sality | 844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee

Analysis

max time kernel
148s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 16:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Size

142KB
MD5

04fcc30dc19ef4b80a75212e6eed46dc
SHA1

000721d3947af3f015fbe79e3ff61bbde8ddf280
SHA256

844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee
SHA512

1fe8f2eef44954771a0f0c82211a1f58fb609d682cbe8ca17a6afa572d9c09f6212817f57ace14e625dd87f8f10e506fdca7dd447f78ec0d5477a3e8032297fa
SSDEEP

3072:pNQKPWDygI0CLsICg92cnyeDr24JMvTd2/xU1TeX0mZ:pNSDygINsXg4DTUxxkmZ

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1"	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe

Disables Task Manager via registry modification
evasion

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
3700	netsh.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1152-133-0x0000000002440000-0x0000000003470000-memory.dmp	upx
behavioral2/memory/1152-135-0x0000000002440000-0x0000000003470000-memory.dmp	upx
behavioral2/memory/1152-136-0x0000000002440000-0x0000000003470000-memory.dmp	upx

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zFM.exe	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7z.exe	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zG.exe	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\Uninstall.exe	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SYSTEM.INI	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Token: SeDebugPrivilege	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 3700	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	79
PID 1152 wrote to memory of 3700	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	79
PID 1152 wrote to memory of 3700	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	79
PID 1152 wrote to memory of 784	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	8
PID 1152 wrote to memory of 792	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	75
PID 1152 wrote to memory of 312	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	10
PID 1152 wrote to memory of 2320	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	50
PID 1152 wrote to memory of 2336	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	49
PID 1152 wrote to memory of 2448	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	16
PID 1152 wrote to memory of 2984	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	41
PID 1152 wrote to memory of 2840	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	40
PID 1152 wrote to memory of 3264	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	39
PID 1152 wrote to memory of 3356	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	19
PID 1152 wrote to memory of 3424	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	20
PID 1152 wrote to memory of 3516	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	38
PID 1152 wrote to memory of 3692	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	37
PID 1152 wrote to memory of 4596	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	34
PID 1152 wrote to memory of 4128	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	23
PID 1152 wrote to memory of 3948	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	78
PID 1152 wrote to memory of 784	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	8
PID 1152 wrote to memory of 792	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	75
PID 1152 wrote to memory of 312	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	10
PID 1152 wrote to memory of 2320	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	50
PID 1152 wrote to memory of 2336	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	49
PID 1152 wrote to memory of 2448	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	16
PID 1152 wrote to memory of 2984	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	41
PID 1152 wrote to memory of 2840	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	40
PID 1152 wrote to memory of 3264	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	39
PID 1152 wrote to memory of 3356	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	19
PID 1152 wrote to memory of 3424	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	20
PID 1152 wrote to memory of 3516	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	38
PID 1152 wrote to memory of 3692	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	37
PID 1152 wrote to memory of 4596	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	34
PID 1152 wrote to memory of 3948	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	78
PID 1152 wrote to memory of 784	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	8
PID 1152 wrote to memory of 792	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	75
PID 1152 wrote to memory of 312	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	10
PID 1152 wrote to memory of 2320	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	50
PID 1152 wrote to memory of 2336	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	49
PID 1152 wrote to memory of 2448	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	16
PID 1152 wrote to memory of 2984	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	41
PID 1152 wrote to memory of 2840	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	40
PID 1152 wrote to memory of 3264	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	39
PID 1152 wrote to memory of 3356	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	19
PID 1152 wrote to memory of 3424	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	20
PID 1152 wrote to memory of 3516	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	38
PID 1152 wrote to memory of 3692	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	37
PID 1152 wrote to memory of 4596	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	34
PID 1152 wrote to memory of 3948	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	78
PID 1152 wrote to memory of 784	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	8
PID 1152 wrote to memory of 792	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	75
PID 1152 wrote to memory of 312	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	10
PID 1152 wrote to memory of 2320	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	50
PID 1152 wrote to memory of 2336	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	49
PID 1152 wrote to memory of 2448	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	16
PID 1152 wrote to memory of 2984	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	41
PID 1152 wrote to memory of 2840	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	40
PID 1152 wrote to memory of 3264	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	39
PID 1152 wrote to memory of 3356	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	19
PID 1152 wrote to memory of 3424	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	20
PID 1152 wrote to memory of 3516	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	38
PID 1152 wrote to memory of 3692	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	37
PID 1152 wrote to memory of 4596	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	34
PID 1152 wrote to memory of 3948	1152	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe	78

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:784

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:312

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2448

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3356

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3424

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:4128

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4596

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3692

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3516

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:2840

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2984
- C:\Users\Admin\AppData\Local\Temp\844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
  "C:\Users\Admin\AppData\Local\Temp\844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe"
  2⤵
  - UAC bypass
  - Disables RegEdit via registry modification
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1152
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall set opmode disable
    3⤵
    - Modifies Windows Firewall
    PID:3700
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE"
    3⤵
    PID:2996
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE"
    3⤵
    PID:2940
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE"
    3⤵
    PID:3572
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE"
    3⤵
    PID:1916
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE"
    3⤵
    PID:3856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2336

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2320

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:792

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1152-132-0x0000000001000000-0x0000000001027000-memory.dmp

Filesize
156KB

Download
memory/1152-133-0x0000000002440000-0x0000000003470000-memory.dmp

Filesize
16.2MB

Download
memory/1152-147-0x0000000001000000-0x0000000001027000-memory.dmp

Filesize
156KB

Download
memory/1152-135-0x0000000002440000-0x0000000003470000-memory.dmp

Filesize
16.2MB

Download
memory/1152-136-0x0000000002440000-0x0000000003470000-memory.dmp

Filesize
16.2MB

Download
memory/1916-144-0x0000000000F20000-0x0000000000F37000-memory.dmp

Filesize
92KB

Download
memory/2940-140-0x0000000001220000-0x0000000001237000-memory.dmp

Filesize
92KB

Download
memory/2996-138-0x0000000000330000-0x0000000000347000-memory.dmp

Filesize
92KB

Download
memory/3572-142-0x0000000001220000-0x0000000001237000-memory.dmp

Filesize
92KB

Download
memory/3856-146-0x0000000000F40000-0x0000000000F57000-memory.dmp

Filesize
92KB

Download