Analysis
-
max time kernel
151s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
10-10-2022 23:39
Behavioral task
behavioral1
Sample
017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe
Resource
win7-20220812-en
windows7-x64
27 signatures
150 seconds
General
-
Target
017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe
-
Size
657KB
-
MD5
6a1304af0bdb3a90423021ea9b607f31
-
SHA1
b3a8fea4b7a35a5e2461f261e05148481aa19443
-
SHA256
017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e
-
SHA512
79e4e10172cf4f86ddfc340ff77dfdc7a51683b2d42dbbeee94ae2488d5b27f1149c3c846fb8bd71800eacd9c3f00280c269eba6c3e63e21948290d76a567576
-
SSDEEP
12288:iARDO0MVcRoSK6wTx9/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeen:pDO0MWiTx9/eeeeeeeeeeeeeeeeeeee3
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" BitTorrent.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" BitTorrent.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" BitTorrent.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" BitTorrent.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" BitTorrent.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" BitTorrent.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" BitTorrent.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" BitTorrent.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" BitTorrent.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" BitTorrent.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe -
Executes dropped EXE 1 IoCs
pid Process 1092 BitTorrent.exe -
resource yara_rule behavioral1/memory/1612-55-0x0000000002070000-0x00000000030FE000-memory.dmp upx behavioral1/memory/1612-56-0x0000000000400000-0x0000000000552000-memory.dmp upx behavioral1/memory/1612-57-0x0000000002070000-0x00000000030FE000-memory.dmp upx behavioral1/files/0x0009000000013922-59.dat upx behavioral1/files/0x0009000000013922-60.dat upx behavioral1/files/0x0009000000013922-61.dat upx behavioral1/files/0x0009000000013922-62.dat upx behavioral1/files/0x0009000000013922-64.dat upx behavioral1/memory/1092-70-0x0000000000400000-0x0000000000552000-memory.dmp upx behavioral1/memory/1612-72-0x0000000000400000-0x0000000000552000-memory.dmp upx behavioral1/memory/1612-73-0x0000000002070000-0x00000000030FE000-memory.dmp upx behavioral1/files/0x0009000000013922-74.dat upx behavioral1/memory/1092-75-0x00000000036F0000-0x000000000477E000-memory.dmp upx behavioral1/memory/1092-76-0x00000000036F0000-0x000000000477E000-memory.dmp upx behavioral1/memory/1092-79-0x0000000000400000-0x0000000000552000-memory.dmp upx behavioral1/memory/1092-80-0x00000000036F0000-0x000000000477E000-memory.dmp upx -
Deletes itself 1 IoCs
pid Process 2004 cmd.exe -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Wine BitTorrent.exe Key opened \REGISTRY\MACHINE\Software\Wow6432Node\Wine BitTorrent.exe -
Loads dropped DLL 4 IoCs
pid Process 1612 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe 1612 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe 1612 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe 1612 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" BitTorrent.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" BitTorrent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc BitTorrent.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" BitTorrent.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" BitTorrent.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" BitTorrent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" BitTorrent.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run BitTorrent.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" BitTorrent.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe -
Enumerates connected drives 3 TTPs 28 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: BitTorrent.exe File opened (read-only) \??\P: BitTorrent.exe File opened (read-only) \??\G: 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe File opened (read-only) \??\E: BitTorrent.exe File opened (read-only) \??\N: BitTorrent.exe File opened (read-only) \??\O: BitTorrent.exe File opened (read-only) \??\T: BitTorrent.exe File opened (read-only) \??\H: 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe File opened (read-only) \??\I: BitTorrent.exe File opened (read-only) \??\J: BitTorrent.exe File opened (read-only) \??\R: BitTorrent.exe File opened (read-only) \??\W: BitTorrent.exe File opened (read-only) \??\X: BitTorrent.exe File opened (read-only) \??\E: 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe File opened (read-only) \??\H: BitTorrent.exe File opened (read-only) \??\K: BitTorrent.exe File opened (read-only) \??\J: 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe File opened (read-only) \??\M: BitTorrent.exe File opened (read-only) \??\Q: BitTorrent.exe File opened (read-only) \??\Z: BitTorrent.exe File opened (read-only) \??\I: 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe File opened (read-only) \??\S: BitTorrent.exe File opened (read-only) \??\V: BitTorrent.exe File opened (read-only) \??\F: BitTorrent.exe File opened (read-only) \??\F: 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe File opened (read-only) \??\G: BitTorrent.exe File opened (read-only) \??\U: BitTorrent.exe File opened (read-only) \??\Y: BitTorrent.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf BitTorrent.exe -
Drops file in Program Files directory 6 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe BitTorrent.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe BitTorrent.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe BitTorrent.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe BitTorrent.exe File created C:\Program Files (x86)\BitTorrent\BitTorrent.exe 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe BitTorrent.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 17 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.torrent 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\BitTorrent\shell\open 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\BitTorrent\shell\ = "open" 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.torrent\OpenWithProgids 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Applications\BitTorrent.exe 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Applications\BitTorrent.exe\shell\open 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\BitTorrent\shell\open\command\ = "\"C:\\Program Files (x86)\\BitTorrent\\BitTorrent.exe\" \"%1\"" 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Applications\BitTorrent.exe\shell\open\command 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\BitTorrent\shell 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.torrent\OpenWithProgids\BitTorrent 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Applications\BitTorrent.exe\shell 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Applications\BitTorrent.exe\shell\ = "open" 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Applications\BitTorrent.exe\shell\open\command\ = "\"C:\\Program Files (x86)\\BitTorrent\\BitTorrent.exe\" \"%1\"" 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.torrent\ = "BitTorrent" 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\BitTorrent\shell\open\command 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\BitTorrent 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Applications 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1612 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe 1612 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe 1092 BitTorrent.exe 1092 BitTorrent.exe 1092 BitTorrent.exe 1092 BitTorrent.exe 1092 BitTorrent.exe 1092 BitTorrent.exe 1092 BitTorrent.exe 1092 BitTorrent.exe 1092 BitTorrent.exe 1092 BitTorrent.exe 1092 BitTorrent.exe 1092 BitTorrent.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1092 BitTorrent.exe -
Suspicious use of AdjustPrivilegeToken 39 IoCs
description pid Process Token: SeDebugPrivilege 1612 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Token: SeDebugPrivilege 1612 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Token: SeDebugPrivilege 1612 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Token: SeDebugPrivilege 1612 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Token: SeDebugPrivilege 1612 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Token: SeDebugPrivilege 1612 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Token: SeDebugPrivilege 1612 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Token: SeDebugPrivilege 1612 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Token: SeDebugPrivilege 1612 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Token: SeDebugPrivilege 1612 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Token: SeDebugPrivilege 1612 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Token: SeDebugPrivilege 1612 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Token: SeDebugPrivilege 1612 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Token: SeDebugPrivilege 1612 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Token: SeDebugPrivilege 1612 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Token: SeDebugPrivilege 1612 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Token: SeDebugPrivilege 1612 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Token: SeDebugPrivilege 1612 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Token: SeDebugPrivilege 1612 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Token: SeIncBasePriorityPrivilege 1612 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe Token: SeDebugPrivilege 1092 BitTorrent.exe Token: SeDebugPrivilege 1092 BitTorrent.exe Token: SeDebugPrivilege 1092 BitTorrent.exe Token: SeDebugPrivilege 1092 BitTorrent.exe Token: SeDebugPrivilege 1092 BitTorrent.exe Token: SeDebugPrivilege 1092 BitTorrent.exe Token: SeDebugPrivilege 1092 BitTorrent.exe Token: SeDebugPrivilege 1092 BitTorrent.exe Token: SeDebugPrivilege 1092 BitTorrent.exe Token: SeDebugPrivilege 1092 BitTorrent.exe Token: SeDebugPrivilege 1092 BitTorrent.exe Token: SeDebugPrivilege 1092 BitTorrent.exe Token: SeDebugPrivilege 1092 BitTorrent.exe Token: SeDebugPrivilege 1092 BitTorrent.exe Token: SeDebugPrivilege 1092 BitTorrent.exe Token: SeDebugPrivilege 1092 BitTorrent.exe Token: SeDebugPrivilege 1092 BitTorrent.exe Token: SeDebugPrivilege 1092 BitTorrent.exe Token: SeDebugPrivilege 1092 BitTorrent.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1092 BitTorrent.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1092 BitTorrent.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1612 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe 1092 BitTorrent.exe -
Suspicious use of WriteProcessMemory 50 IoCs
description pid Process procid_target PID 1612 wrote to memory of 1240 1612 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe 10 PID 1612 wrote to memory of 1320 1612 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe 16 PID 1612 wrote to memory of 1356 1612 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe 15 PID 1612 wrote to memory of 1240 1612 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe 10 PID 1612 wrote to memory of 1320 1612 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe 16 PID 1612 wrote to memory of 1356 1612 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe 15 PID 1612 wrote to memory of 1092 1612 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe 26 PID 1612 wrote to memory of 1092 1612 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe 26 PID 1612 wrote to memory of 1092 1612 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe 26 PID 1612 wrote to memory of 1092 1612 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe 26 PID 1612 wrote to memory of 2004 1612 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe 27 PID 1612 wrote to memory of 2004 1612 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe 27 PID 1612 wrote to memory of 2004 1612 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe 27 PID 1612 wrote to memory of 2004 1612 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe 27 PID 1092 wrote to memory of 1240 1092 BitTorrent.exe 10 PID 1092 wrote to memory of 1320 1092 BitTorrent.exe 16 PID 1092 wrote to memory of 1356 1092 BitTorrent.exe 15 PID 1092 wrote to memory of 1240 1092 BitTorrent.exe 10 PID 1092 wrote to memory of 1320 1092 BitTorrent.exe 16 PID 1092 wrote to memory of 1356 1092 BitTorrent.exe 15 PID 1092 wrote to memory of 1240 1092 BitTorrent.exe 10 PID 1092 wrote to memory of 1320 1092 BitTorrent.exe 16 PID 1092 wrote to memory of 1356 1092 BitTorrent.exe 15 PID 1092 wrote to memory of 1240 1092 BitTorrent.exe 10 PID 1092 wrote to memory of 1320 1092 BitTorrent.exe 16 PID 1092 wrote to memory of 1356 1092 BitTorrent.exe 15 PID 1092 wrote to memory of 1240 1092 BitTorrent.exe 10 PID 1092 wrote to memory of 1320 1092 BitTorrent.exe 16 PID 1092 wrote to memory of 1356 1092 BitTorrent.exe 15 PID 1092 wrote to memory of 1240 1092 BitTorrent.exe 10 PID 1092 wrote to memory of 1320 1092 BitTorrent.exe 16 PID 1092 wrote to memory of 1356 1092 BitTorrent.exe 15 PID 1092 wrote to memory of 1240 1092 BitTorrent.exe 10 PID 1092 wrote to memory of 1320 1092 BitTorrent.exe 16 PID 1092 wrote to memory of 1356 1092 BitTorrent.exe 15 PID 1092 wrote to memory of 1240 1092 BitTorrent.exe 10 PID 1092 wrote to memory of 1320 1092 BitTorrent.exe 16 PID 1092 wrote to memory of 1356 1092 BitTorrent.exe 15 PID 1092 wrote to memory of 1240 1092 BitTorrent.exe 10 PID 1092 wrote to memory of 1320 1092 BitTorrent.exe 16 PID 1092 wrote to memory of 1356 1092 BitTorrent.exe 15 PID 1092 wrote to memory of 1240 1092 BitTorrent.exe 10 PID 1092 wrote to memory of 1320 1092 BitTorrent.exe 16 PID 1092 wrote to memory of 1356 1092 BitTorrent.exe 15 PID 1092 wrote to memory of 1240 1092 BitTorrent.exe 10 PID 1092 wrote to memory of 1320 1092 BitTorrent.exe 16 PID 1092 wrote to memory of 1356 1092 BitTorrent.exe 15 PID 1092 wrote to memory of 1240 1092 BitTorrent.exe 10 PID 1092 wrote to memory of 1320 1092 BitTorrent.exe 16 PID 1092 wrote to memory of 1356 1092 BitTorrent.exe 15 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" BitTorrent.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1240
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe"C:\Users\Admin\AppData\Local\Temp\017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1612 -
C:\Program Files (x86)\BitTorrent\BitTorrent.exeBitTorrent.exe /NOINSTALL /BRINGTOFRONT3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1092
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\017AE8~1.EXE > nul3⤵
- Deletes itself
PID:2004
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1320
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
657KB
MD56a1304af0bdb3a90423021ea9b607f31
SHA1b3a8fea4b7a35a5e2461f261e05148481aa19443
SHA256017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e
SHA51279e4e10172cf4f86ddfc340ff77dfdc7a51683b2d42dbbeee94ae2488d5b27f1149c3c846fb8bd71800eacd9c3f00280c269eba6c3e63e21948290d76a567576
-
Filesize
657KB
MD56a1304af0bdb3a90423021ea9b607f31
SHA1b3a8fea4b7a35a5e2461f261e05148481aa19443
SHA256017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e
SHA51279e4e10172cf4f86ddfc340ff77dfdc7a51683b2d42dbbeee94ae2488d5b27f1149c3c846fb8bd71800eacd9c3f00280c269eba6c3e63e21948290d76a567576
-
Filesize
255B
MD52a610d6ee65a3e5310302ec31596e0f6
SHA15698971b3452ed1cc53e28e35cc53871bffd2135
SHA2569dbc0993ea68d56683cb619ca1e82f13e18aff810cfc9e3dec84b33bd6b61a87
SHA51264b98f8e528e5531a8de05515cae176d728d40c820868f516a585cd15f8b5757edf6ff055eaf45607287d53df0e7b314fba8c9ac097bcea3e51926c3c5765279
-
Filesize
657KB
MD56a1304af0bdb3a90423021ea9b607f31
SHA1b3a8fea4b7a35a5e2461f261e05148481aa19443
SHA256017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e
SHA51279e4e10172cf4f86ddfc340ff77dfdc7a51683b2d42dbbeee94ae2488d5b27f1149c3c846fb8bd71800eacd9c3f00280c269eba6c3e63e21948290d76a567576
-
Filesize
657KB
MD56a1304af0bdb3a90423021ea9b607f31
SHA1b3a8fea4b7a35a5e2461f261e05148481aa19443
SHA256017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e
SHA51279e4e10172cf4f86ddfc340ff77dfdc7a51683b2d42dbbeee94ae2488d5b27f1149c3c846fb8bd71800eacd9c3f00280c269eba6c3e63e21948290d76a567576
-
Filesize
657KB
MD56a1304af0bdb3a90423021ea9b607f31
SHA1b3a8fea4b7a35a5e2461f261e05148481aa19443
SHA256017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e
SHA51279e4e10172cf4f86ddfc340ff77dfdc7a51683b2d42dbbeee94ae2488d5b27f1149c3c846fb8bd71800eacd9c3f00280c269eba6c3e63e21948290d76a567576
-
Filesize
657KB
MD56a1304af0bdb3a90423021ea9b607f31
SHA1b3a8fea4b7a35a5e2461f261e05148481aa19443
SHA256017ae8666f5f4cfd7ee853a2e506f9607a11c4e99481f1c2f8b8ee974ef5a13e
SHA51279e4e10172cf4f86ddfc340ff77dfdc7a51683b2d42dbbeee94ae2488d5b27f1149c3c846fb8bd71800eacd9c3f00280c269eba6c3e63e21948290d76a567576