Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
01/10/2022, 23:56
Static task
static1
Behavioral task
behavioral1
Sample
a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe
Resource
win7-20220812-en
windows7-x64
21 signatures
150 seconds
General
-
Target
a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe
-
Size
187KB
-
MD5
652fe67abc4fc0f30fb5e6ea103aeebe
-
SHA1
9f61655f762ab001915cbbc8a84a324f1eead7dc
-
SHA256
a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab
-
SHA512
3cb8384684ef864cc2ebe5458c994e248e25cb02326cda14980f3ba72f9ecba353a00ac6c1d48d3fc6c8ab184a78017c2ad7b1ca8e702cbb84566d1c7557b186
-
SSDEEP
3072:St1Z9xolp4D4dMz4n4N4t4R4aEIIIIzDMY5pdRvuJOtkedrfNkq35vU:e1Z9xolxMdEIIIIzL5dgOphHU
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" fuemee.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe -
Executes dropped EXE 1 IoCs
pid Process 2660 fuemee.exe -
resource yara_rule behavioral2/memory/4048-132-0x0000000002BA0000-0x0000000003C2E000-memory.dmp upx behavioral2/memory/4048-136-0x0000000002BA0000-0x0000000003C2E000-memory.dmp upx behavioral2/memory/4048-143-0x0000000002BA0000-0x0000000003C2E000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\ fuemee.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fuemee = "C:\\Users\\Admin\\fuemee.exe" fuemee.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe File opened (read-only) \??\O: a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe File opened (read-only) \??\P: a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe File opened (read-only) \??\Q: a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe File opened (read-only) \??\Y: a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe File opened (read-only) \??\E: a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe File opened (read-only) \??\H: a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe File opened (read-only) \??\L: a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe File opened (read-only) \??\U: a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe File opened (read-only) \??\V: a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe File opened (read-only) \??\F: a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe File opened (read-only) \??\J: a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe File opened (read-only) \??\K: a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe File opened (read-only) \??\Z: a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe File opened (read-only) \??\G: a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe File opened (read-only) \??\I: a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe File opened (read-only) \??\S: a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe File opened (read-only) \??\T: a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe File opened (read-only) \??\W: a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe File opened (read-only) \??\X: a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe File opened (read-only) \??\N: a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe File opened (read-only) \??\R: a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe -
Drops file in Program Files directory 11 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe 2660 fuemee.exe 2660 fuemee.exe 2660 fuemee.exe 2660 fuemee.exe 2660 fuemee.exe 2660 fuemee.exe 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe 2660 fuemee.exe 2660 fuemee.exe 2660 fuemee.exe 2660 fuemee.exe 2660 fuemee.exe 2660 fuemee.exe 2660 fuemee.exe 2660 fuemee.exe 2660 fuemee.exe 2660 fuemee.exe 2660 fuemee.exe 2660 fuemee.exe 2660 fuemee.exe 2660 fuemee.exe 2660 fuemee.exe 2660 fuemee.exe 2660 fuemee.exe 2660 fuemee.exe 2660 fuemee.exe 2660 fuemee.exe 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe 2660 fuemee.exe 2660 fuemee.exe 2660 fuemee.exe 2660 fuemee.exe 2660 fuemee.exe 2660 fuemee.exe 2660 fuemee.exe 2660 fuemee.exe 2660 fuemee.exe 2660 fuemee.exe 2660 fuemee.exe 2660 fuemee.exe 2660 fuemee.exe 2660 fuemee.exe 2660 fuemee.exe 2660 fuemee.exe 2660 fuemee.exe 2660 fuemee.exe 2660 fuemee.exe 2660 fuemee.exe 2660 fuemee.exe 2660 fuemee.exe 2660 fuemee.exe 2660 fuemee.exe 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe 2660 fuemee.exe 2660 fuemee.exe 2660 fuemee.exe 2660 fuemee.exe 2660 fuemee.exe 2660 fuemee.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe Token: SeDebugPrivilege 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe 2660 fuemee.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4048 wrote to memory of 768 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe 8 PID 4048 wrote to memory of 776 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe 81 PID 4048 wrote to memory of 328 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe 10 PID 4048 wrote to memory of 2348 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe 58 PID 4048 wrote to memory of 2356 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe 57 PID 4048 wrote to memory of 2560 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe 53 PID 4048 wrote to memory of 2416 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe 49 PID 4048 wrote to memory of 2800 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe 22 PID 4048 wrote to memory of 3272 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe 48 PID 4048 wrote to memory of 3372 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe 47 PID 4048 wrote to memory of 3436 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe 23 PID 4048 wrote to memory of 3528 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe 46 PID 4048 wrote to memory of 3804 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe 45 PID 4048 wrote to memory of 4680 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe 43 PID 4048 wrote to memory of 4472 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe 29 PID 4048 wrote to memory of 4764 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe 28 PID 4048 wrote to memory of 2660 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe 86 PID 4048 wrote to memory of 2660 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe 86 PID 4048 wrote to memory of 2660 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe 86 PID 2660 wrote to memory of 4048 2660 fuemee.exe 82 PID 2660 wrote to memory of 4048 2660 fuemee.exe 82 PID 2660 wrote to memory of 4048 2660 fuemee.exe 82 PID 2660 wrote to memory of 4048 2660 fuemee.exe 82 PID 4048 wrote to memory of 768 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe 8 PID 4048 wrote to memory of 776 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe 81 PID 4048 wrote to memory of 328 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe 10 PID 4048 wrote to memory of 2348 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe 58 PID 4048 wrote to memory of 2356 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe 57 PID 4048 wrote to memory of 2560 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe 53 PID 4048 wrote to memory of 2416 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe 49 PID 4048 wrote to memory of 2800 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe 22 PID 4048 wrote to memory of 3272 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe 48 PID 4048 wrote to memory of 3372 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe 47 PID 4048 wrote to memory of 3436 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe 23 PID 4048 wrote to memory of 3528 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe 46 PID 4048 wrote to memory of 3804 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe 45 PID 4048 wrote to memory of 4680 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe 43 PID 4048 wrote to memory of 4472 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe 29 PID 4048 wrote to memory of 4764 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe 28 PID 4048 wrote to memory of 2328 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe 83 PID 4048 wrote to memory of 2660 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe 86 PID 4048 wrote to memory of 2660 4048 a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe 86 PID 2660 wrote to memory of 4048 2660 fuemee.exe 82 PID 2660 wrote to memory of 4048 2660 fuemee.exe 82 PID 2660 wrote to memory of 4048 2660 fuemee.exe 82 PID 2660 wrote to memory of 4048 2660 fuemee.exe 82 PID 2660 wrote to memory of 4048 2660 fuemee.exe 82 PID 2660 wrote to memory of 4048 2660 fuemee.exe 82 PID 2660 wrote to memory of 4048 2660 fuemee.exe 82 PID 2660 wrote to memory of 4048 2660 fuemee.exe 82 PID 2660 wrote to memory of 4048 2660 fuemee.exe 82 PID 2660 wrote to memory of 4048 2660 fuemee.exe 82 PID 2660 wrote to memory of 4048 2660 fuemee.exe 82 PID 2660 wrote to memory of 4048 2660 fuemee.exe 82 PID 2660 wrote to memory of 4048 2660 fuemee.exe 82 PID 2660 wrote to memory of 4048 2660 fuemee.exe 82 PID 2660 wrote to memory of 4048 2660 fuemee.exe 82 PID 2660 wrote to memory of 4048 2660 fuemee.exe 82 PID 2660 wrote to memory of 4048 2660 fuemee.exe 82 PID 2660 wrote to memory of 4048 2660 fuemee.exe 82 PID 2660 wrote to memory of 4048 2660 fuemee.exe 82 PID 2660 wrote to memory of 4048 2660 fuemee.exe 82 PID 2660 wrote to memory of 4048 2660 fuemee.exe 82 PID 2660 wrote to memory of 4048 2660 fuemee.exe 82 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:768
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:328
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:2800
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3436
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:4764
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:4472
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4680
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3804
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3528
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3372
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3272
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe"C:\Users\Admin\AppData\Local\Temp\a471627cdd65a615ad5180ee861b0d5c231d594d385505d41709b702916165ab.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4048 -
C:\Users\Admin\fuemee.exe"C:\Users\Admin\fuemee.exe"3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2660
-
-
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2560
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2356
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2348
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:776
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2328
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵PID:4524
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
1Modify Existing Service
1Registry Run Keys / Startup Folder
1Defense Evasion
Bypass User Account Control
1Disabling Security Tools
3Hidden Files and Directories
1Modify Registry
7Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
187KB
MD54ff831c16f21176c8a54791b9dcb9891
SHA1faae59a5e230bdb4f0780ad376b8037566d0a435
SHA256abe401bbf3304f279ea13782bd65d2d5f4d8ac416a344ce795e38405b4cb053c
SHA512a645b7f12f7218634dc8951ded00e25afd3b6713a17702379dace17d2bcd28088a3921fa28ce26044007aeff925293cb4d5f0a71b3061f288bf9d9192201ae2b
-
Filesize
187KB
MD54ff831c16f21176c8a54791b9dcb9891
SHA1faae59a5e230bdb4f0780ad376b8037566d0a435
SHA256abe401bbf3304f279ea13782bd65d2d5f4d8ac416a344ce795e38405b4cb053c
SHA512a645b7f12f7218634dc8951ded00e25afd3b6713a17702379dace17d2bcd28088a3921fa28ce26044007aeff925293cb4d5f0a71b3061f288bf9d9192201ae2b