Analysis
-
max time kernel
144s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
30/10/2022, 01:53
Static task
static1
Behavioral task
behavioral1
Sample
38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe
Resource
win7-20220901-en
windows7-x64
21 signatures
150 seconds
General
-
Target
38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe
-
Size
386KB
-
MD5
5c15c1d455043105018b0a238d4ca930
-
SHA1
c84c775104892134f6170e288496ba084c781ce6
-
SHA256
38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399
-
SHA512
dadc9b18b97c0723ba1b7007834acb6d849d7c8089271bd391f8180ce2c6e37acbd64f8aca998d31bbb9af1e676bac015b13e10f361a0067d61ffc6bdfeecb63
-
SSDEEP
6144:EWH8H1bmbUWC3mzu84CGjvHyVHys1ifpkzpVuZABdg2+coSbjNp6tDm:gbmb/C3IzQyHyop8Zad/vjNE9m
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe -
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 768 dxwsetup.exe -
resource yara_rule behavioral1/memory/1708-55-0x0000000002470000-0x00000000034FE000-memory.dmp upx behavioral1/memory/1708-67-0x0000000002470000-0x00000000034FE000-memory.dmp upx behavioral1/memory/1708-75-0x0000000002470000-0x00000000034FE000-memory.dmp upx -
Loads dropped DLL 6 IoCs
pid Process 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 768 dxwsetup.exe 768 dxwsetup.exe 768 dxwsetup.exe 768 dxwsetup.exe 768 dxwsetup.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe File opened (read-only) \??\E: 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe File opened (read-only) \??\G: 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe File opened (read-only) \??\J: 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe File opened (read-only) \??\L: 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe File opened (read-only) \??\O: 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe File opened (read-only) \??\R: 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe File opened (read-only) \??\H: 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe File opened (read-only) \??\S: 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe File opened (read-only) \??\X: 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe File opened (read-only) \??\I: 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe File opened (read-only) \??\K: 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe File opened (read-only) \??\M: 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe File opened (read-only) \??\P: 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe File opened (read-only) \??\W: 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe File opened (read-only) \??\N: 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe File opened (read-only) \??\Q: 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe File opened (read-only) \??\T: 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe File opened (read-only) \??\U: 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe File opened (read-only) \??\Y: 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe File opened (read-only) \??\Z: 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\directx\websetup\dsetup.dll dxwsetup.exe File opened for modification C:\Windows\SysWOW64\directx\websetup\SET2399.tmp dxwsetup.exe File created C:\Windows\SysWOW64\directx\websetup\SET2399.tmp dxwsetup.exe File opened for modification C:\Windows\SysWOW64\directx\websetup\dsetup32.dll dxwsetup.exe File opened for modification C:\Windows\SysWOW64\DirectX\WebSetup dxwsetup.exe File opened for modification C:\Windows\SysWOW64\directx\websetup\SET2128.tmp dxwsetup.exe File created C:\Windows\SysWOW64\directx\websetup\SET2128.tmp dxwsetup.exe -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe File opened for modification C:\Windows\DirectX.log dxwsetup.exe File opened for modification C:\Windows\INF\setupapi.app.log dxwsetup.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe -
Suspicious use of AdjustPrivilegeToken 27 IoCs
description pid Process Token: SeDebugPrivilege 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe Token: SeDebugPrivilege 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe Token: SeDebugPrivilege 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe Token: SeDebugPrivilege 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe Token: SeDebugPrivilege 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe Token: SeDebugPrivilege 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe Token: SeDebugPrivilege 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe Token: SeDebugPrivilege 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe Token: SeDebugPrivilege 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe Token: SeDebugPrivilege 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe Token: SeDebugPrivilege 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe Token: SeDebugPrivilege 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe Token: SeDebugPrivilege 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe Token: SeDebugPrivilege 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe Token: SeDebugPrivilege 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe Token: SeDebugPrivilege 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe Token: SeDebugPrivilege 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe Token: SeDebugPrivilege 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe Token: SeDebugPrivilege 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe Token: SeDebugPrivilege 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe Token: SeRestorePrivilege 768 dxwsetup.exe Token: SeRestorePrivilege 768 dxwsetup.exe Token: SeRestorePrivilege 768 dxwsetup.exe Token: SeRestorePrivilege 768 dxwsetup.exe Token: SeRestorePrivilege 768 dxwsetup.exe Token: SeRestorePrivilege 768 dxwsetup.exe Token: SeRestorePrivilege 768 dxwsetup.exe -
Suspicious use of WriteProcessMemory 51 IoCs
description pid Process procid_target PID 1708 wrote to memory of 1116 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 16 PID 1708 wrote to memory of 1180 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 15 PID 1708 wrote to memory of 1236 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 14 PID 1708 wrote to memory of 768 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 27 PID 1708 wrote to memory of 768 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 27 PID 1708 wrote to memory of 768 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 27 PID 1708 wrote to memory of 768 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 27 PID 1708 wrote to memory of 768 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 27 PID 1708 wrote to memory of 768 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 27 PID 1708 wrote to memory of 768 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 27 PID 1708 wrote to memory of 1116 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 16 PID 1708 wrote to memory of 1180 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 15 PID 1708 wrote to memory of 1236 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 14 PID 1708 wrote to memory of 768 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 27 PID 1708 wrote to memory of 768 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 27 PID 1708 wrote to memory of 1116 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 16 PID 1708 wrote to memory of 1180 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 15 PID 1708 wrote to memory of 1236 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 14 PID 1708 wrote to memory of 1116 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 16 PID 1708 wrote to memory of 1180 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 15 PID 1708 wrote to memory of 1236 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 14 PID 1708 wrote to memory of 1116 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 16 PID 1708 wrote to memory of 1180 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 15 PID 1708 wrote to memory of 1236 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 14 PID 1708 wrote to memory of 1116 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 16 PID 1708 wrote to memory of 1180 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 15 PID 1708 wrote to memory of 1236 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 14 PID 1708 wrote to memory of 1116 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 16 PID 1708 wrote to memory of 1180 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 15 PID 1708 wrote to memory of 1236 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 14 PID 1708 wrote to memory of 1116 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 16 PID 1708 wrote to memory of 1180 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 15 PID 1708 wrote to memory of 1236 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 14 PID 1708 wrote to memory of 1116 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 16 PID 1708 wrote to memory of 1180 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 15 PID 1708 wrote to memory of 1236 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 14 PID 1708 wrote to memory of 1116 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 16 PID 1708 wrote to memory of 1180 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 15 PID 1708 wrote to memory of 1236 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 14 PID 1708 wrote to memory of 1116 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 16 PID 1708 wrote to memory of 1180 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 15 PID 1708 wrote to memory of 1236 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 14 PID 1708 wrote to memory of 1116 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 16 PID 1708 wrote to memory of 1180 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 15 PID 1708 wrote to memory of 1236 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 14 PID 1708 wrote to memory of 1116 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 16 PID 1708 wrote to memory of 1180 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 15 PID 1708 wrote to memory of 1236 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 14 PID 1708 wrote to memory of 1116 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 16 PID 1708 wrote to memory of 1180 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 15 PID 1708 wrote to memory of 1236 1708 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe 14 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe"C:\Users\Admin\AppData\Local\Temp\38667f5ed3c6f2ecb44cee7425168d88e0899115d6bb00f7b3dc2d9ebd5ab399.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:768
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1180
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1116
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5d3dcf192c9420cff748bf553b05edcd3
SHA1a0bd2b9f69597c9401891b48a87d3193f011ea57
SHA256ad672597c675a160dbc9b5321c4b1720f05e11af22fb8723ab93d0510bab4e01
SHA51292cbf24be9afa03762d730b5d8bef37619b63a6930cd1c762e2d12eefc6556a3c699a4e3eafeda56b30036d1decc3b393da8e1f114ce6076aeb00fe25aaffc6c
-
Filesize
2.1MB
MD5209201efab0b251eb90a18639b68c841
SHA11a612dfc41961571b63a85e2531d72d003e6884d
SHA25679ba6d7ef7f8ffeb7cfec21b14003a121314b831e3522c24bb0a581406cc6c9a
SHA51241eb5629018ad1a3bc2fe8a1ca2f8f126422b740a91cd7fb532ee4bfd0c5cc6e143e6dc37e58f570e82ded251dbb712248f999e77dc24cab2b3c72af9dc2a043
-
Filesize
444KB
MD5ad7b4540d252cf3b88da3d5dde791827
SHA15436a887e3f008c65fe18d9f2cd1cef981f67f23
SHA256516cf437f2610fda3975646e7ac5ca6d247ce3da5c09309c05e7daffae065d28
SHA51230f5d4230838f02f95518caaec4eba362603cce534942df1c23abe113f3934041ccd8cdf20136443bc27e2a6a3f1d0213c68b0479ed78b11b03b0191d6db8e51
-
Filesize
444KB
MD5ad7b4540d252cf3b88da3d5dde791827
SHA15436a887e3f008c65fe18d9f2cd1cef981f67f23
SHA256516cf437f2610fda3975646e7ac5ca6d247ce3da5c09309c05e7daffae065d28
SHA51230f5d4230838f02f95518caaec4eba362603cce534942df1c23abe113f3934041ccd8cdf20136443bc27e2a6a3f1d0213c68b0479ed78b11b03b0191d6db8e51
-
Filesize
598B
MD5c5ec2694c87c652e037967dee2492bf3
SHA1e9506391b871880ede5b3ae3b5f6c87b7beb7bf8
SHA256548d157d348281f9708d4e79bb34e7a4af13bf56b732023a7deeb1a3983c5df0
SHA512b7ce8e6c0b61fc07023b1cbae052649db0f9ffaa1dc04cfc0b060e1ace0c81e5346989cbe6cdc62ea5c6eb98efa5afe057160788c98313936f5f4eeeb8378c1f
-
Filesize
444KB
MD5ad7b4540d252cf3b88da3d5dde791827
SHA15436a887e3f008c65fe18d9f2cd1cef981f67f23
SHA256516cf437f2610fda3975646e7ac5ca6d247ce3da5c09309c05e7daffae065d28
SHA51230f5d4230838f02f95518caaec4eba362603cce534942df1c23abe113f3934041ccd8cdf20136443bc27e2a6a3f1d0213c68b0479ed78b11b03b0191d6db8e51
-
Filesize
444KB
MD5ad7b4540d252cf3b88da3d5dde791827
SHA15436a887e3f008c65fe18d9f2cd1cef981f67f23
SHA256516cf437f2610fda3975646e7ac5ca6d247ce3da5c09309c05e7daffae065d28
SHA51230f5d4230838f02f95518caaec4eba362603cce534942df1c23abe113f3934041ccd8cdf20136443bc27e2a6a3f1d0213c68b0479ed78b11b03b0191d6db8e51
-
Filesize
444KB
MD5ad7b4540d252cf3b88da3d5dde791827
SHA15436a887e3f008c65fe18d9f2cd1cef981f67f23
SHA256516cf437f2610fda3975646e7ac5ca6d247ce3da5c09309c05e7daffae065d28
SHA51230f5d4230838f02f95518caaec4eba362603cce534942df1c23abe113f3934041ccd8cdf20136443bc27e2a6a3f1d0213c68b0479ed78b11b03b0191d6db8e51
-
Filesize
444KB
MD5ad7b4540d252cf3b88da3d5dde791827
SHA15436a887e3f008c65fe18d9f2cd1cef981f67f23
SHA256516cf437f2610fda3975646e7ac5ca6d247ce3da5c09309c05e7daffae065d28
SHA51230f5d4230838f02f95518caaec4eba362603cce534942df1c23abe113f3934041ccd8cdf20136443bc27e2a6a3f1d0213c68b0479ed78b11b03b0191d6db8e51
-
Filesize
61KB
MD5d3dcf192c9420cff748bf553b05edcd3
SHA1a0bd2b9f69597c9401891b48a87d3193f011ea57
SHA256ad672597c675a160dbc9b5321c4b1720f05e11af22fb8723ab93d0510bab4e01
SHA51292cbf24be9afa03762d730b5d8bef37619b63a6930cd1c762e2d12eefc6556a3c699a4e3eafeda56b30036d1decc3b393da8e1f114ce6076aeb00fe25aaffc6c
-
Filesize
2.1MB
MD5209201efab0b251eb90a18639b68c841
SHA11a612dfc41961571b63a85e2531d72d003e6884d
SHA25679ba6d7ef7f8ffeb7cfec21b14003a121314b831e3522c24bb0a581406cc6c9a
SHA51241eb5629018ad1a3bc2fe8a1ca2f8f126422b740a91cd7fb532ee4bfd0c5cc6e143e6dc37e58f570e82ded251dbb712248f999e77dc24cab2b3c72af9dc2a043