Analysis
- max time kernel
201s - max time network
194s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
23/11/2022, 15:51
Static task
static1
Behavioral task
behavioral1
Sample
ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe
Resource
win7-20221111-en
windows7-x64
19 signatures
150 seconds
General
- Target ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe
- Size 303KB
- Sample221123-talg4ade25
- SHA256 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5
- MD5 4ed2100f847ca6af006fb894c433b740
- SHA1 82257c6724f7832830cabbbed0ebbd12335bdb1a
- SHA512 35aa432bc663c5b490c571ac8d15ea5fb3e301ad23d1014a98c3b7d5ec1c82c0f06995d4766c47180be52448821229530a556e35f71e57ac92b3d32ba0b475dc
- SSDEEP 6144:64IumFnpizAyTjdOFrtX1kC/3sCnE/oweW215GcFm2jL:bI9ytwtXNsIE/r21lFmQL
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
-
http://www.klkjwre9fqwieluoi.info/
-
http://kukutrustnet777888.info/
Signatures
- Modifies firewall policy service 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" Au_.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" Au_.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Au_.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe - Executes dropped EXE 1 IoCs
pid Process 320 Au_.exe -
resource yara_rule behavioral2/memory/2640-132-0x0000000002360000-0x00000000033EE000-memory.dmp upx behavioral2/memory/2640-138-0x0000000002360000-0x00000000033EE000-memory.dmp upx behavioral2/memory/320-141-0x0000000004360000-0x00000000053EE000-memory.dmp upx behavioral2/memory/320-144-0x0000000004360000-0x00000000053EE000-memory.dmp upx behavioral2/memory/320-145-0x0000000004360000-0x00000000053EE000-memory.dmp upx - Loads dropped DLL 1 IoCs
pid Process 320 Au_.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" Au_.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" Au_.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Au_.exe - Enumerates connected drives 3 TTPs 19 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: Au_.exe File opened (read-only) \??\G: Au_.exe File opened (read-only) \??\L: Au_.exe File opened (read-only) \??\Q: Au_.exe File opened (read-only) \??\H: Au_.exe File opened (read-only) \??\O: Au_.exe File opened (read-only) \??\P: Au_.exe File opened (read-only) \??\R: Au_.exe File opened (read-only) \??\Z: Au_.exe File opened (read-only) \??\F: Au_.exe File opened (read-only) \??\I: Au_.exe File opened (read-only) \??\J: Au_.exe File opened (read-only) \??\N: Au_.exe File opened (read-only) \??\S: Au_.exe File opened (read-only) \??\T: Au_.exe File opened (read-only) \??\U: Au_.exe File opened (read-only) \??\E: Au_.exe File opened (read-only) \??\K: Au_.exe File opened (read-only) \??\M: Au_.exe - Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf Au_.exe - Drops file in Program Files directory 11 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe Au_.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe Au_.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe Au_.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe Au_.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe Au_.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe Au_.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe Au_.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe Au_.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe Au_.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe Au_.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe Au_.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe 320 Au_.exe 320 Au_.exe 320 Au_.exe 320 Au_.exe 320 Au_.exe 320 Au_.exe 320 Au_.exe 320 Au_.exe 320 Au_.exe 320 Au_.exe 320 Au_.exe 320 Au_.exe 320 Au_.exe 320 Au_.exe 320 Au_.exe 320 Au_.exe 320 Au_.exe 320 Au_.exe 320 Au_.exe 320 Au_.exe 320 Au_.exe 320 Au_.exe 320 Au_.exe 320 Au_.exe 320 Au_.exe 320 Au_.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Token: SeDebugPrivilege 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Token: SeDebugPrivilege 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Token: SeDebugPrivilege 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Token: SeDebugPrivilege 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Token: SeDebugPrivilege 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Token: SeDebugPrivilege 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Token: SeDebugPrivilege 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Token: SeDebugPrivilege 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Token: SeDebugPrivilege 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Token: SeDebugPrivilege 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Token: SeDebugPrivilege 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Token: SeDebugPrivilege 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Token: SeDebugPrivilege 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Token: SeDebugPrivilege 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Token: SeDebugPrivilege 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Token: SeDebugPrivilege 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Token: SeDebugPrivilege 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Token: SeDebugPrivilege 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Token: SeDebugPrivilege 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Token: SeDebugPrivilege 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Token: SeDebugPrivilege 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Token: SeDebugPrivilege 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Token: SeDebugPrivilege 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Token: SeDebugPrivilege 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Token: SeDebugPrivilege 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Token: SeDebugPrivilege 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Token: SeDebugPrivilege 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Token: SeDebugPrivilege 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Token: SeDebugPrivilege 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Token: SeDebugPrivilege 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Token: SeDebugPrivilege 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Token: SeDebugPrivilege 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Token: SeDebugPrivilege 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Token: SeDebugPrivilege 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Token: SeDebugPrivilege 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Token: SeDebugPrivilege 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Token: SeDebugPrivilege 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Token: SeDebugPrivilege 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Token: SeDebugPrivilege 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Token: SeDebugPrivilege 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Token: SeDebugPrivilege 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Token: SeDebugPrivilege 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Token: SeDebugPrivilege 320 Au_.exe Token: SeDebugPrivilege 320 Au_.exe Token: SeDebugPrivilege 320 Au_.exe Token: SeDebugPrivilege 320 Au_.exe Token: SeDebugPrivilege 320 Au_.exe Token: SeDebugPrivilege 320 Au_.exe Token: SeDebugPrivilege 320 Au_.exe Token: SeDebugPrivilege 320 Au_.exe Token: SeDebugPrivilege 320 Au_.exe Token: SeDebugPrivilege 320 Au_.exe Token: SeDebugPrivilege 320 Au_.exe Token: SeDebugPrivilege 320 Au_.exe Token: SeDebugPrivilege 320 Au_.exe Token: SeDebugPrivilege 320 Au_.exe Token: SeDebugPrivilege 320 Au_.exe Token: SeDebugPrivilege 320 Au_.exe Token: SeDebugPrivilege 320 Au_.exe Token: SeDebugPrivilege 320 Au_.exe Token: SeDebugPrivilege 320 Au_.exe Token: SeDebugPrivilege 320 Au_.exe Token: SeDebugPrivilege 320 Au_.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2640 wrote to memory of 776 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe 9 PID 2640 wrote to memory of 784 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe 82 PID 2640 wrote to memory of 1016 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe 11 PID 2640 wrote to memory of 320 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe 86 PID 2640 wrote to memory of 320 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe 86 PID 2640 wrote to memory of 320 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe 86 PID 2640 wrote to memory of 2416 2640 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe 53 PID 320 wrote to memory of 776 320 Au_.exe 9 PID 320 wrote to memory of 784 320 Au_.exe 82 PID 320 wrote to memory of 1016 320 Au_.exe 11 PID 320 wrote to memory of 2416 320 Au_.exe 53 PID 320 wrote to memory of 2428 320 Au_.exe 52 PID 320 wrote to memory of 2608 320 Au_.exe 48 PID 320 wrote to memory of 2584 320 Au_.exe 42 PID 320 wrote to memory of 2836 320 Au_.exe 41 PID 320 wrote to memory of 3276 320 Au_.exe 40 PID 320 wrote to memory of 3384 320 Au_.exe 39 PID 320 wrote to memory of 3452 320 Au_.exe 38 PID 320 wrote to memory of 3552 320 Au_.exe 37 PID 320 wrote to memory of 3816 320 Au_.exe 36 PID 320 wrote to memory of 4164 320 Au_.exe 22 PID 320 wrote to memory of 1640 320 Au_.exe 15 PID 320 wrote to memory of 776 320 Au_.exe 9 PID 320 wrote to memory of 784 320 Au_.exe 82 PID 320 wrote to memory of 1016 320 Au_.exe 11 PID 320 wrote to memory of 2416 320 Au_.exe 53 PID 320 wrote to memory of 2428 320 Au_.exe 52 PID 320 wrote to memory of 2608 320 Au_.exe 48 PID 320 wrote to memory of 2584 320 Au_.exe 42 PID 320 wrote to memory of 2836 320 Au_.exe 41 PID 320 wrote to memory of 3276 320 Au_.exe 40 PID 320 wrote to memory of 3384 320 Au_.exe 39 PID 320 wrote to memory of 3452 320 Au_.exe 38 PID 320 wrote to memory of 3552 320 Au_.exe 37 PID 320 wrote to memory of 3816 320 Au_.exe 36 PID 320 wrote to memory of 4164 320 Au_.exe 22 PID 320 wrote to memory of 1640 320 Au_.exe 15 PID 320 wrote to memory of 776 320 Au_.exe 9 PID 320 wrote to memory of 784 320 Au_.exe 82 PID 320 wrote to memory of 1016 320 Au_.exe 11 PID 320 wrote to memory of 2416 320 Au_.exe 53 PID 320 wrote to memory of 2428 320 Au_.exe 52 PID 320 wrote to memory of 2608 320 Au_.exe 48 PID 320 wrote to memory of 2584 320 Au_.exe 42 PID 320 wrote to memory of 2836 320 Au_.exe 41 PID 320 wrote to memory of 3276 320 Au_.exe 40 PID 320 wrote to memory of 3384 320 Au_.exe 39 PID 320 wrote to memory of 3452 320 Au_.exe 38 PID 320 wrote to memory of 3552 320 Au_.exe 37 PID 320 wrote to memory of 3816 320 Au_.exe 36 PID 320 wrote to memory of 4164 320 Au_.exe 22 PID 320 wrote to memory of 1640 320 Au_.exe 15 PID 320 wrote to memory of 776 320 Au_.exe 9 PID 320 wrote to memory of 784 320 Au_.exe 82 PID 320 wrote to memory of 1016 320 Au_.exe 11 PID 320 wrote to memory of 2416 320 Au_.exe 53 PID 320 wrote to memory of 2428 320 Au_.exe 52 PID 320 wrote to memory of 2608 320 Au_.exe 48 PID 320 wrote to memory of 2584 320 Au_.exe 42 PID 320 wrote to memory of 2836 320 Au_.exe 41 PID 320 wrote to memory of 3276 320 Au_.exe 40 PID 320 wrote to memory of 3384 320 Au_.exe 39 PID 320 wrote to memory of 3452 320 Au_.exe 38 PID 320 wrote to memory of 3552 320 Au_.exe 37 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Au_.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:776
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1016
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:1640
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4164
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3816
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3552
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3452
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3384
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3276
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:2836
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe"C:\Users\Admin\AppData\Local\Temp\ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:320
-
-
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2608
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2428
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2416
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3700
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:5056
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵PID:1144
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:2800
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\0E5757C5_Rar\ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe
- Size 223KB
- SHA256 e8e79df93a53375f24af80dc87dd363e4bb29e91a17d365a20e273b97450c858
- MD5 cb47cabb27471e1b903d146df5a81528
- SHA1 98fa99265f0a8601bf1403b9c3dbd966dc498fff
- SHA512 c18a039b958ec4f13df369efc4b6522fdef35fdf60171dc94e92338dee43de94885902c8e0742e94f9c7d98a5ead45c69ca409fdd39e6b7d5c454ee028bccf40
- SSDEEP 3072:X9/FfVXi7qmqS7yvmpizAyasCnEjU70JVGxnwec1MuFh5A9H5GlGnFmj6ISL:tFIumFnpizAyasCnE/oweW215GcFm2jL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nso5DFF.tmp\UAC.dll
- Size 29KB
- SHA256 97c46f2c5b4a09317d2d2fd8272f2bb36cbb9d25f5003cc69908c49c18128a9e
- MD5 fc38d5993ec3c029e2a9d9068d3eb146
- SHA1 80246043884ae50f90bd77fbe9a823de7ea7e326
- SHA512 83b495210158b5084ff917fb3152b8b82fdbcc0fb2768145f32646c33294dae6d1987142908b7a52f5f736e5227f977a39d4a41b9052e89a83ef6dd1bf350c07
- SSDEEP 384:yeD3JuvsGKnMe8cpOB+IcZEr5/IoR7vyMjipvv8wjJ7addyCk:yQAEGKwcIcWr5/n7vyyip8wj4xk
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
- Size 303KB
- SHA256 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5
- MD5 4ed2100f847ca6af006fb894c433b740
- SHA1 82257c6724f7832830cabbbed0ebbd12335bdb1a
- SHA512 35aa432bc663c5b490c571ac8d15ea5fb3e301ad23d1014a98c3b7d5ec1c82c0f06995d4766c47180be52448821229530a556e35f71e57ac92b3d32ba0b475dc
- SSDEEP 6144:64IumFnpizAyTjdOFrtX1kC/3sCnE/oweW215GcFm2jL:bI9ytwtXNsIE/r21lFmQL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
- Size 303KB
- SHA256 ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5
- MD5 4ed2100f847ca6af006fb894c433b740
- SHA1 82257c6724f7832830cabbbed0ebbd12335bdb1a
- SHA512 35aa432bc663c5b490c571ac8d15ea5fb3e301ad23d1014a98c3b7d5ec1c82c0f06995d4766c47180be52448821229530a556e35f71e57ac92b3d32ba0b475dc
- SSDEEP 6144:64IumFnpizAyTjdOFrtX1kC/3sCnE/oweW215GcFm2jL:bI9ytwtXNsIE/r21lFmQL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SYSTEM.INI
- Size 257B
- SHA256 c2b8d2c94c7af093257de1ffb77bf871133bb4433717d97748aa40589ac1b5e9
- MD5 868ed8580daf557af6afddc5acb0b73f
- SHA1 7e5199dd491d18e539111153961fd7a34fbcd4c2
- SHA512 d5ef452718aa77c634999b9515ab340c91723bdd0bbfe49a7bcb68d4820a6c327b65f5aa6955500cf3051df2fa2efb206fc947a88b0466ce2bca10769c77f12c
- MD5 SHA1 SHA512