sality | 994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a

Analysis

max time kernel
58s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2022 14:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Size

207KB
MD5

05a3ca3ba03923b9dd85a2d7820724b6
SHA1

26be66fde5e7ab96d7413016658e6bbd293fdd5b
SHA256

994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a
SHA512

7d27d127d6b78299c80bbc8c34272320fa1c91aec6a0db86309b8d6889d4a49c2a478919b827a02ff027e5ec728d198596556014f24bdd13a10fbfa8f8e32eb4
SSDEEP

6144:8JvqJqyroIDbByGPMsMPHeOFEWiiVHwblfwE:wqJqyrVyveOFXLxzE

Score

10^/10

sality backdoor evasion persistence trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	moibu.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1"	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe

Disables Task Manager via registry modification
evasion

Executes dropped EXE 1 IoCs

pid	Process
1608	moibu.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
5088	netsh.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5036-133-0x0000000002A50000-0x0000000003A83000-memory.dmp	upx
behavioral2/memory/5036-137-0x0000000002A50000-0x0000000003A83000-memory.dmp	upx
behavioral2/memory/5036-144-0x0000000002A50000-0x0000000003A83000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\	moibu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moibu = "C:\\Users\\Admin\\moibu.exe"	moibu.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zFM.exe	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zG.exe	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\Uninstall.exe	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7z.exe	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SYSTEM.INI	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe
1608	moibu.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
Token: SeDebugPrivilege	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
1608	moibu.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 776	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe	78
PID 5036 wrote to memory of 784	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe	77
PID 5036 wrote to memory of 312	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe	9
PID 5036 wrote to memory of 5088	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe	80
PID 5036 wrote to memory of 5088	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe	80
PID 5036 wrote to memory of 5088	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe	80
PID 5036 wrote to memory of 2376	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe	23
PID 5036 wrote to memory of 2388	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe	61
PID 5036 wrote to memory of 2628	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe	31
PID 5036 wrote to memory of 2432	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe	59
PID 5036 wrote to memory of 760	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe	35
PID 5036 wrote to memory of 3244	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe	58
PID 5036 wrote to memory of 3348	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe	57
PID 5036 wrote to memory of 3412	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe	36
PID 5036 wrote to memory of 3544	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe	38
PID 5036 wrote to memory of 3896	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe	39
PID 5036 wrote to memory of 4776	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe	55
PID 5036 wrote to memory of 5088	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe	80
PID 5036 wrote to memory of 5088	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe	80
PID 5036 wrote to memory of 1608	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe	82
PID 5036 wrote to memory of 1608	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe	82
PID 5036 wrote to memory of 1608	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe	82
PID 1608 wrote to memory of 5036	1608	moibu.exe	79
PID 1608 wrote to memory of 5036	1608	moibu.exe	79
PID 1608 wrote to memory of 5036	1608	moibu.exe	79
PID 1608 wrote to memory of 5036	1608	moibu.exe	79
PID 1608 wrote to memory of 5036	1608	moibu.exe	79
PID 1608 wrote to memory of 5036	1608	moibu.exe	79
PID 1608 wrote to memory of 5036	1608	moibu.exe	79
PID 1608 wrote to memory of 5036	1608	moibu.exe	79
PID 1608 wrote to memory of 5036	1608	moibu.exe	79
PID 1608 wrote to memory of 5036	1608	moibu.exe	79
PID 5036 wrote to memory of 776	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe	78
PID 5036 wrote to memory of 784	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe	77
PID 5036 wrote to memory of 312	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe	9
PID 5036 wrote to memory of 2376	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe	23
PID 5036 wrote to memory of 2388	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe	61
PID 5036 wrote to memory of 2628	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe	31
PID 5036 wrote to memory of 2432	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe	59
PID 5036 wrote to memory of 760	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe	35
PID 5036 wrote to memory of 3244	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe	58
PID 5036 wrote to memory of 3348	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe	57
PID 5036 wrote to memory of 3412	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe	36
PID 5036 wrote to memory of 3544	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe	38
PID 5036 wrote to memory of 3896	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe	39
PID 5036 wrote to memory of 4776	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe	55
PID 5036 wrote to memory of 1608	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe	82
PID 5036 wrote to memory of 1608	5036	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe	82
PID 1608 wrote to memory of 5036	1608	moibu.exe	79
PID 1608 wrote to memory of 5036	1608	moibu.exe	79
PID 1608 wrote to memory of 5036	1608	moibu.exe	79
PID 1608 wrote to memory of 5036	1608	moibu.exe	79
PID 1608 wrote to memory of 5036	1608	moibu.exe	79
PID 1608 wrote to memory of 5036	1608	moibu.exe	79
PID 1608 wrote to memory of 5036	1608	moibu.exe	79
PID 1608 wrote to memory of 5036	1608	moibu.exe	79
PID 1608 wrote to memory of 5036	1608	moibu.exe	79
PID 1608 wrote to memory of 5036	1608	moibu.exe	79
PID 1608 wrote to memory of 5036	1608	moibu.exe	79
PID 1608 wrote to memory of 5036	1608	moibu.exe	79
PID 1608 wrote to memory of 5036	1608	moibu.exe	79
PID 1608 wrote to memory of 5036	1608	moibu.exe	79
PID 1608 wrote to memory of 5036	1608	moibu.exe	79
PID 1608 wrote to memory of 5036	1608	moibu.exe	79

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:312

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2376

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:760

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3412

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3544

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3896

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4776

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3348

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3244

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2432
- C:\Users\Admin\AppData\Local\Temp\994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe
  "C:\Users\Admin\AppData\Local\Temp\994ab082e8631f3ee0400a62c544b12daf7935d822ea5c8262fdc8973b292b8a.exe"
  2⤵
  - UAC bypass
  - Windows security bypass
  - Disables RegEdit via registry modification
  - Checks computer location settings
  - Windows security modification
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:5036
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall set opmode disable
    3⤵
    - Modifies Windows Firewall
    PID:5088
- - C:\Users\Admin\moibu.exe
    "C:\Users\Admin\moibu.exe"
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1608
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE"
    3⤵
    PID:800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2388

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:784

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:776

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\moibu.exe

Filesize
207KB

MD5
b6e42b6c53605f0bec82b90ebd62f3c8

SHA1
76813d156e723536fbb0302776322335921e6c55

SHA256
03ca314b2ad6fa385bf8333e2c295650fd3dfa9abf294860267b745bef9dd134

SHA512
b54b73fb030a4053b90e1ea78d70a31738070743862a798320f8896fc6ca4125bfd509e14d39f4d45f6f79f9549f127708543d031454172a76fa1bac894149b8

Download Submit
C:\Users\Admin\moibu.exe

Filesize
207KB

MD5
b6e42b6c53605f0bec82b90ebd62f3c8

SHA1
76813d156e723536fbb0302776322335921e6c55

SHA256
03ca314b2ad6fa385bf8333e2c295650fd3dfa9abf294860267b745bef9dd134

SHA512
b54b73fb030a4053b90e1ea78d70a31738070743862a798320f8896fc6ca4125bfd509e14d39f4d45f6f79f9549f127708543d031454172a76fa1bac894149b8

Download Submit
memory/800-145-0x0000000000000000-mapping.dmp

Download
memory/1608-138-0x0000000000000000-mapping.dmp

Download
memory/1608-143-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/5036-132-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/5036-133-0x0000000002A50000-0x0000000003A83000-memory.dmp

Filesize
16.2MB

Download
memory/5036-137-0x0000000002A50000-0x0000000003A83000-memory.dmp

Filesize
16.2MB

Download
memory/5036-144-0x0000000002A50000-0x0000000003A83000-memory.dmp

Filesize
16.2MB

Download
memory/5088-136-0x0000000000000000-mapping.dmp

Download