Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
resource tags
arch:x64arch:x86image:win10v2004-20220414-enlocale:en-usos:windows10-2004-x64system -
submitted
17-07-2022 00:31
Static task
static1
Behavioral task
behavioral1
Sample
533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe
Resource
win7-20220414-en
General
-
Target
533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe
-
Size
1.1MB
-
MD5
d6a7b0a231c4e4bd8d1638abf43292e0
-
SHA1
8a6fd2338ae5e0b28c3de639682e4bfa9f8bab1a
-
SHA256
533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c
-
SHA512
1da3528b239c22ea7605e430505686773a7c2cd449b5833fc90657da62ee51b144a0262238c582ada3fda2d1d1f92a70a6391d2c24b904b0decff3cd5a0781be
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
http://klkjwre77638dfqwieuoi888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exefwynor.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" fwynor.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" fwynor.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" fwynor.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe -
Processes:
533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exefwynor.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" fwynor.exe -
Processes:
533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exefwynor.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" fwynor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" fwynor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" fwynor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" fwynor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" fwynor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" fwynor.exe -
Disables RegEdit via registry modification 2 IoCs
Processes:
533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exefwynor.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" fwynor.exe -
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
Processes:
fwynor.exepid process 2700 fwynor.exe -
Processes:
resource yara_rule behavioral2/memory/4740-131-0x0000000002810000-0x000000000389E000-memory.dmp upx behavioral2/memory/4740-135-0x0000000002810000-0x000000000389E000-memory.dmp upx behavioral2/memory/4740-138-0x0000000002810000-0x000000000389E000-memory.dmp upx behavioral2/memory/2700-140-0x0000000002700000-0x000000000378E000-memory.dmp upx behavioral2/memory/2700-142-0x0000000002700000-0x000000000378E000-memory.dmp upx behavioral2/memory/2700-143-0x0000000002700000-0x000000000378E000-memory.dmp upx -
Processes:
fwynor.exe533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" fwynor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" fwynor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" fwynor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" fwynor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" fwynor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" fwynor.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc fwynor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
fwynor.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\fwynor.exe" fwynor.exe -
Processes:
533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exefwynor.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" fwynor.exe -
Drops file in Program Files directory 11 IoCs
Processes:
fwynor.exedescription ioc process File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe fwynor.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe fwynor.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe fwynor.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe fwynor.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe fwynor.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe fwynor.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe fwynor.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe fwynor.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe fwynor.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe fwynor.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe fwynor.exe -
Drops file in Windows directory 1 IoCs
Processes:
533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exefwynor.exepid process 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe 2700 fwynor.exe 2700 fwynor.exe 2700 fwynor.exe 2700 fwynor.exe 2700 fwynor.exe 2700 fwynor.exe 2700 fwynor.exe 2700 fwynor.exe 2700 fwynor.exe 2700 fwynor.exe 2700 fwynor.exe 2700 fwynor.exe 2700 fwynor.exe 2700 fwynor.exe 2700 fwynor.exe 2700 fwynor.exe 2700 fwynor.exe 2700 fwynor.exe 2700 fwynor.exe 2700 fwynor.exe 2700 fwynor.exe 2700 fwynor.exe 2700 fwynor.exe 2700 fwynor.exe 2700 fwynor.exe 2700 fwynor.exe 2700 fwynor.exe 2700 fwynor.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exedescription pid process Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Token: SeDebugPrivilege 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exefwynor.exedescription pid process target process PID 4740 wrote to memory of 808 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe fontdrvhost.exe PID 4740 wrote to memory of 816 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe fontdrvhost.exe PID 4740 wrote to memory of 416 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe dwm.exe PID 4740 wrote to memory of 2416 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe sihost.exe PID 4740 wrote to memory of 2452 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe svchost.exe PID 4740 wrote to memory of 2564 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe taskhostw.exe PID 4740 wrote to memory of 796 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Explorer.EXE PID 4740 wrote to memory of 3108 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe svchost.exe PID 4740 wrote to memory of 3304 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe DllHost.exe PID 4740 wrote to memory of 3392 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe StartMenuExperienceHost.exe PID 4740 wrote to memory of 3468 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe RuntimeBroker.exe PID 4740 wrote to memory of 3556 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe SearchApp.exe PID 4740 wrote to memory of 3852 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe RuntimeBroker.exe PID 4740 wrote to memory of 4368 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe RuntimeBroker.exe PID 4740 wrote to memory of 2700 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe fwynor.exe PID 4740 wrote to memory of 2700 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe fwynor.exe PID 4740 wrote to memory of 2700 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe fwynor.exe PID 4740 wrote to memory of 4888 4740 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe backgroundTaskHost.exe PID 2700 wrote to memory of 808 2700 fwynor.exe fontdrvhost.exe PID 2700 wrote to memory of 816 2700 fwynor.exe fontdrvhost.exe PID 2700 wrote to memory of 416 2700 fwynor.exe dwm.exe PID 2700 wrote to memory of 2416 2700 fwynor.exe sihost.exe PID 2700 wrote to memory of 2452 2700 fwynor.exe svchost.exe PID 2700 wrote to memory of 2564 2700 fwynor.exe taskhostw.exe PID 2700 wrote to memory of 796 2700 fwynor.exe Explorer.EXE PID 2700 wrote to memory of 3108 2700 fwynor.exe svchost.exe PID 2700 wrote to memory of 3304 2700 fwynor.exe DllHost.exe PID 2700 wrote to memory of 3392 2700 fwynor.exe StartMenuExperienceHost.exe PID 2700 wrote to memory of 3468 2700 fwynor.exe RuntimeBroker.exe PID 2700 wrote to memory of 3556 2700 fwynor.exe SearchApp.exe PID 2700 wrote to memory of 3852 2700 fwynor.exe RuntimeBroker.exe PID 2700 wrote to memory of 4368 2700 fwynor.exe RuntimeBroker.exe PID 2700 wrote to memory of 4888 2700 fwynor.exe backgroundTaskHost.exe PID 2700 wrote to memory of 808 2700 fwynor.exe fontdrvhost.exe PID 2700 wrote to memory of 816 2700 fwynor.exe fontdrvhost.exe PID 2700 wrote to memory of 416 2700 fwynor.exe dwm.exe PID 2700 wrote to memory of 2416 2700 fwynor.exe sihost.exe PID 2700 wrote to memory of 2452 2700 fwynor.exe svchost.exe PID 2700 wrote to memory of 2564 2700 fwynor.exe taskhostw.exe PID 2700 wrote to memory of 796 2700 fwynor.exe Explorer.EXE PID 2700 wrote to memory of 3108 2700 fwynor.exe svchost.exe PID 2700 wrote to memory of 3304 2700 fwynor.exe DllHost.exe PID 2700 wrote to memory of 3392 2700 fwynor.exe StartMenuExperienceHost.exe PID 2700 wrote to memory of 3468 2700 fwynor.exe RuntimeBroker.exe PID 2700 wrote to memory of 3556 2700 fwynor.exe SearchApp.exe PID 2700 wrote to memory of 3852 2700 fwynor.exe RuntimeBroker.exe PID 2700 wrote to memory of 4368 2700 fwynor.exe RuntimeBroker.exe PID 2700 wrote to memory of 808 2700 fwynor.exe fontdrvhost.exe PID 2700 wrote to memory of 816 2700 fwynor.exe fontdrvhost.exe PID 2700 wrote to memory of 416 2700 fwynor.exe dwm.exe PID 2700 wrote to memory of 2416 2700 fwynor.exe sihost.exe PID 2700 wrote to memory of 2452 2700 fwynor.exe svchost.exe PID 2700 wrote to memory of 2564 2700 fwynor.exe taskhostw.exe PID 2700 wrote to memory of 796 2700 fwynor.exe Explorer.EXE PID 2700 wrote to memory of 3108 2700 fwynor.exe svchost.exe PID 2700 wrote to memory of 3304 2700 fwynor.exe DllHost.exe PID 2700 wrote to memory of 3392 2700 fwynor.exe StartMenuExperienceHost.exe PID 2700 wrote to memory of 3468 2700 fwynor.exe RuntimeBroker.exe PID 2700 wrote to memory of 3556 2700 fwynor.exe SearchApp.exe PID 2700 wrote to memory of 3852 2700 fwynor.exe RuntimeBroker.exe PID 2700 wrote to memory of 4368 2700 fwynor.exe RuntimeBroker.exe PID 2700 wrote to memory of 808 2700 fwynor.exe fontdrvhost.exe PID 2700 wrote to memory of 816 2700 fwynor.exe fontdrvhost.exe PID 2700 wrote to memory of 416 2700 fwynor.exe dwm.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exefwynor.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" fwynor.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe"C:\Users\Admin\AppData\Local\Temp\533be406ce5edf8ba5a2f02835fa6a96192f426d27a2e571dc69e35f0352cb6c.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\ProgramData\fwynor.exe"C:\ProgramData\fwynor.exe"3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Saaaalamm\Mira.hFilesize
557KB
MD56f1656028d98fceaa83d9b6f8cc5459d
SHA17f2e990ad5347f6613683e7efa86f08ebfa9f4a6
SHA2562121af2516f030cebfd88efb6b6c195ecc4573cdbc79595253af54970a0a8a9a
SHA512cc0ede5bd411363d4f6a81e20521af15865decedbfb539702744f8cafc2087533a513f4a7541cb0eb3447411397cd042d00232e9d091a97e09043711379ce71e
-
C:\ProgramData\fwynor.exeFilesize
522KB
MD54449fa356c6aa705f92ea8353a6037d0
SHA1dbddc21bb9ee79d669fa742c25e3ed803ebde385
SHA25614351384e3fe382c530a05327868e531ef1de27470160e5afc7921d0eaa1d7f7
SHA512e57146852c1ad5596ecdd094c37fd7ed0da5b76d724d9a2d9b7848dfb94fc7fa6c0c57bff39183500cfecdbe84ddfb09b9d16a19099a0be2efc09ea4991b027c
-
C:\ProgramData\fwynor.exeFilesize
522KB
MD54449fa356c6aa705f92ea8353a6037d0
SHA1dbddc21bb9ee79d669fa742c25e3ed803ebde385
SHA25614351384e3fe382c530a05327868e531ef1de27470160e5afc7921d0eaa1d7f7
SHA512e57146852c1ad5596ecdd094c37fd7ed0da5b76d724d9a2d9b7848dfb94fc7fa6c0c57bff39183500cfecdbe84ddfb09b9d16a19099a0be2efc09ea4991b027c
-
C:\Windows\SYSTEM.INIFilesize
256B
MD5492f74e18feda294d4b76ac4088aaa1a
SHA1c607b46c1f70f8124ae8a03c47fe0d63c4fff3f0
SHA2567523e3d3e8a4e25d3fe95eacbb4596ca004f20701ea135a9f4bcea70472da447
SHA5122a81f4c34eba7e7d27fd7a0c32680eee475f412e8476326bb87f13e3b9b4323fb7401a197fe730ea3f09919cb01c6d23103037337ec7358ca2daf85439b0d0f9
-
memory/2700-140-0x0000000002700000-0x000000000378E000-memory.dmpFilesize
16.6MB
-
memory/2700-144-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/2700-132-0x0000000000000000-mapping.dmp
-
memory/2700-143-0x0000000002700000-0x000000000378E000-memory.dmpFilesize
16.6MB
-
memory/2700-142-0x0000000002700000-0x000000000378E000-memory.dmpFilesize
16.6MB
-
memory/2700-139-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/4740-135-0x0000000002810000-0x000000000389E000-memory.dmpFilesize
16.6MB
-
memory/4740-138-0x0000000002810000-0x000000000389E000-memory.dmpFilesize
16.6MB
-
memory/4740-137-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/4740-131-0x0000000002810000-0x000000000389E000-memory.dmpFilesize
16.6MB
-
memory/4740-130-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB