Analysis
-
max time kernel
11s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 17:07
Behavioral task
behavioral1
Sample
41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe
Resource
win7-20220812-en
General
-
Target
41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe
-
Size
272KB
-
MD5
3695b3c1e7fa3e8b81f8bb82e655ba41
-
SHA1
0ad37edf83255c34b89fab0aaa112e9bb2967cc4
-
SHA256
41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2
-
SHA512
82164d394342b022605e7246dd2d9efe0266829dc7299d004c1051eba3fb5bd9d744d220f0b1a1adf79e244535d401f565855c3d25cdd9cfb59ba2b46120f142
-
SSDEEP
6144:9PLkVO8A1X2og0tEHH45Y0KTIVaTycTVDNe4jAfQP2JqjsR:qMJ1X2og0MHGKT3RRwcAf22EQR
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Processes:
41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe -
Processes:
41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe -
Disables Task Manager via registry modification
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Processes:
resource yara_rule behavioral2/memory/4252-133-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/memory/4252-132-0x0000000002440000-0x0000000003473000-memory.dmp upx behavioral2/memory/4252-139-0x0000000000400000-0x000000000049C000-memory.dmp upx behavioral2/memory/4252-140-0x0000000002440000-0x0000000003473000-memory.dmp upx -
Processes:
41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger = "C:\\Windows\\system32\\SSVICHOSST.exe" 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe -
Processes:
41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exedescription ioc process File opened (read-only) \??\h: 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe File opened (read-only) \??\i: 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe File opened (read-only) \??\m: 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe File opened (read-only) \??\q: 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe File opened (read-only) \??\w: 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe File opened (read-only) \??\y: 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe File opened (read-only) \??\z: 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe File opened (read-only) \??\b: 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe File opened (read-only) \??\f: 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe File opened (read-only) \??\g: 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe File opened (read-only) \??\k: 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe File opened (read-only) \??\x: 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe File opened (read-only) \??\r: 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe File opened (read-only) \??\s: 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe File opened (read-only) \??\t: 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe File opened (read-only) \??\u: 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe File opened (read-only) \??\a: 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe File opened (read-only) \??\e: 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe File opened (read-only) \??\j: 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe File opened (read-only) \??\l: 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe File opened (read-only) \??\n: 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe File opened (read-only) \??\o: 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe File opened (read-only) \??\p: 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe File opened (read-only) \??\v: 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe -
Drops file in System32 directory 3 IoCs
Processes:
41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exedescription ioc process File created C:\Windows\SysWOW64\SSVICHOSST.exe 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe File opened for modification C:\Windows\SysWOW64\SSVICHOSST.exe 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe File opened for modification C:\Windows\SysWOW64\autorun.ini 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe -
Drops file in Windows directory 3 IoCs
Processes:
41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe File created C:\Windows\SSVICHOSST.exe 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe File opened for modification C:\Windows\SSVICHOSST.exe 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exepid process 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exedescription pid process Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Token: SeDebugPrivilege 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.execmd.execmd.exedescription pid process target process PID 4252 wrote to memory of 4092 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe netsh.exe PID 4252 wrote to memory of 4092 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe netsh.exe PID 4252 wrote to memory of 4092 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe netsh.exe PID 4252 wrote to memory of 772 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe fontdrvhost.exe PID 4252 wrote to memory of 776 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe fontdrvhost.exe PID 4252 wrote to memory of 328 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe dwm.exe PID 4252 wrote to memory of 2724 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe sihost.exe PID 4252 wrote to memory of 2824 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe svchost.exe PID 4252 wrote to memory of 2888 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe taskhostw.exe PID 4252 wrote to memory of 652 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Explorer.EXE PID 4252 wrote to memory of 3088 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe svchost.exe PID 4252 wrote to memory of 3296 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe DllHost.exe PID 4252 wrote to memory of 3384 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe StartMenuExperienceHost.exe PID 4252 wrote to memory of 3444 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe RuntimeBroker.exe PID 4252 wrote to memory of 3544 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe SearchApp.exe PID 4252 wrote to memory of 3680 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe RuntimeBroker.exe PID 4252 wrote to memory of 4612 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe RuntimeBroker.exe PID 4252 wrote to memory of 4092 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe netsh.exe PID 4252 wrote to memory of 4092 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe netsh.exe PID 4252 wrote to memory of 2404 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe Conhost.exe PID 4252 wrote to memory of 1152 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe cmd.exe PID 4252 wrote to memory of 1152 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe cmd.exe PID 4252 wrote to memory of 1152 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe cmd.exe PID 1152 wrote to memory of 4864 1152 cmd.exe at.exe PID 1152 wrote to memory of 4864 1152 cmd.exe at.exe PID 1152 wrote to memory of 4864 1152 cmd.exe at.exe PID 4252 wrote to memory of 4104 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe cmd.exe PID 4252 wrote to memory of 4104 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe cmd.exe PID 4252 wrote to memory of 4104 4252 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe cmd.exe PID 4104 wrote to memory of 3212 4104 cmd.exe at.exe PID 4104 wrote to memory of 3212 4104 cmd.exe at.exe PID 4104 wrote to memory of 3212 4104 cmd.exe at.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe"C:\Users\Admin\AppData\Local\Temp\41e59a60716a1da5b44869ebe27d6c0b2ed289930dd3adc622cb3ae314a43df2.exe"2⤵
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode disable3⤵
- Modifies Windows Firewall
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\at.exeAT /delete /yes4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\SSVICHOSST.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\at.exeAT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\SSVICHOSST.exe4⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1152-135-0x0000000000000000-mapping.dmp
-
memory/3212-138-0x0000000000000000-mapping.dmp
-
memory/4092-134-0x0000000000000000-mapping.dmp
-
memory/4104-137-0x0000000000000000-mapping.dmp
-
memory/4252-133-0x0000000000400000-0x000000000049C000-memory.dmpFilesize
624KB
-
memory/4252-132-0x0000000002440000-0x0000000003473000-memory.dmpFilesize
16.2MB
-
memory/4252-139-0x0000000000400000-0x000000000049C000-memory.dmpFilesize
624KB
-
memory/4252-140-0x0000000002440000-0x0000000003473000-memory.dmpFilesize
16.2MB
-
memory/4864-136-0x0000000000000000-mapping.dmp