Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06-11-2022 18:45
Static task
static1
Behavioral task
behavioral1
Sample
b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe
Resource
win7-20220901-en
windows7-x64
18 signatures
150 seconds
General
-
Target
b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe
-
Size
144KB
-
MD5
0c309cac018d98471faf31feff28e8e0
-
SHA1
d62789b02b92a067bf4569f86cde6f939a3fd7a4
-
SHA256
b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759
-
SHA512
44ce9659bbb15ac9c992c7bb52c9a1bf33fb971b02c093090529e7b4a8eba0d57be480d715f94784b10976662395bda4d3f2d691ec865a1a4b792c1440eaf511
-
SSDEEP
3072:X6pyTK5LYYGEKZzTmq7u7vSZFXm0wqP6b/MnDlfFvaZ:X6py6LaWz7S7wqP6gDlRaZ
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe -
Disables Task Manager via registry modification
-
resource yara_rule behavioral2/memory/2416-132-0x0000000002440000-0x00000000034CE000-memory.dmp upx behavioral2/memory/2416-134-0x0000000002440000-0x00000000034CE000-memory.dmp upx behavioral2/memory/2416-135-0x0000000002440000-0x00000000034CE000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File opened (read-only) \??\R: b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File opened (read-only) \??\S: b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File opened (read-only) \??\Z: b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File opened (read-only) \??\F: b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File opened (read-only) \??\J: b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File opened (read-only) \??\M: b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File opened (read-only) \??\P: b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File opened (read-only) \??\T: b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File opened (read-only) \??\U: b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File opened (read-only) \??\X: b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File opened (read-only) \??\Y: b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File opened (read-only) \??\H: b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File opened (read-only) \??\G: b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File opened (read-only) \??\N: b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File opened (read-only) \??\Q: b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File opened (read-only) \??\V: b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File opened (read-only) \??\W: b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File opened (read-only) \??\E: b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File opened (read-only) \??\L: b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File opened (read-only) \??\O: b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File opened (read-only) \??\K: b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe -
Drops file in Program Files directory 11 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\inf\c_fshsm.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\kscaptur.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\netmscli.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\smrvolume.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\netrasa.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\netvwififlt.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\c_fssystemrecovery.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\mbtr8897w81x64.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\mdmcxpv6.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\mdmnis1u.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\netnwifi.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\mdmiodat.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\netimm.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\lltdio.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\mdmnis3t.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\nulhprs8.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\wfcvsc.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\wvmic_kvpexchange.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\netvchannel.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\prnms003.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\tpmvsc.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\c_hidclass.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\displayoverride.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\hdaudss.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\hidbthle.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\netserv.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\c_system.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\mdmmcom.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\netlldp.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\61883.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\mvumis.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\net44amd.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\wvmic_ext.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\eaphost.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\hidserv.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\mdmbw561.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\mdmmega.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\wstorvsc.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\mdmatm2k.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\mdmgl009.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\miradisp.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\net1ic64.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\netxex64.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\mdmsuprv.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\sensorsalsdriver.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\xusb22.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\mdmcom1.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\mdmosi.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\mdmtdkj3.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\c_fsquotamgmt.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\mdmhaeu.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\mdmjf56e.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\mdmmetri.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\net9500-x64-n650f.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\c_smartcardreader.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\mdmvdot.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\netvwwanmp.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\wvmic_guestinterface.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\cht4nulx64.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\c_scmdisk.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\mdmzyxlg.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\c_computer.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\c_dot4print.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe File created C:\Windows\inf\ipmidrv.PNF b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe -
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe Token: SeDebugPrivilege 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2416 wrote to memory of 792 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 78 PID 2416 wrote to memory of 800 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 77 PID 2416 wrote to memory of 312 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 8 PID 2416 wrote to memory of 2428 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 44 PID 2416 wrote to memory of 2452 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 11 PID 2416 wrote to memory of 2772 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 38 PID 2416 wrote to memory of 372 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 36 PID 2416 wrote to memory of 3076 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 35 PID 2416 wrote to memory of 3268 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 34 PID 2416 wrote to memory of 3368 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 33 PID 2416 wrote to memory of 3432 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 12 PID 2416 wrote to memory of 3524 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 32 PID 2416 wrote to memory of 3680 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 31 PID 2416 wrote to memory of 4588 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 28 PID 2416 wrote to memory of 792 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 78 PID 2416 wrote to memory of 800 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 77 PID 2416 wrote to memory of 312 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 8 PID 2416 wrote to memory of 2428 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 44 PID 2416 wrote to memory of 2452 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 11 PID 2416 wrote to memory of 2772 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 38 PID 2416 wrote to memory of 372 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 36 PID 2416 wrote to memory of 3076 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 35 PID 2416 wrote to memory of 3268 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 34 PID 2416 wrote to memory of 3368 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 33 PID 2416 wrote to memory of 3432 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 12 PID 2416 wrote to memory of 3524 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 32 PID 2416 wrote to memory of 3680 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 31 PID 2416 wrote to memory of 4588 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 28 PID 2416 wrote to memory of 792 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 78 PID 2416 wrote to memory of 800 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 77 PID 2416 wrote to memory of 312 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 8 PID 2416 wrote to memory of 2428 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 44 PID 2416 wrote to memory of 2452 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 11 PID 2416 wrote to memory of 2772 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 38 PID 2416 wrote to memory of 372 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 36 PID 2416 wrote to memory of 3076 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 35 PID 2416 wrote to memory of 3268 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 34 PID 2416 wrote to memory of 3368 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 33 PID 2416 wrote to memory of 3432 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 12 PID 2416 wrote to memory of 3524 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 32 PID 2416 wrote to memory of 3680 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 31 PID 2416 wrote to memory of 4588 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 28 PID 2416 wrote to memory of 792 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 78 PID 2416 wrote to memory of 800 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 77 PID 2416 wrote to memory of 312 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 8 PID 2416 wrote to memory of 2428 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 44 PID 2416 wrote to memory of 2452 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 11 PID 2416 wrote to memory of 2772 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 38 PID 2416 wrote to memory of 372 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 36 PID 2416 wrote to memory of 3076 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 35 PID 2416 wrote to memory of 3268 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 34 PID 2416 wrote to memory of 3368 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 33 PID 2416 wrote to memory of 3432 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 12 PID 2416 wrote to memory of 3524 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 32 PID 2416 wrote to memory of 3680 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 31 PID 2416 wrote to memory of 4588 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 28 PID 2416 wrote to memory of 792 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 78 PID 2416 wrote to memory of 800 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 77 PID 2416 wrote to memory of 312 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 8 PID 2416 wrote to memory of 2428 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 44 PID 2416 wrote to memory of 2452 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 11 PID 2416 wrote to memory of 2772 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 38 PID 2416 wrote to memory of 372 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 36 PID 2416 wrote to memory of 3076 2416 b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe 35 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe
Processes
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:312
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2452
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe"C:\Users\Admin\AppData\Local\Temp\b9ca5e641ea25590c2eabc53cebdbf38f19f5c10c81e2b7c90761910de253759.exe"1⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2416
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4588
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3680
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3524
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3368
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3268
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3076
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:372
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2772
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2428
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:800
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:792