Overview
overview
10Static
static
XISE WBMS ...��.exe
windows7-x64
10XISE WBMS ...��.exe
windows10-2004-x64
10fz.dll
windows7-x64
3fz.dll
windows10-2004-x64
3jiaoben/zhu/asp/1.asp
windows7-x64
3jiaoben/zhu/asp/1.asp
windows10-2004-x64
3xise/XISE ....9.exe
windows7-x64
10xise/XISE ....9.exe
windows10-2004-x64
10xise/jiaob...se.vbs
windows7-x64
1xise/jiaob...se.vbs
windows10-2004-x64
1xise/jsc.dll
windows7-x64
3xise/jsc.dll
windows10-2004-x64
3Analysis
-
max time kernel
152s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
18-09-2022 01:45
Static task
static1
Behavioral task
behavioral1
Sample
XISE WBMS 2020官方正版.exe
Resource
win7-20220812-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
XISE WBMS 2020官方正版.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral3
Sample
fz.dll
Resource
win7-20220812-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
fz.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral5
Sample
jiaoben/zhu/asp/1.asp
Resource
win7-20220901-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
jiaoben/zhu/asp/1.asp
Resource
win10v2004-20220812-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
xise/XISE 菜刀管理7.9.exe
Resource
win7-20220812-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral8
Sample
xise/XISE 菜刀管理7.9.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral9
Sample
xise/jiaoben/ASPhorse.vbs
Resource
win7-20220901-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
xise/jiaoben/ASPhorse.vbs
Resource
win10v2004-20220812-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
xise/jsc.dll
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
xise/jsc.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
xise/XISE 菜刀管理7.9.exe
-
Size
3.5MB
-
MD5
96982ad9d89aed47ae7745e629ac5e94
-
SHA1
a38cd9ca46a12465e167fa4e142566dcbacd52c0
-
SHA256
1af112aa05fff8e947f7d0736bbd22b103bfaeadaf8df008d0a8420399411f36
-
SHA512
1a9711e65786155e1e6f263d3d1871a44e4c4465ea7497996dbab5ae4fb95241bcb47c4f9e5fcb3a924fc31d547ecbb9ee2eecbc5ea551c8005688976f7b256a
-
SSDEEP
49152:pnsHyjtk2MYC5GDBBV14O01+D/PO+pC6x692Aa+36/jOk:pnsmtk2aqVmOC+D/PO+pC6x69ja+Gjj
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 7 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications XISE 菜刀管理7.9.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\xise\XISE ????7.9.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xise\\XISE ????7.9.exe:*:enabled:@shell32.dll,-1" XISE 菜刀管理7.9.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" XISE 菜刀管理7.9.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" XISE 菜刀管理7.9.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" XISE 菜刀管理7.9.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List XISE 菜刀管理7.9.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile XISE 菜刀管理7.9.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" XISE 菜刀管理7.9.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" XISE 菜刀管理7.9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" XISE 菜刀管理7.9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" XISE 菜刀管理7.9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" XISE 菜刀管理7.9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" XISE 菜刀管理7.9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" XISE 菜刀管理7.9.exe -
resource yara_rule behavioral8/memory/404-132-0x0000000002700000-0x000000000378E000-memory.dmp upx behavioral8/memory/404-133-0x0000000002700000-0x000000000378E000-memory.dmp upx behavioral8/memory/404-134-0x0000000002700000-0x000000000378E000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" XISE 菜刀管理7.9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" XISE 菜刀管理7.9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" XISE 菜刀管理7.9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" XISE 菜刀管理7.9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" XISE 菜刀管理7.9.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc XISE 菜刀管理7.9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" XISE 菜刀管理7.9.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" XISE 菜刀管理7.9.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" XISE 菜刀管理7.9.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: XISE 菜刀管理7.9.exe File opened (read-only) \??\O: XISE 菜刀管理7.9.exe File opened (read-only) \??\W: XISE 菜刀管理7.9.exe File opened (read-only) \??\Z: XISE 菜刀管理7.9.exe File opened (read-only) \??\J: XISE 菜刀管理7.9.exe File opened (read-only) \??\S: XISE 菜刀管理7.9.exe File opened (read-only) \??\T: XISE 菜刀管理7.9.exe File opened (read-only) \??\U: XISE 菜刀管理7.9.exe File opened (read-only) \??\V: XISE 菜刀管理7.9.exe File opened (read-only) \??\X: XISE 菜刀管理7.9.exe File opened (read-only) \??\Y: XISE 菜刀管理7.9.exe File opened (read-only) \??\P: XISE 菜刀管理7.9.exe File opened (read-only) \??\F: XISE 菜刀管理7.9.exe File opened (read-only) \??\K: XISE 菜刀管理7.9.exe File opened (read-only) \??\R: XISE 菜刀管理7.9.exe File opened (read-only) \??\E: XISE 菜刀管理7.9.exe File opened (read-only) \??\H: XISE 菜刀管理7.9.exe File opened (read-only) \??\I: XISE 菜刀管理7.9.exe File opened (read-only) \??\L: XISE 菜刀管理7.9.exe File opened (read-only) \??\N: XISE 菜刀管理7.9.exe File opened (read-only) \??\Q: XISE 菜刀管理7.9.exe File opened (read-only) \??\G: XISE 菜刀管理7.9.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf XISE 菜刀管理7.9.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\7-ZIP\7Z.EXE XISE 菜刀管理7.9.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7ZFM.EXE XISE 菜刀管理7.9.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe XISE 菜刀管理7.9.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7ZG.EXE XISE 菜刀管理7.9.exe File opened for modification C:\PROGRAM FILES\7-ZIP\UNINSTALL.EXE XISE 菜刀管理7.9.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe XISE 菜刀管理7.9.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe XISE 菜刀管理7.9.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe XISE 菜刀管理7.9.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe XISE 菜刀管理7.9.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe XISE 菜刀管理7.9.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe XISE 菜刀管理7.9.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe XISE 菜刀管理7.9.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe XISE 菜刀管理7.9.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe XISE 菜刀管理7.9.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe XISE 菜刀管理7.9.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI XISE 菜刀管理7.9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe -
Suspicious behavior: MapViewOfSection 64 IoCs
pid Process 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe 404 XISE 菜刀管理7.9.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 404 XISE 菜刀管理7.9.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 404 wrote to memory of 612 404 XISE 菜刀管理7.9.exe 6 PID 404 wrote to memory of 612 404 XISE 菜刀管理7.9.exe 6 PID 404 wrote to memory of 612 404 XISE 菜刀管理7.9.exe 6 PID 404 wrote to memory of 612 404 XISE 菜刀管理7.9.exe 6 PID 404 wrote to memory of 612 404 XISE 菜刀管理7.9.exe 6 PID 404 wrote to memory of 612 404 XISE 菜刀管理7.9.exe 6 PID 404 wrote to memory of 668 404 XISE 菜刀管理7.9.exe 5 PID 404 wrote to memory of 668 404 XISE 菜刀管理7.9.exe 5 PID 404 wrote to memory of 668 404 XISE 菜刀管理7.9.exe 5 PID 404 wrote to memory of 668 404 XISE 菜刀管理7.9.exe 5 PID 404 wrote to memory of 668 404 XISE 菜刀管理7.9.exe 5 PID 404 wrote to memory of 668 404 XISE 菜刀管理7.9.exe 5 PID 404 wrote to memory of 780 404 XISE 菜刀管理7.9.exe 8 PID 404 wrote to memory of 780 404 XISE 菜刀管理7.9.exe 8 PID 404 wrote to memory of 780 404 XISE 菜刀管理7.9.exe 8 PID 404 wrote to memory of 780 404 XISE 菜刀管理7.9.exe 8 PID 404 wrote to memory of 780 404 XISE 菜刀管理7.9.exe 8 PID 404 wrote to memory of 780 404 XISE 菜刀管理7.9.exe 8 PID 404 wrote to memory of 788 404 XISE 菜刀管理7.9.exe 9 PID 404 wrote to memory of 788 404 XISE 菜刀管理7.9.exe 9 PID 404 wrote to memory of 788 404 XISE 菜刀管理7.9.exe 9 PID 404 wrote to memory of 788 404 XISE 菜刀管理7.9.exe 9 PID 404 wrote to memory of 788 404 XISE 菜刀管理7.9.exe 9 PID 404 wrote to memory of 788 404 XISE 菜刀管理7.9.exe 9 PID 404 wrote to memory of 796 404 XISE 菜刀管理7.9.exe 63 PID 404 wrote to memory of 796 404 XISE 菜刀管理7.9.exe 63 PID 404 wrote to memory of 796 404 XISE 菜刀管理7.9.exe 63 PID 404 wrote to memory of 796 404 XISE 菜刀管理7.9.exe 63 PID 404 wrote to memory of 796 404 XISE 菜刀管理7.9.exe 63 PID 404 wrote to memory of 796 404 XISE 菜刀管理7.9.exe 63 PID 404 wrote to memory of 908 404 XISE 菜刀管理7.9.exe 61 PID 404 wrote to memory of 908 404 XISE 菜刀管理7.9.exe 61 PID 404 wrote to memory of 908 404 XISE 菜刀管理7.9.exe 61 PID 404 wrote to memory of 908 404 XISE 菜刀管理7.9.exe 61 PID 404 wrote to memory of 908 404 XISE 菜刀管理7.9.exe 61 PID 404 wrote to memory of 908 404 XISE 菜刀管理7.9.exe 61 PID 404 wrote to memory of 956 404 XISE 菜刀管理7.9.exe 56 PID 404 wrote to memory of 956 404 XISE 菜刀管理7.9.exe 56 PID 404 wrote to memory of 956 404 XISE 菜刀管理7.9.exe 56 PID 404 wrote to memory of 956 404 XISE 菜刀管理7.9.exe 56 PID 404 wrote to memory of 956 404 XISE 菜刀管理7.9.exe 56 PID 404 wrote to memory of 956 404 XISE 菜刀管理7.9.exe 56 PID 404 wrote to memory of 332 404 XISE 菜刀管理7.9.exe 55 PID 404 wrote to memory of 332 404 XISE 菜刀管理7.9.exe 55 PID 404 wrote to memory of 332 404 XISE 菜刀管理7.9.exe 55 PID 404 wrote to memory of 332 404 XISE 菜刀管理7.9.exe 55 PID 404 wrote to memory of 332 404 XISE 菜刀管理7.9.exe 55 PID 404 wrote to memory of 332 404 XISE 菜刀管理7.9.exe 55 PID 404 wrote to memory of 396 404 XISE 菜刀管理7.9.exe 10 PID 404 wrote to memory of 396 404 XISE 菜刀管理7.9.exe 10 PID 404 wrote to memory of 396 404 XISE 菜刀管理7.9.exe 10 PID 404 wrote to memory of 396 404 XISE 菜刀管理7.9.exe 10 PID 404 wrote to memory of 396 404 XISE 菜刀管理7.9.exe 10 PID 404 wrote to memory of 396 404 XISE 菜刀管理7.9.exe 10 PID 404 wrote to memory of 384 404 XISE 菜刀管理7.9.exe 11 PID 404 wrote to memory of 384 404 XISE 菜刀管理7.9.exe 11 PID 404 wrote to memory of 384 404 XISE 菜刀管理7.9.exe 11 PID 404 wrote to memory of 384 404 XISE 菜刀管理7.9.exe 11 PID 404 wrote to memory of 384 404 XISE 菜刀管理7.9.exe 11 PID 404 wrote to memory of 384 404 XISE 菜刀管理7.9.exe 11 PID 404 wrote to memory of 900 404 XISE 菜刀管理7.9.exe 54 PID 404 wrote to memory of 900 404 XISE 菜刀管理7.9.exe 54 PID 404 wrote to memory of 900 404 XISE 菜刀管理7.9.exe 54 PID 404 wrote to memory of 900 404 XISE 菜刀管理7.9.exe 54 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" XISE 菜刀管理7.9.exe
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:668
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:612
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"2⤵PID:780
-
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:332
-
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:396
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:384
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵PID:1072
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵PID:1164
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1328
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1396
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:2708
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1516
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1508
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1360
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1608
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1336
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1316
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1908
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:1648
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵PID:1772
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:1980
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2356
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵PID:2476
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:2468
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵PID:2540
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2344
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2552
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2572
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2772
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2900
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3076
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3288
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:512
-
C:\Users\Admin\AppData\Local\Temp\xise\XISE 菜刀管理7.9.exe"C:\Users\Admin\AppData\Local\Temp\xise\XISE 菜刀管理7.9.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:404
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵PID:2560
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2144
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:1216
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3456
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3380
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵PID:1916
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:1896
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵PID:1840
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1752
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵PID:1744
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s FontCache1⤵PID:1620
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1196
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵PID:1124
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:952
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:900
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:956
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:4480
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3720
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3540
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵PID:908
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵PID:796
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding2⤵PID:4844
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe2⤵PID:4640
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:4600
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca2⤵PID:3904
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:452
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵PID:4076
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:1780
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:1380
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵PID:4952
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵PID:2276
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:5048
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time1⤵PID:1960