sality | 5c663d8932faf3af09c3fae890b5cec421a6601848745b01034b0d5b85b8fae2

General

Target

5c663d8932faf3af09c3fae890b5cec421a6601848745b01034b0d5b85b8fae2.exe
Size

567KB
MD5

742fa4d87468c0627133ec45629c692d
SHA1

d9bb92a9b3a050394f8008d76e94eb8cffb82787
SHA256

5c663d8932faf3af09c3fae890b5cec421a6601848745b01034b0d5b85b8fae2
SHA512

70218d835228e6180971e833ef477f9e8648bc03d877b466d8d4778f7598278dab46bec44767265c7a66873eea09d7a13d36496d156c53e4fcc1893db17b9bb4

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

Modifies firewall policy service 2 TTPs 3 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

svhost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	svhost.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	svhost.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	svhost.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

svhost.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svhost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svhost.exe

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

svhost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	svhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	svhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	svhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	svhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	svhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	svhost.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

svhost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1"	svhost.exe

Disables Task Manager via registry modification
evasion
Executes dropped EXE 1 IoCs

Processes:

svhost.exe

pid process

3696 svhost.exe

pid	process
3696	svhost.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3696-136-0x0000000000400000-0x0000000000476000-memory.dmp	upx
behavioral2/memory/3696-140-0x0000000000400000-0x0000000000476000-memory.dmp	upx
behavioral2/memory/3696-142-0x0000000000400000-0x0000000000476000-memory.dmp	upx
behavioral2/memory/3696-141-0x0000000003610000-0x000000000469E000-memory.dmp	upx
behavioral2/memory/3696-145-0x0000000000400000-0x0000000000476000-memory.dmp	upx
behavioral2/memory/3696-146-0x0000000003610000-0x000000000469E000-memory.dmp	upx

Drops startup file 1 IoCs

Processes:

5c663d8932faf3af09c3fae890b5cec421a6601848745b01034b0d5b85b8fae2.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svhost.exe.lnk	5c663d8932faf3af09c3fae890b5cec421a6601848745b01034b0d5b85b8fae2.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

svhost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	svhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	svhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	svhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	svhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	svhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	svhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	svhost.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

svhost.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svhost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svhost.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

svhost.exe

description	ioc	process
File opened (read-only)	\??\E:	svhost.exe
File opened (read-only)	\??\G:	svhost.exe
File opened (read-only)	\??\M:	svhost.exe
File opened (read-only)	\??\N:	svhost.exe
File opened (read-only)	\??\X:	svhost.exe
File opened (read-only)	\??\F:	svhost.exe
File opened (read-only)	\??\I:	svhost.exe
File opened (read-only)	\??\O:	svhost.exe
File opened (read-only)	\??\R:	svhost.exe
File opened (read-only)	\??\Z:	svhost.exe
File opened (read-only)	\??\K:	svhost.exe
File opened (read-only)	\??\L:	svhost.exe
File opened (read-only)	\??\T:	svhost.exe
File opened (read-only)	\??\U:	svhost.exe
File opened (read-only)	\??\V:	svhost.exe
File opened (read-only)	\??\W:	svhost.exe
File opened (read-only)	\??\Y:	svhost.exe
File opened (read-only)	\??\H:	svhost.exe
File opened (read-only)	\??\J:	svhost.exe
File opened (read-only)	\??\P:	svhost.exe
File opened (read-only)	\??\Q:	svhost.exe
File opened (read-only)	\??\S:	svhost.exe

Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media
T1091

Processes:

svhost.exe

description ioc process

File opened for modification C:\autorun.inf svhost.exe

description	ioc	process
File opened for modification	C:\autorun.inf	svhost.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

5c663d8932faf3af09c3fae890b5cec421a6601848745b01034b0d5b85b8fae2.exe

description	pid	process	target process
PID 4956 set thread context of 3696	4956	5c663d8932faf3af09c3fae890b5cec421a6601848745b01034b0d5b85b8fae2.exe	svhost.exe

Drops file in Program Files directory 11 IoCs

Processes:

svhost.exe

description	ioc	process
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zG.exe	svhost.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\Uninstall.exe	svhost.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe	svhost.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe	svhost.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7z.exe	svhost.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe	svhost.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe	svhost.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe	svhost.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe	svhost.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe	svhost.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zFM.exe	svhost.exe

Drops file in Windows directory 1 IoCs

Processes:

svhost.exe

description ioc process

File opened for modification C:\Windows\SYSTEM.INI svhost.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
NTFS ADS 1 IoCs

Processes:

cmd.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Windows\svhost.exe:Zone.Identifier cmd.exe

description	ioc	process
File opened for modification	C:\Windows\SYSTEM.INI	svhost.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Windows\svhost.exe:Zone.Identifier	cmd.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

Processes:

5c663d8932faf3af09c3fae890b5cec421a6601848745b01034b0d5b85b8fae2.exesvhost.exe

pid	process
4956	5c663d8932faf3af09c3fae890b5cec421a6601848745b01034b0d5b85b8fae2.exe
4956	5c663d8932faf3af09c3fae890b5cec421a6601848745b01034b0d5b85b8fae2.exe
4956	5c663d8932faf3af09c3fae890b5cec421a6601848745b01034b0d5b85b8fae2.exe
4956	5c663d8932faf3af09c3fae890b5cec421a6601848745b01034b0d5b85b8fae2.exe
3696	svhost.exe
3696	svhost.exe
4956	5c663d8932faf3af09c3fae890b5cec421a6601848745b01034b0d5b85b8fae2.exe
4956	5c663d8932faf3af09c3fae890b5cec421a6601848745b01034b0d5b85b8fae2.exe
4956	5c663d8932faf3af09c3fae890b5cec421a6601848745b01034b0d5b85b8fae2.exe
4956	5c663d8932faf3af09c3fae890b5cec421a6601848745b01034b0d5b85b8fae2.exe
4956	5c663d8932faf3af09c3fae890b5cec421a6601848745b01034b0d5b85b8fae2.exe
4956	5c663d8932faf3af09c3fae890b5cec421a6601848745b01034b0d5b85b8fae2.exe
4956	5c663d8932faf3af09c3fae890b5cec421a6601848745b01034b0d5b85b8fae2.exe
4956	5c663d8932faf3af09c3fae890b5cec421a6601848745b01034b0d5b85b8fae2.exe
4956	5c663d8932faf3af09c3fae890b5cec421a6601848745b01034b0d5b85b8fae2.exe
4956	5c663d8932faf3af09c3fae890b5cec421a6601848745b01034b0d5b85b8fae2.exe
3696	svhost.exe
3696	svhost.exe
3696	svhost.exe
3696	svhost.exe
3696	svhost.exe
3696	svhost.exe
3696	svhost.exe
3696	svhost.exe
3696	svhost.exe
3696	svhost.exe
3696	svhost.exe
3696	svhost.exe
3696	svhost.exe
3696	svhost.exe
3696	svhost.exe
3696	svhost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

5c663d8932faf3af09c3fae890b5cec421a6601848745b01034b0d5b85b8fae2.exesvhost.exe

description	pid	process
Token: SeDebugPrivilege	4956	5c663d8932faf3af09c3fae890b5cec421a6601848745b01034b0d5b85b8fae2.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe
Token: SeDebugPrivilege	3696	svhost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

svhost.exe

pid process

3696 svhost.exe

pid	process
3696	svhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

5c663d8932faf3af09c3fae890b5cec421a6601848745b01034b0d5b85b8fae2.execmd.exesvhost.exe

description	pid	process	target process
PID 4956 wrote to memory of 2572	4956	5c663d8932faf3af09c3fae890b5cec421a6601848745b01034b0d5b85b8fae2.exe	cmd.exe
PID 4956 wrote to memory of 2572	4956	5c663d8932faf3af09c3fae890b5cec421a6601848745b01034b0d5b85b8fae2.exe	cmd.exe
PID 4956 wrote to memory of 2572	4956	5c663d8932faf3af09c3fae890b5cec421a6601848745b01034b0d5b85b8fae2.exe	cmd.exe
PID 2572 wrote to memory of 4700	2572	cmd.exe	reg.exe
PID 2572 wrote to memory of 4700	2572	cmd.exe	reg.exe
PID 2572 wrote to memory of 4700	2572	cmd.exe	reg.exe
PID 4956 wrote to memory of 3696	4956	5c663d8932faf3af09c3fae890b5cec421a6601848745b01034b0d5b85b8fae2.exe	svhost.exe
PID 4956 wrote to memory of 3696	4956	5c663d8932faf3af09c3fae890b5cec421a6601848745b01034b0d5b85b8fae2.exe	svhost.exe
PID 4956 wrote to memory of 3696	4956	5c663d8932faf3af09c3fae890b5cec421a6601848745b01034b0d5b85b8fae2.exe	svhost.exe
PID 4956 wrote to memory of 3696	4956	5c663d8932faf3af09c3fae890b5cec421a6601848745b01034b0d5b85b8fae2.exe	svhost.exe
PID 4956 wrote to memory of 3696	4956	5c663d8932faf3af09c3fae890b5cec421a6601848745b01034b0d5b85b8fae2.exe	svhost.exe
PID 4956 wrote to memory of 3696	4956	5c663d8932faf3af09c3fae890b5cec421a6601848745b01034b0d5b85b8fae2.exe	svhost.exe
PID 4956 wrote to memory of 3696	4956	5c663d8932faf3af09c3fae890b5cec421a6601848745b01034b0d5b85b8fae2.exe	svhost.exe
PID 3696 wrote to memory of 780	3696	svhost.exe	fontdrvhost.exe
PID 3696 wrote to memory of 788	3696	svhost.exe	fontdrvhost.exe
PID 3696 wrote to memory of 996	3696	svhost.exe	dwm.exe
PID 3696 wrote to memory of 2432	3696	svhost.exe	sihost.exe
PID 3696 wrote to memory of 2456	3696	svhost.exe	svchost.exe
PID 3696 wrote to memory of 2732	3696	svhost.exe	taskhostw.exe
PID 3696 wrote to memory of 2616	3696	svhost.exe	Explorer.EXE
PID 3696 wrote to memory of 2652	3696	svhost.exe	svchost.exe
PID 3696 wrote to memory of 3272	3696	svhost.exe	DllHost.exe
PID 3696 wrote to memory of 3364	3696	svhost.exe	StartMenuExperienceHost.exe
PID 3696 wrote to memory of 3432	3696	svhost.exe	RuntimeBroker.exe
PID 3696 wrote to memory of 3524	3696	svhost.exe	SearchApp.exe
PID 3696 wrote to memory of 3688	3696	svhost.exe	RuntimeBroker.exe
PID 3696 wrote to memory of 4956	3696	svhost.exe	5c663d8932faf3af09c3fae890b5cec421a6601848745b01034b0d5b85b8fae2.exe
PID 3696 wrote to memory of 4956	3696	svhost.exe	5c663d8932faf3af09c3fae890b5cec421a6601848745b01034b0d5b85b8fae2.exe
PID 3696 wrote to memory of 4984	3696	svhost.exe	RuntimeBroker.exe
PID 3696 wrote to memory of 780	3696	svhost.exe	fontdrvhost.exe
PID 3696 wrote to memory of 788	3696	svhost.exe	fontdrvhost.exe
PID 3696 wrote to memory of 996	3696	svhost.exe	dwm.exe
PID 3696 wrote to memory of 2432	3696	svhost.exe	sihost.exe
PID 3696 wrote to memory of 2456	3696	svhost.exe	svchost.exe
PID 3696 wrote to memory of 2732	3696	svhost.exe	taskhostw.exe
PID 3696 wrote to memory of 2616	3696	svhost.exe	Explorer.EXE
PID 3696 wrote to memory of 2652	3696	svhost.exe	svchost.exe
PID 3696 wrote to memory of 3272	3696	svhost.exe	DllHost.exe
PID 3696 wrote to memory of 3364	3696	svhost.exe	StartMenuExperienceHost.exe
PID 3696 wrote to memory of 3432	3696	svhost.exe	RuntimeBroker.exe
PID 3696 wrote to memory of 3524	3696	svhost.exe	SearchApp.exe
PID 3696 wrote to memory of 3688	3696	svhost.exe	RuntimeBroker.exe
PID 3696 wrote to memory of 4984	3696	svhost.exe	RuntimeBroker.exe
PID 3696 wrote to memory of 4948	3696	svhost.exe	RuntimeBroker.exe
PID 3696 wrote to memory of 780	3696	svhost.exe	fontdrvhost.exe
PID 3696 wrote to memory of 788	3696	svhost.exe	fontdrvhost.exe
PID 3696 wrote to memory of 996	3696	svhost.exe	dwm.exe
PID 3696 wrote to memory of 2432	3696	svhost.exe	sihost.exe
PID 3696 wrote to memory of 2456	3696	svhost.exe	svchost.exe
PID 3696 wrote to memory of 2732	3696	svhost.exe	taskhostw.exe
PID 3696 wrote to memory of 2616	3696	svhost.exe	Explorer.EXE
PID 3696 wrote to memory of 2652	3696	svhost.exe	svchost.exe
PID 3696 wrote to memory of 3272	3696	svhost.exe	DllHost.exe
PID 3696 wrote to memory of 3364	3696	svhost.exe	StartMenuExperienceHost.exe
PID 3696 wrote to memory of 3432	3696	svhost.exe	RuntimeBroker.exe
PID 3696 wrote to memory of 3524	3696	svhost.exe	SearchApp.exe
PID 3696 wrote to memory of 3688	3696	svhost.exe	RuntimeBroker.exe
PID 3696 wrote to memory of 4948	3696	svhost.exe	RuntimeBroker.exe
PID 3696 wrote to memory of 4352	3696	svhost.exe	backgroundTaskHost.exe
PID 3696 wrote to memory of 4924	3696	svhost.exe	RuntimeBroker.exe
PID 3696 wrote to memory of 4184	3696	svhost.exe	DllHost.exe
PID 3696 wrote to memory of 780	3696	svhost.exe	fontdrvhost.exe
PID 3696 wrote to memory of 788	3696	svhost.exe	fontdrvhost.exe
PID 3696 wrote to memory of 996	3696	svhost.exe	dwm.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

svhost.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svhost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svhost.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:780

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2732

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3432

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3524

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3364

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3688

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:2652

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2616

C:\Users\Admin\AppData\Local\Temp\5c663d8932faf3af09c3fae890b5cec421a6601848745b01034b0d5b85b8fae2.exe
"C:\Users\Admin\AppData\Local\Temp\5c663d8932faf3af09c3fae890b5cec421a6601848745b01034b0d5b85b8fae2.exe"
2⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4956

C:\Windows\SysWOW64\cmd.exe
"cmd.exe"
3⤵
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:2572

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows\svhost.exe.lnk" /f
4⤵
PID:4700

C:\Users\Admin\AppData\Local\Temp\svhost.exe
"C:\Users\Admin\AppData\Local\Temp\svhost.exe"
3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2456

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2432

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:996

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:788

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4984

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4948

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:4352

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4924

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:4184

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:4472

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:4100

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Modify Registry

5

T1112

Bypass User Account Control

1

T1088

Disabling Security Tools

3

T1089

Credential Access

Discovery

System Information Discovery

3

T1082

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\svhost.exe
Filesize
1.6MB

MD5
1c9ff7df71493896054a91bee0322ebf

SHA1
38f1c85965d58b910d8e8381b6b1099d5dfcbfe4

SHA256
e8b5da3394bbdd7868122ffd88d9d06afe31bd69d656857910d2f820c32d0efa

SHA512
aa0def62b663743e6c3c022182b35cff33cb9abf08453d5098f3c5d32b2a8b0cd1cc5de64b93e39680c1d1396fef1fd50b642ca3ea4ba1f6d1078321d96916ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\svhost.exe
Filesize
1.6MB

MD5
1c9ff7df71493896054a91bee0322ebf

SHA1
38f1c85965d58b910d8e8381b6b1099d5dfcbfe4

SHA256
e8b5da3394bbdd7868122ffd88d9d06afe31bd69d656857910d2f820c32d0efa

SHA512
aa0def62b663743e6c3c022182b35cff33cb9abf08453d5098f3c5d32b2a8b0cd1cc5de64b93e39680c1d1396fef1fd50b642ca3ea4ba1f6d1078321d96916ab

Download Submit
C:\Users\Admin\AppData\Roaming\Windows\svhost.exe
Filesize
567KB

MD5
742fa4d87468c0627133ec45629c692d

SHA1
d9bb92a9b3a050394f8008d76e94eb8cffb82787

SHA256
5c663d8932faf3af09c3fae890b5cec421a6601848745b01034b0d5b85b8fae2

SHA512
70218d835228e6180971e833ef477f9e8648bc03d877b466d8d4778f7598278dab46bec44767265c7a66873eea09d7a13d36496d156c53e4fcc1893db17b9bb4

Download Submit
memory/2572-132-0x0000000000000000-mapping.dmp

Download
memory/3696-140-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/3696-135-0x0000000000000000-mapping.dmp

Download
memory/3696-136-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/3696-142-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/3696-141-0x0000000003610000-0x000000000469E000-memory.dmp

Filesize
16.6MB

Download
memory/3696-145-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/3696-146-0x0000000003610000-0x000000000469E000-memory.dmp

Filesize
16.6MB

Download
memory/4700-133-0x0000000000000000-mapping.dmp

Download
memory/4956-131-0x00000000752E0000-0x0000000075891000-memory.dmp

Filesize
5.7MB

Download
memory/4956-130-0x00000000752E0000-0x0000000075891000-memory.dmp

Filesize
5.7MB

Download
memory/4956-147-0x00000000752E0000-0x0000000075891000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads