Analysis
-
max time kernel
153s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
25-07-2022 03:30
Behavioral task
behavioral1
Sample
f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe
Resource
win10v2004-20220721-en
General
-
Target
f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe
-
Size
827KB
-
MD5
bb5bacfe2ae5bf6e02f5aa5f55c28acf
-
SHA1
c49192478c9611df1fde63fdd1f848def716fcba
-
SHA256
f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c
-
SHA512
f59a33f7bac0f8efab55c00e5e5be44c1db9ed859c7e6ffe563d43767d7c71ed902831739dea211d05ef6920ad2b13e7b76e824c88ade01e3cdf441fa524a8fc
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Ammyy Admin
Remote admin tool with various capabilities.
-
AmmyyAdmin payload 6 IoCs
Processes:
resource yara_rule behavioral2/memory/4396-130-0x0000000000400000-0x00000000004D4000-memory.dmp family_ammyyadmin behavioral2/memory/4396-135-0x0000000000400000-0x00000000004D4000-memory.dmp family_ammyyadmin behavioral2/memory/4560-136-0x0000000000400000-0x00000000004D4000-memory.dmp family_ammyyadmin behavioral2/memory/2100-140-0x0000000000400000-0x00000000004D4000-memory.dmp family_ammyyadmin behavioral2/memory/4560-144-0x0000000000FE0000-0x000000000206E000-memory.dmp family_ammyyadmin behavioral2/memory/2100-147-0x0000000000400000-0x00000000004D4000-memory.dmp family_ammyyadmin -
FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
-
Modifies firewall policy service 2 TTPs 9 IoCs
Processes:
f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exef7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exef7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe -
Processes:
f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exef7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exef7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe -
Processes:
f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exef7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exef7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UpdatesDisableNotify = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UacDisableNotify = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusDisableNotify = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallOverride = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusOverride = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusDisableNotify = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UacDisableNotify = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallDisableNotify = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallOverride = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusOverride = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallDisableNotify = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UpdatesDisableNotify = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe -
Disables Task Manager via registry modification
-
Processes:
resource yara_rule behavioral2/memory/4396-131-0x0000000002410000-0x000000000349E000-memory.dmp upx behavioral2/memory/4560-132-0x0000000000FE0000-0x000000000206E000-memory.dmp upx behavioral2/memory/4396-137-0x0000000002410000-0x000000000349E000-memory.dmp upx behavioral2/memory/4560-139-0x0000000000FE0000-0x000000000206E000-memory.dmp upx behavioral2/memory/2100-143-0x0000000004F20000-0x0000000005FAE000-memory.dmp upx behavioral2/memory/2100-145-0x0000000004F20000-0x0000000005FAE000-memory.dmp upx behavioral2/memory/2100-146-0x0000000004F20000-0x0000000005FAE000-memory.dmp upx -
Processes:
f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exef7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exef7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallDisableNotify = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UpdatesDisableNotify = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallOverride = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallDisableNotify = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UacDisableNotify = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusDisableNotify = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UpdatesDisableNotify = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UacDisableNotify = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusOverride = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallOverride = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusOverride = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusDisableNotify = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe -
Processes:
f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exef7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exef7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exedescription ioc process File opened (read-only) \??\M: f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe File opened (read-only) \??\R: f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe File opened (read-only) \??\U: f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe File opened (read-only) \??\E: f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe File opened (read-only) \??\H: f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe File opened (read-only) \??\I: f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe File opened (read-only) \??\T: f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe File opened (read-only) \??\V: f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe File opened (read-only) \??\W: f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe File opened (read-only) \??\Y: f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe File opened (read-only) \??\Z: f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe File opened (read-only) \??\N: f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe File opened (read-only) \??\O: f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe File opened (read-only) \??\Q: f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe File opened (read-only) \??\L: f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe File opened (read-only) \??\S: f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe File opened (read-only) \??\X: f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe File opened (read-only) \??\F: f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe File opened (read-only) \??\G: f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe File opened (read-only) \??\K: f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe File opened (read-only) \??\J: f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe File opened (read-only) \??\P: f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exedescription ioc process File opened for modification C:\autorun.inf f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe -
Drops file in System32 directory 4 IoCs
Processes:
f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe -
Drops file in Program Files directory 11 IoCs
Processes:
f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exedescription ioc process File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe -
Drops file in Windows directory 1 IoCs
Processes:
f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe -
Modifies data under HKEY_USERS 41 IoCs
Processes:
f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exef7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\policies\system\DisableTaskMgr = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\1460008425\-50721799 = "0" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Key created \REGISTRY\USER\.DEFAULT\Software f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\GlobalUserOffline = "0" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S2_0 = "5517" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\1460008425\-101443598 = "0A00687474703A2F2F63696B6D61796564656B70617263612E636F6D2F696D616765732F6C6F676F732E67696600687474703A2F2F6272756365676172726F642E636F6D2F696D616765732F6C6F676F732E67696600687474703A2F2F6362626173696D6576692E636F6D2F696D616765732F6C6F676F732E67696600687474703A2F2F6272616E64616F656D61746F732E636F6D2E62722F696D616765732F6C6F676F692E67696600687474703A2F2F6361676C617274656B6E696B2E636F6D2F6C6F676F732E67696600687474703A2F2F6268617261746973616E676C692E696E2F6C6F676F692E67696600687474703A2F2F636163732E6F72672E62722F6E6F766F736974652F6C6F676F732E67696600687474703A2F2F62757461636D2E676F2E726F2F6C6F676F732E67696600687474703A2F2F626F7961626174656D6C2E6B31322E74722F696D616765732F6C6F676F732E67696600687474703A2F2F636173627967726F75702E636F6D2F696D616765732F6C6F676F732E676966" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\1460008425\1313304901 = "8D047AF7229C9B8962BA0482D99D368E2F27DA435BE2A7386A33EDC80BF5E291731E9D01A5491DAF960D9F12BEF04EC6593B061C5B93136EC6BFEC34C08A20B0C1FA17DCC2BD245ECA59601A83B2A1E4EA6D8C1E0D407E7C34901CE485312CA99533EF94DBD09BAC13BC887C7B5FA8BD183F0B60FDAC439D9A828FBE91ABBD7D" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S1_0 = "3432392762" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Ammyy f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\policies\system\DisableRegistryTools = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\policies f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\policies\system\DisableRegistryTools = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Aoqcbk f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\1460008425\1414748499 = "121" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\1460008425\1364026700 = "35" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\policies\system\DisableTaskMgr = "1" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\1460008425\1313304901 = "8D047AF7229C9B8962BA0482D99D368E2F27DA435BE2A7386A33EDC80BF5E291731E9D01A5491DAF960D9F12BEF04EC6593B061C5B93136EC6BFEC34C08A20B0C1FA17DCC2BD245ECA59601A83B2A1E4EA6D8C1E0D407E7C34901CE485312CA99533EF94DBD09BAC13BC887C7B5FA8BD183F0B60FDAC439D9A828FBE91ABBD7D" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S3_0 = "17001001" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S4_0 = "0" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\1460008425\-1465470298 = "0" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\1460008425\1364026700 = "35" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\GlobalUserOffline = "0" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\1460008425\1414748499 = "121" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\1460008425\-1516192097 = "387" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\1460008425\-101443598 = "0A00687474703A2F2F63696B6D61796564656B70617263612E636F6D2F696D616765732F6C6F676F732E67696600687474703A2F2F6272756365676172726F642E636F6D2F696D616765732F6C6F676F732E67696600687474703A2F2F6362626173696D6576692E636F6D2F696D616765732F6C6F676F732E67696600687474703A2F2F6272616E64616F656D61746F732E636F6D2E62722F696D616765732F6C6F676F692E67696600687474703A2F2F6361676C617274656B6E696B2E636F6D2F6C6F676F732E67696600687474703A2F2F6268617261746973616E676C692E696E2F6C6F676F692E67696600687474703A2F2F636163732E6F72672E62722F6E6F766F736974652F6C6F676F732E67696600687474703A2F2F62757461636D2E676F2E726F2F6C6F676F732E67696600687474703A2F2F626F7961626174656D6C2E6B31322E74722F696D616765732F6C6F676F732E67696600687474703A2F2F636173627967726F75702E636F6D2F696D616765732F6C6F676F732E676966" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr = 537d56736608796d5b5b4e155253e1a1a087afc0b06b f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\1460008425\-1516192097 = "387" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\1460008425\-1465470298 = "0" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\policies\system f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\1460008425 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\1460008425\-50721799 = "0" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr3 = 62602a33684f0207734ac80a960415f2e42febdc3cd30d2b196fef60b391126eb5750a677864ce8f6fea7a6849bc0a22faa60d43db5d897428269ca67c36a8dbec5dfc8c f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe -
Suspicious behavior: EnumeratesProcesses 32 IoCs
Processes:
f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exef7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exef7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exepid process 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe 4560 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe 4560 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exedescription pid process Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Token: SeDebugPrivilege 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exepid process 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exepid process 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exef7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exef7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exedescription pid process target process PID 4396 wrote to memory of 792 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe fontdrvhost.exe PID 4396 wrote to memory of 800 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe fontdrvhost.exe PID 4396 wrote to memory of 388 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe dwm.exe PID 4396 wrote to memory of 2688 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe sihost.exe PID 4396 wrote to memory of 2760 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe svchost.exe PID 4396 wrote to memory of 2848 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe taskhostw.exe PID 4396 wrote to memory of 2900 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Explorer.EXE PID 4396 wrote to memory of 3080 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe svchost.exe PID 4396 wrote to memory of 3292 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe DllHost.exe PID 4396 wrote to memory of 3392 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe StartMenuExperienceHost.exe PID 4396 wrote to memory of 3456 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe RuntimeBroker.exe PID 4396 wrote to memory of 3544 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe SearchApp.exe PID 4396 wrote to memory of 3740 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe RuntimeBroker.exe PID 4396 wrote to memory of 3556 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe RuntimeBroker.exe PID 4396 wrote to memory of 3884 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe backgroundTaskHost.exe PID 4396 wrote to memory of 2844 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe backgroundTaskHost.exe PID 4396 wrote to memory of 4880 4396 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe RuntimeBroker.exe PID 4560 wrote to memory of 2100 4560 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe PID 4560 wrote to memory of 2100 4560 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe PID 4560 wrote to memory of 2100 4560 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe PID 2100 wrote to memory of 792 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe fontdrvhost.exe PID 2100 wrote to memory of 800 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe fontdrvhost.exe PID 2100 wrote to memory of 388 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe dwm.exe PID 2100 wrote to memory of 2688 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe sihost.exe PID 2100 wrote to memory of 2760 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe svchost.exe PID 2100 wrote to memory of 2848 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe taskhostw.exe PID 2100 wrote to memory of 2900 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Explorer.EXE PID 2100 wrote to memory of 3080 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe svchost.exe PID 2100 wrote to memory of 3292 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe DllHost.exe PID 2100 wrote to memory of 3392 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe StartMenuExperienceHost.exe PID 2100 wrote to memory of 3456 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe RuntimeBroker.exe PID 2100 wrote to memory of 3544 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe SearchApp.exe PID 2100 wrote to memory of 3740 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe RuntimeBroker.exe PID 2100 wrote to memory of 3556 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe RuntimeBroker.exe PID 2100 wrote to memory of 3884 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe backgroundTaskHost.exe PID 2100 wrote to memory of 2844 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe backgroundTaskHost.exe PID 2100 wrote to memory of 4880 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe RuntimeBroker.exe PID 2100 wrote to memory of 792 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe fontdrvhost.exe PID 2100 wrote to memory of 800 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe fontdrvhost.exe PID 2100 wrote to memory of 388 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe dwm.exe PID 2100 wrote to memory of 2688 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe sihost.exe PID 2100 wrote to memory of 2760 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe svchost.exe PID 2100 wrote to memory of 2848 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe taskhostw.exe PID 2100 wrote to memory of 2900 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Explorer.EXE PID 2100 wrote to memory of 3080 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe svchost.exe PID 2100 wrote to memory of 3292 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe DllHost.exe PID 2100 wrote to memory of 3392 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe StartMenuExperienceHost.exe PID 2100 wrote to memory of 3456 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe RuntimeBroker.exe PID 2100 wrote to memory of 3544 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe SearchApp.exe PID 2100 wrote to memory of 3740 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe RuntimeBroker.exe PID 2100 wrote to memory of 3556 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe RuntimeBroker.exe PID 2100 wrote to memory of 3884 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe backgroundTaskHost.exe PID 2100 wrote to memory of 2844 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe backgroundTaskHost.exe PID 2100 wrote to memory of 4880 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe RuntimeBroker.exe PID 2100 wrote to memory of 792 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe fontdrvhost.exe PID 2100 wrote to memory of 800 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe fontdrvhost.exe PID 2100 wrote to memory of 388 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe dwm.exe PID 2100 wrote to memory of 2688 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe sihost.exe PID 2100 wrote to memory of 2760 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe svchost.exe PID 2100 wrote to memory of 2848 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe taskhostw.exe PID 2100 wrote to memory of 2900 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Explorer.EXE PID 2100 wrote to memory of 3080 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe svchost.exe PID 2100 wrote to memory of 3292 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe DllHost.exe PID 2100 wrote to memory of 3392 2100 f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe StartMenuExperienceHost.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exef7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exef7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe"C:\Users\Admin\AppData\Local\Temp\f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵
-
C:\Users\Admin\AppData\Local\Temp\f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe"C:\Users\Admin\AppData\Local\Temp\f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe" -service -lunch1⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe"C:\Users\Admin\AppData\Local\Temp\f7f175a450a116c0be3c493e697c98c9469f2f894f3834fea484f5540621350c.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\AMMYY\hrFilesize
22B
MD5b51ff1164a5b348f4d9e903b66c0d4ce
SHA14806f314c99a10cb3d896c4fab229ef7ffebf25d
SHA2565034f0aba9c8ed2728a0b22594f374fb0fc5cd0a9272085841c69c4999bf4534
SHA5127e05b203d9510ca4f3dc271d0aa06ac36759073a81b92274e780fde0487a99cf5d1a6225be04e750dc3d708eb9c3b4b3237e8a84bbbc7f61460b2a805e5740db
-
C:\ProgramData\AMMYY\hr3Filesize
68B
MD5875292975e6701eb3668c9d7d4e0cf0e
SHA108a301850bdb78b372b16e274d5f71e5d97ff135
SHA256d417318cb9b4105760511b16b21a86f79ca975038089e391b1c037aa58aa78b4
SHA51298af0edcec8859f7ed25671538c5a9db9f69fe9b61d215d400274280ab24f9a5c8e1a4ca378042724698e69bdb258420967fdc65949c7d72d1b80cdf465d9b25
-
C:\ProgramData\AMMYY\settings3.binFilesize
271B
MD5714f2508d4227f74b6adacfef73815d8
SHA1a35c8a796e4453c0c09d011284b806d25bdad04c
SHA256a5579945f23747541c0e80b79e79375d4ca44feafcd425ee9bd9302e35312480
SHA5121171a6eac6d237053815a40c2bcc2df9f4209902d6157777377228f3b618cad50c88a9519444ed5c447cf744e4655272fb42dabb567df85b4b19b1a2f1d086d8
-
C:\Windows\SYSTEM.INIFilesize
257B
MD50f50553cf6fc0db44663405f6d2786ae
SHA1e919c8076508be2a292d8f3f72d59454df9ac900
SHA256ef41b3f0370ce3e2cb14f3bd86ffd1eedcdda129293a451023f3deeefaf7ce97
SHA512dab729b639e377ef11140646da60bf63ca5245cdc49dbaee756f8238e5bf4169972897f0b8203b30da860ecbb0a5b1f0bf78629610665151c00d46855a1fba2a
-
memory/2100-140-0x0000000000400000-0x00000000004D4000-memory.dmpFilesize
848KB
-
memory/2100-133-0x0000000000000000-mapping.dmp
-
memory/2100-147-0x0000000000400000-0x00000000004D4000-memory.dmpFilesize
848KB
-
memory/2100-146-0x0000000004F20000-0x0000000005FAE000-memory.dmpFilesize
16.6MB
-
memory/2100-145-0x0000000004F20000-0x0000000005FAE000-memory.dmpFilesize
16.6MB
-
memory/2100-143-0x0000000004F20000-0x0000000005FAE000-memory.dmpFilesize
16.6MB
-
memory/4396-131-0x0000000002410000-0x000000000349E000-memory.dmpFilesize
16.6MB
-
memory/4396-130-0x0000000000400000-0x00000000004D4000-memory.dmpFilesize
848KB
-
memory/4396-137-0x0000000002410000-0x000000000349E000-memory.dmpFilesize
16.6MB
-
memory/4396-135-0x0000000000400000-0x00000000004D4000-memory.dmpFilesize
848KB
-
memory/4560-132-0x0000000000FE0000-0x000000000206E000-memory.dmpFilesize
16.6MB
-
memory/4560-139-0x0000000000FE0000-0x000000000206E000-memory.dmpFilesize
16.6MB
-
memory/4560-144-0x0000000000FE0000-0x000000000206E000-memory.dmpFilesize
16.6MB
-
memory/4560-136-0x0000000000400000-0x00000000004D4000-memory.dmpFilesize
848KB