Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2022, 04:03
Static task
static1
Behavioral task
behavioral1
Sample
b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe
Resource
win7-20220901-en
windows7-x64
19 signatures
150 seconds
General
-
Target
b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe
-
Size
260KB
-
MD5
6e262f942aa819fe4555bc41df893c60
-
SHA1
ebcbdece979ecdb400e2dfe2a101ed15a8a1de25
-
SHA256
b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6
-
SHA512
736a5547b4c953d052575f959830f447a9a8f55d817cefa1704b1ec1e2a4f934ece18041d6ca10f28c4f245b384840e4388da4bb7520be64d6f3773000d85cbd
-
SSDEEP
6144:wj16JTe7QDT1lC7H0q6k+RCoXe8xrubntZ8u:m8JC8DT1lsHZv4BekEtZh
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe -
Executes dropped EXE 2 IoCs
pid Process 3180 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 4496 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe -
resource yara_rule behavioral2/memory/2784-133-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2784-134-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2784-135-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2784-143-0x0000000002350000-0x00000000033DE000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Wfkkkg = "C:\\Users\\Admin\\AppData\\Roaming\\Identities\\Wfkkkg.exe" notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Adobe System Incorporated = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Adobe\\Reader_sl.exe" svchost.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe -
Enumerates connected drives 3 TTPs 33 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: svchost.exe File opened (read-only) \??\H: svchost.exe File opened (read-only) \??\P: svchost.exe File opened (read-only) \??\E: b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe File opened (read-only) \??\K: svchost.exe File opened (read-only) \??\N: svchost.exe File opened (read-only) \??\R: svchost.exe File opened (read-only) \??\K: b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe File opened (read-only) \??\L: b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe File opened (read-only) \??\F: svchost.exe File opened (read-only) \??\V: svchost.exe File opened (read-only) \??\Y: svchost.exe File opened (read-only) \??\H: b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe File opened (read-only) \??\Q: svchost.exe File opened (read-only) \??\U: svchost.exe File opened (read-only) \??\Z: svchost.exe File opened (read-only) \??\G: b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe File opened (read-only) \??\M: b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe File opened (read-only) \??\J: svchost.exe File opened (read-only) \??\T: svchost.exe File opened (read-only) \??\X: svchost.exe File opened (read-only) \??\J: b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe File opened (read-only) \??\B: svchost.exe File opened (read-only) \??\D: notepad.exe File opened (read-only) \??\F: b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe File opened (read-only) \??\I: b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe File opened (read-only) \??\G: svchost.exe File opened (read-only) \??\I: svchost.exe File opened (read-only) \??\M: svchost.exe File opened (read-only) \??\W: svchost.exe File opened (read-only) \??\L: svchost.exe File opened (read-only) \??\O: svchost.exe File opened (read-only) \??\S: svchost.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2784 set thread context of 3180 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 90 PID 3180 set thread context of 4496 3180 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 94 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 3464 svchost.exe 3464 svchost.exe 4496 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 4496 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 4496 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3180 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe Token: SeDebugPrivilege 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2784 wrote to memory of 788 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 8 PID 2784 wrote to memory of 796 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 80 PID 2784 wrote to memory of 328 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 9 PID 2784 wrote to memory of 2308 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 61 PID 2784 wrote to memory of 2324 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 60 PID 2784 wrote to memory of 2424 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 59 PID 2784 wrote to memory of 3048 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 26 PID 2784 wrote to memory of 768 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 27 PID 2784 wrote to memory of 3248 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 29 PID 2784 wrote to memory of 3348 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 31 PID 2784 wrote to memory of 3412 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 32 PID 2784 wrote to memory of 3500 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 33 PID 2784 wrote to memory of 3840 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 39 PID 2784 wrote to memory of 4896 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 38 PID 2784 wrote to memory of 1416 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 41 PID 2784 wrote to memory of 4852 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 43 PID 2784 wrote to memory of 788 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 8 PID 2784 wrote to memory of 796 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 80 PID 2784 wrote to memory of 328 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 9 PID 2784 wrote to memory of 2308 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 61 PID 2784 wrote to memory of 2324 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 60 PID 2784 wrote to memory of 2424 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 59 PID 2784 wrote to memory of 3048 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 26 PID 2784 wrote to memory of 768 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 27 PID 2784 wrote to memory of 3248 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 29 PID 2784 wrote to memory of 3348 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 31 PID 2784 wrote to memory of 3412 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 32 PID 2784 wrote to memory of 3500 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 33 PID 2784 wrote to memory of 3840 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 39 PID 2784 wrote to memory of 4896 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 38 PID 2784 wrote to memory of 1416 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 41 PID 2784 wrote to memory of 3180 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 90 PID 2784 wrote to memory of 3180 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 90 PID 2784 wrote to memory of 3180 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 90 PID 2784 wrote to memory of 3180 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 90 PID 2784 wrote to memory of 3180 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 90 PID 2784 wrote to memory of 3180 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 90 PID 2784 wrote to memory of 3180 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 90 PID 2784 wrote to memory of 3180 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 90 PID 2784 wrote to memory of 3180 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 90 PID 2784 wrote to memory of 3180 2784 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 90 PID 3180 wrote to memory of 3464 3180 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 91 PID 3180 wrote to memory of 3464 3180 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 91 PID 3180 wrote to memory of 3464 3180 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 91 PID 3180 wrote to memory of 3464 3180 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 91 PID 3180 wrote to memory of 3668 3180 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 92 PID 3180 wrote to memory of 3668 3180 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 92 PID 3180 wrote to memory of 3668 3180 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 92 PID 3180 wrote to memory of 3668 3180 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 92 PID 3180 wrote to memory of 3668 3180 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 92 PID 3464 wrote to memory of 3592 3464 svchost.exe 93 PID 3464 wrote to memory of 3592 3464 svchost.exe 93 PID 3464 wrote to memory of 3592 3464 svchost.exe 93 PID 3464 wrote to memory of 3592 3464 svchost.exe 93 PID 3180 wrote to memory of 4496 3180 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 94 PID 3180 wrote to memory of 4496 3180 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 94 PID 3180 wrote to memory of 4496 3180 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 94 PID 3180 wrote to memory of 4496 3180 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 94 PID 3180 wrote to memory of 4496 3180 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 94 PID 3180 wrote to memory of 4496 3180 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 94 PID 3180 wrote to memory of 4496 3180 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 94 PID 3180 wrote to memory of 4496 3180 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 94 PID 3180 wrote to memory of 4496 3180 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 94 PID 4496 wrote to memory of 3464 4496 b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe 91 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:328
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe"C:\Users\Admin\AppData\Local\Temp\b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe"C:\Users\Admin\AppData\Local\Temp\b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"4⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\SysWOW64\notepad.exe"5⤵
- Adds Run key to start application
- Enumerates connected drives
PID:3592
-
-
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\SysWOW64\calc.exe"4⤵PID:3668
-
-
C:\Users\Admin\AppData\Local\Temp\b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe"C:\Users\Admin\AppData\Local\Temp\b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4496
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:768
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3248
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3348
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3412
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3500
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4896
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3840
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1416
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:4852
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2424
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2324
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2308
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:796
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3508
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe
Filesize260KB
MD56e262f942aa819fe4555bc41df893c60
SHA1ebcbdece979ecdb400e2dfe2a101ed15a8a1de25
SHA256b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6
SHA512736a5547b4c953d052575f959830f447a9a8f55d817cefa1704b1ec1e2a4f934ece18041d6ca10f28c4f245b384840e4388da4bb7520be64d6f3773000d85cbd
-
C:\Users\Admin\AppData\Local\Temp\b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6.exe
Filesize260KB
MD56e262f942aa819fe4555bc41df893c60
SHA1ebcbdece979ecdb400e2dfe2a101ed15a8a1de25
SHA256b9605f80ee0f224142ca3d2f614d618c64eb7d351ea21f95bc7d56fed56e69e6
SHA512736a5547b4c953d052575f959830f447a9a8f55d817cefa1704b1ec1e2a4f934ece18041d6ca10f28c4f245b384840e4388da4bb7520be64d6f3773000d85cbd