Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
166s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20/10/2022, 23:38
Static task
static1
Behavioral task
behavioral1
Sample
f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe
Resource
win7-20220901-en
windows7-x64
2 signatures
150 seconds
General
-
Target
f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe
-
Size
167KB
-
MD5
4e8bd18c20a9b053f9727eb5f8e3c037
-
SHA1
5d4750302bbef963434d8ce660a9ba618987cf5f
-
SHA256
f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179
-
SHA512
48a8cbbb886ad80b1d9d1835ceda6c822dbb0fc991d5fe6e44570d5f04939ca3a9534df7756f5c5811efdd7677cf76707f212fa7d474dff5a8b0f7cfda2e2393
-
SSDEEP
3072:hvzNWVMw6g5ZX73Plewmh0Bx4rWDNvXwmas/V74Ilj3qozhAvsx:FNWVM5wmSErWpvNeIp7Sy
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Jfjhjq.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" Jfjhjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" Jfjhjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" Jfjhjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" Jfjhjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" Jfjhjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" Jfjhjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe -
Disables RegEdit via registry modification 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" Jfjhjq.exe -
Disables Task Manager via registry modification
-
Executes dropped EXE 3 IoCs
pid Process 4780 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe 2276 Jfjhjq.exe 116 Jfjhjq.exe -
Modifies Windows Firewall 1 TTPs 2 IoCs
pid Process 3908 netsh.exe 444 netsh.exe -
resource yara_rule behavioral2/memory/4268-134-0x0000000002360000-0x0000000003393000-memory.dmp upx behavioral2/memory/4268-136-0x0000000002360000-0x0000000003393000-memory.dmp upx behavioral2/memory/4268-144-0x0000000002360000-0x0000000003393000-memory.dmp upx behavioral2/memory/2276-149-0x0000000002310000-0x0000000003343000-memory.dmp upx behavioral2/memory/2276-152-0x0000000002310000-0x0000000003343000-memory.dmp upx behavioral2/memory/2276-159-0x0000000002310000-0x0000000003343000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" Jfjhjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" Jfjhjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" Jfjhjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" Jfjhjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" Jfjhjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" Jfjhjq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jfjhjq.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Jfjhjq = "C:\\Users\\Admin\\AppData\\Roaming\\Jfjhjq.exe" f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Jfjhjq.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4268 set thread context of 4780 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe 86 PID 2276 set thread context of 116 2276 Jfjhjq.exe 93 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "846581886" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30991634" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30991634" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "373096877" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{513217BC-5105-11ED-B696-72E07057041D} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "846581886" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe 4780 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe 4780 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe 2276 Jfjhjq.exe 2276 Jfjhjq.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Token: SeDebugPrivilege 2276 Jfjhjq.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1840 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1840 IEXPLORE.EXE 1840 IEXPLORE.EXE 4368 IEXPLORE.EXE 4368 IEXPLORE.EXE 4368 IEXPLORE.EXE 4368 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4268 wrote to memory of 784 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe 69 PID 4268 wrote to memory of 792 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe 68 PID 4268 wrote to memory of 312 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe 65 PID 4268 wrote to memory of 3908 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe 79 PID 4268 wrote to memory of 3908 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe 79 PID 4268 wrote to memory of 3908 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe 79 PID 4268 wrote to memory of 2320 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe 36 PID 4268 wrote to memory of 2336 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe 35 PID 4268 wrote to memory of 2448 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe 34 PID 4268 wrote to memory of 2984 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe 24 PID 4268 wrote to memory of 2840 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe 23 PID 4268 wrote to memory of 3264 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe 22 PID 4268 wrote to memory of 3356 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe 21 PID 4268 wrote to memory of 3424 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe 20 PID 4268 wrote to memory of 3516 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe 19 PID 4268 wrote to memory of 3692 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe 18 PID 4268 wrote to memory of 4596 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe 15 PID 4268 wrote to memory of 4420 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe 4 PID 4268 wrote to memory of 1048 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe 1 PID 4268 wrote to memory of 4780 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe 86 PID 4268 wrote to memory of 4780 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe 86 PID 4268 wrote to memory of 4780 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe 86 PID 4268 wrote to memory of 4780 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe 86 PID 4268 wrote to memory of 4780 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe 86 PID 4268 wrote to memory of 4780 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe 86 PID 4268 wrote to memory of 4780 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe 86 PID 4268 wrote to memory of 4780 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe 86 PID 4268 wrote to memory of 4780 4268 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe 86 PID 4780 wrote to memory of 2276 4780 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe 90 PID 4780 wrote to memory of 2276 4780 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe 90 PID 4780 wrote to memory of 2276 4780 f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe 90 PID 2276 wrote to memory of 784 2276 Jfjhjq.exe 69 PID 2276 wrote to memory of 444 2276 Jfjhjq.exe 91 PID 2276 wrote to memory of 792 2276 Jfjhjq.exe 68 PID 2276 wrote to memory of 444 2276 Jfjhjq.exe 91 PID 2276 wrote to memory of 444 2276 Jfjhjq.exe 91 PID 2276 wrote to memory of 312 2276 Jfjhjq.exe 65 PID 2276 wrote to memory of 2320 2276 Jfjhjq.exe 36 PID 2276 wrote to memory of 2336 2276 Jfjhjq.exe 35 PID 2276 wrote to memory of 2448 2276 Jfjhjq.exe 34 PID 2276 wrote to memory of 2984 2276 Jfjhjq.exe 24 PID 2276 wrote to memory of 2840 2276 Jfjhjq.exe 23 PID 2276 wrote to memory of 3264 2276 Jfjhjq.exe 22 PID 2276 wrote to memory of 3356 2276 Jfjhjq.exe 21 PID 2276 wrote to memory of 3424 2276 Jfjhjq.exe 20 PID 2276 wrote to memory of 3516 2276 Jfjhjq.exe 19 PID 2276 wrote to memory of 3692 2276 Jfjhjq.exe 18 PID 2276 wrote to memory of 4596 2276 Jfjhjq.exe 15 PID 2276 wrote to memory of 1048 2276 Jfjhjq.exe 1 PID 2276 wrote to memory of 444 2276 Jfjhjq.exe 91 PID 2276 wrote to memory of 444 2276 Jfjhjq.exe 91 PID 2276 wrote to memory of 116 2276 Jfjhjq.exe 93 PID 2276 wrote to memory of 116 2276 Jfjhjq.exe 93 PID 2276 wrote to memory of 116 2276 Jfjhjq.exe 93 PID 2276 wrote to memory of 116 2276 Jfjhjq.exe 93 PID 2276 wrote to memory of 116 2276 Jfjhjq.exe 93 PID 2276 wrote to memory of 116 2276 Jfjhjq.exe 93 PID 2276 wrote to memory of 116 2276 Jfjhjq.exe 93 PID 2276 wrote to memory of 116 2276 Jfjhjq.exe 93 PID 2276 wrote to memory of 116 2276 Jfjhjq.exe 93 PID 116 wrote to memory of 4004 116 Jfjhjq.exe 94 PID 116 wrote to memory of 4004 116 Jfjhjq.exe 94 PID 116 wrote to memory of 4004 116 Jfjhjq.exe 94 PID 116 wrote to memory of 4004 116 Jfjhjq.exe 94 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Jfjhjq.exe
Processes
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1048
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:4420
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4596
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3692
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3516
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3424
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3356
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3264
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:2840
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe"C:\Users\Admin\AppData\Local\Temp\f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe"2⤵
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4268 -
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode disable3⤵
- Modifies Windows Firewall
PID:3908
-
-
C:\Users\Admin\AppData\Local\Temp\f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe"C:\Users\Admin\AppData\Local\Temp\f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Roaming\Jfjhjq.exe"C:\Users\Admin\AppData\Roaming\Jfjhjq.exe"4⤵
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2276 -
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode disable5⤵
- Modifies Windows Firewall
PID:444
-
-
C:\Users\Admin\AppData\Roaming\Jfjhjq.exe"C:\Users\Admin\AppData\Roaming\Jfjhjq.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"6⤵PID:4004
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"7⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1840 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1840 CREDAT:17410 /prefetch:28⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4368
-
-
-
-
-
-
-
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2448
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2336
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2320
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:312
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:792
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179.exe
Filesize167KB
MD54e8bd18c20a9b053f9727eb5f8e3c037
SHA15d4750302bbef963434d8ce660a9ba618987cf5f
SHA256f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179
SHA51248a8cbbb886ad80b1d9d1835ceda6c822dbb0fc991d5fe6e44570d5f04939ca3a9534df7756f5c5811efdd7677cf76707f212fa7d474dff5a8b0f7cfda2e2393
-
Filesize
167KB
MD54e8bd18c20a9b053f9727eb5f8e3c037
SHA15d4750302bbef963434d8ce660a9ba618987cf5f
SHA256f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179
SHA51248a8cbbb886ad80b1d9d1835ceda6c822dbb0fc991d5fe6e44570d5f04939ca3a9534df7756f5c5811efdd7677cf76707f212fa7d474dff5a8b0f7cfda2e2393
-
Filesize
167KB
MD54e8bd18c20a9b053f9727eb5f8e3c037
SHA15d4750302bbef963434d8ce660a9ba618987cf5f
SHA256f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179
SHA51248a8cbbb886ad80b1d9d1835ceda6c822dbb0fc991d5fe6e44570d5f04939ca3a9534df7756f5c5811efdd7677cf76707f212fa7d474dff5a8b0f7cfda2e2393
-
Filesize
167KB
MD54e8bd18c20a9b053f9727eb5f8e3c037
SHA15d4750302bbef963434d8ce660a9ba618987cf5f
SHA256f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179
SHA51248a8cbbb886ad80b1d9d1835ceda6c822dbb0fc991d5fe6e44570d5f04939ca3a9534df7756f5c5811efdd7677cf76707f212fa7d474dff5a8b0f7cfda2e2393
-
Filesize
258B
MD5400a23a56d3d6655a175afccd74d2bee
SHA1db79406256c161d5703c9b639984341abf2829a5
SHA25662ab4d477a0f6a32d743af6b4519d14513ab50441d71e3dee8b483c678b41759
SHA512dd376183f8389215426d9057018ce4638b150074ca3c86d050b54302b8cf62ec0ba4cf95f88bf8a039d0b25323c959cf8fa3a2baa770dca7ca1bc8f99638db5d