Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
21/11/2022, 09:06
Static task
static1
Behavioral task
behavioral1
Sample
0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe
Resource
win7-20221111-en
windows7-x64
16 signatures
150 seconds
General
-
Target
0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe
-
Size
185KB
-
MD5
409a7607dbc57625959684c6988b1740
-
SHA1
f9ebc627e9b56a0675ec5ed7a280374cb4726253
-
SHA256
0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298
-
SHA512
c4bf4e33bb443b7d12bd4d4e1494b57faf842ba88a72711fbdc79f83bbb496c98ae815824727059c4bbd16ba4bb7700053fe287cf118422d04dd34a3378bb2a3
-
SSDEEP
3072:MyaY46tGNttyf8AyXmd6I1ORtXHFXetjFr+Z+s1Bu0Az/yEqJhukQ426I1ORtXHy:X46tGdyR4rtXAJFr+Z+6Bu0AqukhtX/L
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe -
resource yara_rule behavioral2/memory/2736-132-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/2736-135-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/2736-139-0x0000000000850000-0x000000000190A000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation cmd.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Logo1_.exe 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe File created C:\Windows\e56622a 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe File opened for modification C:\Windows\SYSTEM.INI 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe File created C:\Windows\rundl132.exe 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe Token: SeDebugPrivilege 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4448 cmd.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 2736 wrote to memory of 2072 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 82 PID 2736 wrote to memory of 2072 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 82 PID 2736 wrote to memory of 2072 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 82 PID 2736 wrote to memory of 776 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 8 PID 2736 wrote to memory of 780 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 19 PID 2736 wrote to memory of 64 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 9 PID 2736 wrote to memory of 2528 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 45 PID 2072 wrote to memory of 2732 2072 net.exe 84 PID 2072 wrote to memory of 2732 2072 net.exe 84 PID 2072 wrote to memory of 2732 2072 net.exe 84 PID 2736 wrote to memory of 2560 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 47 PID 2736 wrote to memory of 2812 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 53 PID 2736 wrote to memory of 2804 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 54 PID 2736 wrote to memory of 3092 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 55 PID 2736 wrote to memory of 3304 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 56 PID 2736 wrote to memory of 3392 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 57 PID 2736 wrote to memory of 3464 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 58 PID 2736 wrote to memory of 3556 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 59 PID 2736 wrote to memory of 3808 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 60 PID 2736 wrote to memory of 4684 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 63 PID 2736 wrote to memory of 4480 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 74 PID 2736 wrote to memory of 2072 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 82 PID 2736 wrote to memory of 2072 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 82 PID 2736 wrote to memory of 3224 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 83 PID 2736 wrote to memory of 4448 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 85 PID 2736 wrote to memory of 4448 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 85 PID 2736 wrote to memory of 4448 2736 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe 85 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:776
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:64
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2528
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2560
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2812
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe"C:\Users\Admin\AppData\Local\Temp\0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Drops file in Drivers directory
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2736 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:3224
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:2732
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D93.bat3⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
PID:4448
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3092
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3304
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3392
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3464
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3556
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3808
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4684
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4480
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
722B
MD5e07188e93eca6c6661ad5deae51fb6f1
SHA124cdd3aae2ec7de7687070f6dc9dea8f84df8b1e
SHA256b209cb0376552fdcaa0c6cb5adcbbf814e3a6e2285b60763853dd7a34542461d
SHA512ffb9ab53f8da7a85cd41fe5bd1ac743e2bef3b6cbe72f41c75c1b0d48502f41ed3170c94bc5d27b525203d053370911832dde5fb2c9907be5a7767bad0c5c0cf
-
C:\Users\Admin\AppData\Local\Temp\0a455bf907462fec4cca724d38312457eaadcb3a9743e0353df6a5a6d8f4c298.exe.exe
Filesize151KB
MD5c343538e74573399df63471ffa923492
SHA1267e88820394865518e68d98a31b6e5c7b17c947
SHA256e9606e5aea15769acd30486d4acd817f2538638afbc6008c790fba2e05d85c28
SHA512beb554aaee40fecd4340c030017b114e05f60830a4909bcd410c66a9b0dfd2bc83bc5f0df5df0997e03f72829592ff04bc53c9e23936326828181a9a6d440c65