sality | f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195

General

Target

f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe
Size

235KB
MD5

432c6ad9a018a7fc0ab0295a3f6301e1
SHA1

f8319549a3b95569dac43d441f9cedc2ab931c46
SHA256

f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195
SHA512

b8defaa17560119fa72326d40b3ff8d4fc122a6ba849331115ba350f5ffe15148b2e83bed375cdefc98b23395c01e7aac02b2dbcc499df251e0ea6476f02da5a
SSDEEP

3072:hQ2aSiRT2KPCvG19f1sU+WzjEPUE9CJvGoK9Dbd800/knTX2Gh1/QrlX238UsO5n:bayOff1shPoQb2Bsn5UfkhYA

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

Modifies firewall policy service 2 TTPs 3 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1"	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe

Disables Task Manager via registry modification
evasion
Executes dropped EXE 1 IoCs

Processes:

f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195mgr.exe

pid process

1548 f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195mgr.exe

pid	process
1548	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195mgr.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195mgr.exe	upx
\Users\Admin\AppData\Local\Temp\f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195mgr.exe	upx
C:\Users\Admin\AppData\Local\Temp\f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195mgr.exe	upx
behavioral1/memory/1548-60-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/1352-63-0x0000000001DE0000-0x0000000002E6E000-memory.dmp	upx
behavioral1/memory/1352-64-0x0000000001DE0000-0x0000000002E6E000-memory.dmp	upx
behavioral1/memory/1352-67-0x0000000001DE0000-0x0000000002E6E000-memory.dmp	upx

Loads dropped DLL 2 IoCs

Processes:

f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe

pid	process
1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe
1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe

description	ioc	process
File opened (read-only)	\??\E:	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe
File opened (read-only)	\??\F:	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe

Drops file in Windows directory 1 IoCs

Processes:

f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe

description ioc process

File opened for modification C:\Windows\SYSTEM.INI f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe

description	ioc	process
File opened for modification	C:\Windows\SYSTEM.INI	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe

pid	process
1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe
1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe

Suspicious behavior: MapViewOfSection 22 IoCs

Processes:

f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe

pid	process
1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe
1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe
1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe
1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe
1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe
1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe
1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe
1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe
1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe
1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe
1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe
1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe
1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe
1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe
1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe
1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe
1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe
1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe
1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe
1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe
1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe
1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe

description pid process

Token: SeDebugPrivilege 1352 f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe

description	pid	process
Token: SeDebugPrivilege	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe

description	pid	process	target process
PID 1352 wrote to memory of 1548	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195mgr.exe
PID 1352 wrote to memory of 1548	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195mgr.exe
PID 1352 wrote to memory of 1548	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195mgr.exe
PID 1352 wrote to memory of 1548	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195mgr.exe
PID 1352 wrote to memory of 368	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	wininit.exe
PID 1352 wrote to memory of 368	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	wininit.exe
PID 1352 wrote to memory of 368	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	wininit.exe
PID 1352 wrote to memory of 368	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	wininit.exe
PID 1352 wrote to memory of 368	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	wininit.exe
PID 1352 wrote to memory of 368	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	wininit.exe
PID 1352 wrote to memory of 368	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	wininit.exe
PID 1352 wrote to memory of 380	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	csrss.exe
PID 1352 wrote to memory of 380	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	csrss.exe
PID 1352 wrote to memory of 380	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	csrss.exe
PID 1352 wrote to memory of 380	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	csrss.exe
PID 1352 wrote to memory of 380	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	csrss.exe
PID 1352 wrote to memory of 380	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	csrss.exe
PID 1352 wrote to memory of 380	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	csrss.exe
PID 1352 wrote to memory of 416	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	winlogon.exe
PID 1352 wrote to memory of 416	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	winlogon.exe
PID 1352 wrote to memory of 416	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	winlogon.exe
PID 1352 wrote to memory of 416	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	winlogon.exe
PID 1352 wrote to memory of 416	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	winlogon.exe
PID 1352 wrote to memory of 416	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	winlogon.exe
PID 1352 wrote to memory of 416	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	winlogon.exe
PID 1352 wrote to memory of 460	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	services.exe
PID 1352 wrote to memory of 460	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	services.exe
PID 1352 wrote to memory of 460	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	services.exe
PID 1352 wrote to memory of 460	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	services.exe
PID 1352 wrote to memory of 460	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	services.exe
PID 1352 wrote to memory of 460	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	services.exe
PID 1352 wrote to memory of 460	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	services.exe
PID 1352 wrote to memory of 476	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	lsass.exe
PID 1352 wrote to memory of 476	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	lsass.exe
PID 1352 wrote to memory of 476	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	lsass.exe
PID 1352 wrote to memory of 476	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	lsass.exe
PID 1352 wrote to memory of 476	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	lsass.exe
PID 1352 wrote to memory of 476	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	lsass.exe
PID 1352 wrote to memory of 476	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	lsass.exe
PID 1352 wrote to memory of 484	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	lsm.exe
PID 1352 wrote to memory of 484	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	lsm.exe
PID 1352 wrote to memory of 484	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	lsm.exe
PID 1352 wrote to memory of 484	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	lsm.exe
PID 1352 wrote to memory of 484	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	lsm.exe
PID 1352 wrote to memory of 484	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	lsm.exe
PID 1352 wrote to memory of 484	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	lsm.exe
PID 1352 wrote to memory of 596	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	svchost.exe
PID 1352 wrote to memory of 596	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	svchost.exe
PID 1352 wrote to memory of 596	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	svchost.exe
PID 1352 wrote to memory of 596	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	svchost.exe
PID 1352 wrote to memory of 596	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	svchost.exe
PID 1352 wrote to memory of 596	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	svchost.exe
PID 1352 wrote to memory of 596	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	svchost.exe
PID 1352 wrote to memory of 672	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	svchost.exe
PID 1352 wrote to memory of 672	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	svchost.exe
PID 1352 wrote to memory of 672	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	svchost.exe
PID 1352 wrote to memory of 672	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	svchost.exe
PID 1352 wrote to memory of 672	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	svchost.exe
PID 1352 wrote to memory of 672	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	svchost.exe
PID 1352 wrote to memory of 672	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	svchost.exe
PID 1352 wrote to memory of 756	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	svchost.exe
PID 1352 wrote to memory of 756	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	svchost.exe
PID 1352 wrote to memory of 756	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	svchost.exe
PID 1352 wrote to memory of 756	1352	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe	svchost.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

Processes:

f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:476

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
2⤵
PID:296

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
2⤵
PID:276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
2⤵
PID:1672

C:\Windows\system32\taskhost.exe
"taskhost.exe"
2⤵
PID:1124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
2⤵
PID:1096

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
2⤵
PID:1036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
2⤵
PID:884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
2⤵
PID:840

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
2⤵
PID:808

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
2⤵
PID:756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
2⤵
PID:672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
2⤵
PID:596

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:416

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:1604

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:980

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1228

C:\Users\Admin\AppData\Local\Temp\f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe
"C:\Users\Admin\AppData\Local\Temp\f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195.exe"
2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1352

C:\Users\Admin\AppData\Local\Temp\f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195mgr.exe
C:\Users\Admin\AppData\Local\Temp\f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195mgr.exe
3⤵
- Executes dropped EXE
PID:1548

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1192

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:484

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:380

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:368

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195mgr.exe

Filesize
104KB

MD5
efaa22ffce5c3265d85c80b672dd5bb1

SHA1
820844bb923da4af260568f2eda9286c54f709b6

SHA256
daa5f8f031ab6898fa32bbf04a460e28aad36bd08fe5a1ac6cd9556929a78097

SHA512
df5143a64441869fc97a3fa8753670f6f7463bdc3099c66f0b7bfb1faa8e900cccca39031fdc40155487bce90b386bd4c070c97a12cd120ead0596bcc98b4ed8

Download Submit
\Users\Admin\AppData\Local\Temp\f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195mgr.exe

Filesize
104KB

MD5
efaa22ffce5c3265d85c80b672dd5bb1

SHA1
820844bb923da4af260568f2eda9286c54f709b6

SHA256
daa5f8f031ab6898fa32bbf04a460e28aad36bd08fe5a1ac6cd9556929a78097

SHA512
df5143a64441869fc97a3fa8753670f6f7463bdc3099c66f0b7bfb1faa8e900cccca39031fdc40155487bce90b386bd4c070c97a12cd120ead0596bcc98b4ed8

Download Submit
\Users\Admin\AppData\Local\Temp\f379b9d662d1c02393ec7c314c24c2fa08c2fc95f06b011702494bdcc307f195mgr.exe

Filesize
104KB

MD5
efaa22ffce5c3265d85c80b672dd5bb1

SHA1
820844bb923da4af260568f2eda9286c54f709b6

SHA256
daa5f8f031ab6898fa32bbf04a460e28aad36bd08fe5a1ac6cd9556929a78097

SHA512
df5143a64441869fc97a3fa8753670f6f7463bdc3099c66f0b7bfb1faa8e900cccca39031fdc40155487bce90b386bd4c070c97a12cd120ead0596bcc98b4ed8

Download Submit
memory/1352-63-0x0000000001DE0000-0x0000000002E6E000-memory.dmp

Filesize
16.6MB

Download
memory/1352-55-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1352-61-0x0000000000220000-0x000000000027B000-memory.dmp

Filesize
364KB

Download
memory/1352-62-0x0000000000220000-0x000000000027B000-memory.dmp

Filesize
364KB

Download
memory/1352-54-0x0000000075D51000-0x0000000075D53000-memory.dmp

Filesize
8KB

Download
memory/1352-64-0x0000000001DE0000-0x0000000002E6E000-memory.dmp

Filesize
16.6MB

Download
memory/1352-65-0x00000000003F0000-0x00000000003F2000-memory.dmp

Filesize
8KB

Download
memory/1352-66-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1352-67-0x0000000001DE0000-0x0000000002E6E000-memory.dmp

Filesize
16.6MB

Download
memory/1548-58-0x0000000000000000-mapping.dmp

Download
memory/1548-60-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads