file in Program Files directory 5 IoCs
Processes:
4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exedescription ioc process File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\BCSSYNC.EXE 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe -
Drops file in Windows directory 1 IoCs
Processes:
4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 27 IoCs
Processes:
4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 4c003100000000000000000010004c6f63616c00380008000400efbe00000000000000002a000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Set value (data) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = fe00310000000000000000001700343737316139623932343064373332613131613466323532343063656566363333613439656362383165643635303362343237363838643136663734303636340000ae0008000400efbe00000000000000002a000000000000000000000000000000000000000000000000003400370037003100610039006200390032003400300064003700330032006100310031006100340066003200350032003400300063006500650066003600330033006100340039006500630062003800310065006400360035003000330062003400320037003600380038006400310036006600370034003000360036003400000050000000 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_Classes\Local Settings 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Set value (data) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Set value (data) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Set value (data) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Set value (data) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Set value (data) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = ffffffff 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Set value (data) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4a0031000000000000000000100054656d700000360008000400efbe00000000000000002a00000000000000000000000000000000000000000000000000540065006d007000000014000000 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Set value (data) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Set value (data) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Set value (data) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 7e0074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f3c0008000400efbe00000000000000002a000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Set value (data) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Set value (int) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\NodeSlot = "1" 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Set value (data) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Set value (data) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exepid process 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
Processes:
4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exedescription pid process Token: SeDebugPrivilege 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Token: SeDebugPrivilege 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Token: SeDebugPrivilege 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Token: SeDebugPrivilege 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Token: SeDebugPrivilege 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Token: SeDebugPrivilege 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Token: SeDebugPrivilege 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Token: SeDebugPrivilege 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Token: SeDebugPrivilege 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Token: SeDebugPrivilege 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Token: SeDebugPrivilege 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Token: SeDebugPrivilege 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Token: SeDebugPrivilege 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Token: SeDebugPrivilege 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Token: SeDebugPrivilege 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Token: SeDebugPrivilege 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Token: SeDebugPrivilege 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Token: SeDebugPrivilege 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Token: SeDebugPrivilege 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe -
Suspicious use of WriteProcessMemory 42 IoCs
Processes:
4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exedescription pid process target process PID 848 wrote to memory of 1132 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe taskhost.exe PID 848 wrote to memory of 1252 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Dwm.exe PID 848 wrote to memory of 1312 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Explorer.EXE PID 848 wrote to memory of 1132 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe taskhost.exe PID 848 wrote to memory of 1252 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Dwm.exe PID 848 wrote to memory of 1312 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Explorer.EXE PID 848 wrote to memory of 1132 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe taskhost.exe PID 848 wrote to memory of 1252 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Dwm.exe PID 848 wrote to memory of 1312 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Explorer.EXE PID 848 wrote to memory of 1132 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe taskhost.exe PID 848 wrote to memory of 1252 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Dwm.exe PID 848 wrote to memory of 1312 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Explorer.EXE PID 848 wrote to memory of 1132 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe taskhost.exe PID 848 wrote to memory of 1252 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Dwm.exe PID 848 wrote to memory of 1312 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Explorer.EXE PID 848 wrote to memory of 1132 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe taskhost.exe PID 848 wrote to memory of 1252 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Dwm.exe PID 848 wrote to memory of 1312 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Explorer.EXE PID 848 wrote to memory of 1132 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe taskhost.exe PID 848 wrote to memory of 1252 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Dwm.exe PID 848 wrote to memory of 1312 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Explorer.EXE PID 848 wrote to memory of 1132 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe taskhost.exe PID 848 wrote to memory of 1252 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Dwm.exe PID 848 wrote to memory of 1312 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Explorer.EXE PID 848 wrote to memory of 1132 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe taskhost.exe PID 848 wrote to memory of 1252 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Dwm.exe PID 848 wrote to memory of 1312 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Explorer.EXE PID 848 wrote to memory of 1132 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe taskhost.exe PID 848 wrote to memory of 1252 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Dwm.exe PID 848 wrote to memory of 1312 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Explorer.EXE PID 848 wrote to memory of 1132 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe taskhost.exe PID 848 wrote to memory of 1252 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Dwm.exe PID 848 wrote to memory of 1312 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Explorer.EXE PID 848 wrote to memory of 1132 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe taskhost.exe PID 848 wrote to memory of 1252 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Dwm.exe PID 848 wrote to memory of 1312 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Explorer.EXE PID 848 wrote to memory of 1132 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe taskhost.exe PID 848 wrote to memory of 1252 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Dwm.exe PID 848 wrote to memory of 1312 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Explorer.EXE PID 848 wrote to memory of 1132 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe taskhost.exe PID 848 wrote to memory of 1252 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Dwm.exe PID 848 wrote to memory of 1312 848 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe Explorer.EXE -
System policy modification 1 TTPs 1 IoCs
Processes:
4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe"C:\Users\Admin\AppData\Local\Temp\4771a9b9240d732a11a4f25240ceef633a49ecb81ed6503b427688d16f740664.exe"2⤵
- Modifies firewall policy service
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/848-54-0x0000000075951000-0x0000000075953000-memory.dmpFilesize
8KB
-
memory/848-55-0x0000000001D40000-0x0000000002DCE000-memory.dmpFilesize
16.6MB
-
memory/848-56-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/848-57-0x0000000001D40000-0x0000000002DCE000-memory.dmpFilesize
16.6MB
-
memory/848-58-0x0000000000270000-0x0000000000272000-memory.dmpFilesize
8KB
-
memory/848-59-0x0000000074131000-0x0000000074133000-memory.dmpFilesize
8KB
-
memory/848-60-0x0000000003BB0000-0x0000000003BB2000-memory.dmpFilesize
8KB
-
memory/848-62-0x0000000000270000-0x0000000000272000-memory.dmpFilesize
8KB
-
memory/848-61-0x0000000001D40000-0x0000000002DCE000-memory.dmpFilesize
16.6MB
-
memory/848-63-0x0000000003BB0000-0x0000000003BB2000-memory.dmpFilesize
8KB