Analysis
-
max time kernel
189s -
max time network
212s -
platform
windows7_x64 -
resource
win7-20220414-en -
resource tags
arch:x64arch:x86image:win7-20220414-enlocale:en-usos:windows7-x64system -
submitted
17-07-2022 00:31
Static task
static1
Behavioral task
behavioral1
Sample
533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe
Resource
win7-20220414-en
General
-
Target
533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe
-
Size
1.1MB
-
MD5
d6a7b0a231c4e4bd8d1638abf43292e0
-
SHA1
8a6fd2338ae5e0b28c3de639682e4bfa9f8bab1a
-
SHA256
533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c
-
SHA512
1da3528b239c22ea7605e430505686773a7c2cd449b5833fc90657da62ee51b144a0262238c582ada3fda2d1d1f92a70a6391d2c24b904b0decff3cd5a0781be
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
http://klkjwre77638dfqwieuoi888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exenrutm.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" nrutm.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" nrutm.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" nrutm.exe -
Processes:
533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exenrutm.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" nrutm.exe -
Processes:
533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exenrutm.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" nrutm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" nrutm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" nrutm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" nrutm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" nrutm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" nrutm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe -
Disables RegEdit via registry modification 2 IoCs
Processes:
533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exenrutm.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" nrutm.exe -
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
Processes:
nrutm.exepid process 268 nrutm.exe -
Processes:
resource yara_rule behavioral1/memory/1784-55-0x0000000002140000-0x00000000031CE000-memory.dmp upx behavioral1/memory/1784-57-0x0000000002140000-0x00000000031CE000-memory.dmp upx behavioral1/memory/1784-64-0x0000000002140000-0x00000000031CE000-memory.dmp upx behavioral1/memory/268-68-0x0000000001F20000-0x0000000002FAE000-memory.dmp upx behavioral1/memory/268-70-0x0000000001F20000-0x0000000002FAE000-memory.dmp upx behavioral1/memory/268-72-0x0000000001F20000-0x0000000002FAE000-memory.dmp upx -
Deletes itself 1 IoCs
Processes:
nrutm.exepid process 268 nrutm.exe -
Loads dropped DLL 2 IoCs
Processes:
533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exepid process 1784 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe 1784 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe -
Processes:
nrutm.exe533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" nrutm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" nrutm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" nrutm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" nrutm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc nrutm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" nrutm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" nrutm.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
nrutm.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\nrutm.exe" nrutm.exe -
Processes:
533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exenrutm.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" nrutm.exe -
Drops file in Program Files directory 1 IoCs
Processes:
nrutm.exedescription ioc process File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\BCSSYNC.EXE nrutm.exe -
Drops file in Windows directory 1 IoCs
Processes:
533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exenrutm.exepid process 1784 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe 268 nrutm.exe 268 nrutm.exe 268 nrutm.exe 268 nrutm.exe 268 nrutm.exe 268 nrutm.exe 268 nrutm.exe 268 nrutm.exe 268 nrutm.exe 268 nrutm.exe 268 nrutm.exe 268 nrutm.exe 268 nrutm.exe -
Suspicious use of AdjustPrivilegeToken 42 IoCs
Processes:
533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exenrutm.exedescription pid process Token: SeDebugPrivilege 1784 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 1784 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 1784 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 1784 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 1784 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 1784 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 1784 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 1784 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 1784 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 1784 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 1784 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 1784 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 1784 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 1784 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 1784 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 1784 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 1784 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 1784 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 1784 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 1784 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 1784 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 268 nrutm.exe Token: SeDebugPrivilege 268 nrutm.exe Token: SeDebugPrivilege 268 nrutm.exe Token: SeDebugPrivilege 268 nrutm.exe Token: SeDebugPrivilege 268 nrutm.exe Token: SeDebugPrivilege 268 nrutm.exe Token: SeDebugPrivilege 268 nrutm.exe Token: SeDebugPrivilege 268 nrutm.exe Token: SeDebugPrivilege 268 nrutm.exe Token: SeDebugPrivilege 268 nrutm.exe Token: SeDebugPrivilege 268 nrutm.exe Token: SeDebugPrivilege 268 nrutm.exe Token: SeDebugPrivilege 268 nrutm.exe Token: SeDebugPrivilege 268 nrutm.exe Token: SeDebugPrivilege 268 nrutm.exe Token: SeDebugPrivilege 268 nrutm.exe Token: SeDebugPrivilege 268 nrutm.exe Token: SeDebugPrivilege 268 nrutm.exe Token: SeDebugPrivilege 268 nrutm.exe Token: SeDebugPrivilege 268 nrutm.exe Token: SeDebugPrivilege 268 nrutm.exe -
Suspicious use of WriteProcessMemory 46 IoCs
Processes:
533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exenrutm.exedescription pid process target process PID 1784 wrote to memory of 1132 1784 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe taskhost.exe PID 1784 wrote to memory of 1216 1784 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Dwm.exe PID 1784 wrote to memory of 1268 1784 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Explorer.EXE PID 1784 wrote to memory of 268 1784 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe nrutm.exe PID 1784 wrote to memory of 268 1784 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe nrutm.exe PID 1784 wrote to memory of 268 1784 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe nrutm.exe PID 1784 wrote to memory of 268 1784 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe nrutm.exe PID 268 wrote to memory of 1132 268 nrutm.exe taskhost.exe PID 268 wrote to memory of 1216 268 nrutm.exe Dwm.exe PID 268 wrote to memory of 1268 268 nrutm.exe Explorer.EXE PID 268 wrote to memory of 1132 268 nrutm.exe taskhost.exe PID 268 wrote to memory of 1216 268 nrutm.exe Dwm.exe PID 268 wrote to memory of 1268 268 nrutm.exe Explorer.EXE PID 268 wrote to memory of 1132 268 nrutm.exe taskhost.exe PID 268 wrote to memory of 1216 268 nrutm.exe Dwm.exe PID 268 wrote to memory of 1268 268 nrutm.exe Explorer.EXE PID 268 wrote to memory of 1132 268 nrutm.exe taskhost.exe PID 268 wrote to memory of 1216 268 nrutm.exe Dwm.exe PID 268 wrote to memory of 1268 268 nrutm.exe Explorer.EXE PID 268 wrote to memory of 1132 268 nrutm.exe taskhost.exe PID 268 wrote to memory of 1216 268 nrutm.exe Dwm.exe PID 268 wrote to memory of 1268 268 nrutm.exe Explorer.EXE PID 268 wrote to memory of 1132 268 nrutm.exe taskhost.exe PID 268 wrote to memory of 1216 268 nrutm.exe Dwm.exe PID 268 wrote to memory of 1268 268 nrutm.exe Explorer.EXE PID 268 wrote to memory of 1132 268 nrutm.exe taskhost.exe PID 268 wrote to memory of 1216 268 nrutm.exe Dwm.exe PID 268 wrote to memory of 1268 268 nrutm.exe Explorer.EXE PID 268 wrote to memory of 1132 268 nrutm.exe taskhost.exe PID 268 wrote to memory of 1216 268 nrutm.exe Dwm.exe PID 268 wrote to memory of 1268 268 nrutm.exe Explorer.EXE PID 268 wrote to memory of 1132 268 nrutm.exe taskhost.exe PID 268 wrote to memory of 1216 268 nrutm.exe Dwm.exe PID 268 wrote to memory of 1268 268 nrutm.exe Explorer.EXE PID 268 wrote to memory of 1132 268 nrutm.exe taskhost.exe PID 268 wrote to memory of 1216 268 nrutm.exe Dwm.exe PID 268 wrote to memory of 1268 268 nrutm.exe Explorer.EXE PID 268 wrote to memory of 1132 268 nrutm.exe taskhost.exe PID 268 wrote to memory of 1216 268 nrutm.exe Dwm.exe PID 268 wrote to memory of 1268 268 nrutm.exe Explorer.EXE PID 268 wrote to memory of 1132 268 nrutm.exe taskhost.exe PID 268 wrote to memory of 1216 268 nrutm.exe Dwm.exe PID 268 wrote to memory of 1268 268 nrutm.exe Explorer.EXE PID 268 wrote to memory of 1132 268 nrutm.exe taskhost.exe PID 268 wrote to memory of 1216 268 nrutm.exe Dwm.exe PID 268 wrote to memory of 1268 268 nrutm.exe Explorer.EXE -
System policy modification 1 TTPs 2 IoCs
Processes:
533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exenrutm.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" nrutm.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe"C:\Users\Admin\AppData\Local\Temp\533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\ProgramData\nrutm.exe"C:\ProgramData\nrutm.exe"3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Deletes itself
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Saaaalamm\Mira.hFilesize
557KB
MD56f1656028d98fceaa83d9b6f8cc5459d
SHA17f2e990ad5347f6613683e7efa86f08ebfa9f4a6
SHA2562121af2516f030cebfd88efb6b6c195ecc4573cdbc79595253af54970a0a8a9a
SHA512cc0ede5bd411363d4f6a81e20521af15865decedbfb539702744f8cafc2087533a513f4a7541cb0eb3447411397cd042d00232e9d091a97e09043711379ce71e
-
C:\ProgramData\nrutm.exeFilesize
522KB
MD54449fa356c6aa705f92ea8353a6037d0
SHA1dbddc21bb9ee79d669fa742c25e3ed803ebde385
SHA25614351384e3fe382c530a05327868e531ef1de27470160e5afc7921d0eaa1d7f7
SHA512e57146852c1ad5596ecdd094c37fd7ed0da5b76d724d9a2d9b7848dfb94fc7fa6c0c57bff39183500cfecdbe84ddfb09b9d16a19099a0be2efc09ea4991b027c
-
C:\ProgramData\nrutm.exeFilesize
522KB
MD54449fa356c6aa705f92ea8353a6037d0
SHA1dbddc21bb9ee79d669fa742c25e3ed803ebde385
SHA25614351384e3fe382c530a05327868e531ef1de27470160e5afc7921d0eaa1d7f7
SHA512e57146852c1ad5596ecdd094c37fd7ed0da5b76d724d9a2d9b7848dfb94fc7fa6c0c57bff39183500cfecdbe84ddfb09b9d16a19099a0be2efc09ea4991b027c
-
C:\Windows\SYSTEM.INIFilesize
255B
MD5449f6bf71162cbe9f4f0437b719ea480
SHA16af88653f9df714353ee52f1333fbe72eb6c1d69
SHA256c47429d061275aa66c1fccd14e7a68e1df4487c2be081bad640d756e2b69a207
SHA512e87b8c9f87f1c5e506d40e7c25c1b68745348a1bdaf95f29368e8b038d5f719ce730ced9e0a55d9f8094a5f426702d1dd1b0cbf88acfe497603068147113b0f3
-
\ProgramData\nrutm.exeFilesize
522KB
MD54449fa356c6aa705f92ea8353a6037d0
SHA1dbddc21bb9ee79d669fa742c25e3ed803ebde385
SHA25614351384e3fe382c530a05327868e531ef1de27470160e5afc7921d0eaa1d7f7
SHA512e57146852c1ad5596ecdd094c37fd7ed0da5b76d724d9a2d9b7848dfb94fc7fa6c0c57bff39183500cfecdbe84ddfb09b9d16a19099a0be2efc09ea4991b027c
-
\ProgramData\nrutm.exeFilesize
522KB
MD54449fa356c6aa705f92ea8353a6037d0
SHA1dbddc21bb9ee79d669fa742c25e3ed803ebde385
SHA25614351384e3fe382c530a05327868e531ef1de27470160e5afc7921d0eaa1d7f7
SHA512e57146852c1ad5596ecdd094c37fd7ed0da5b76d724d9a2d9b7848dfb94fc7fa6c0c57bff39183500cfecdbe84ddfb09b9d16a19099a0be2efc09ea4991b027c
-
memory/268-65-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/268-71-0x00000000004E0000-0x00000000004E2000-memory.dmpFilesize
8KB
-
memory/268-74-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/268-73-0x00000000004E0000-0x00000000004E2000-memory.dmpFilesize
8KB
-
memory/268-72-0x0000000001F20000-0x0000000002FAE000-memory.dmpFilesize
16.6MB
-
memory/268-60-0x0000000000000000-mapping.dmp
-
memory/268-70-0x0000000001F20000-0x0000000002FAE000-memory.dmpFilesize
16.6MB
-
memory/268-68-0x0000000001F20000-0x0000000002FAE000-memory.dmpFilesize
16.6MB
-
memory/1784-55-0x0000000002140000-0x00000000031CE000-memory.dmpFilesize
16.6MB
-
memory/1784-56-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/1784-57-0x0000000002140000-0x00000000031CE000-memory.dmpFilesize
16.6MB
-
memory/1784-54-0x00000000769D1000-0x00000000769D3000-memory.dmpFilesize
8KB
-
memory/1784-64-0x0000000002140000-0x00000000031CE000-memory.dmpFilesize
16.6MB
-
memory/1784-63-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB