sality | 916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 07:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Size

358KB
MD5

a60e7bf353ef320cb8f8082c09e136fc
SHA1

ff280b2519b6c30f7a0ad48af9922bd510d8f172
SHA256

916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96
SHA512

c0d0d2e3e9a38f5fb662e8befe22817bc973b8ea527c76282c08c5521c42146dd306d3df603fced9fdd5fc986a4b52d65b1f529d3c68163a081e72cc6379753e
SSDEEP

6144:GyTYVd5dCC0E8zTSNwpLDPQhmm1rEkosSHwoSFbSK2C6uSl3:GysV57hriRPQwDQoSFbH2OSl3

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4616-133-0x0000000000400000-0x00000000008D6000-memory.dmp	upx
behavioral2/memory/4616-132-0x0000000002840000-0x0000000003870000-memory.dmp	upx
behavioral2/memory/4616-134-0x0000000002840000-0x0000000003870000-memory.dmp	upx
behavioral2/memory/4616-135-0x0000000000400000-0x00000000008D6000-memory.dmp	upx
behavioral2/memory/4616-136-0x0000000002840000-0x0000000003870000-memory.dmp	upx
behavioral2/memory/4616-137-0x0000000002840000-0x0000000003870000-memory.dmp	upx
behavioral2/memory/4616-138-0x0000000000400000-0x00000000008D6000-memory.dmp	upx

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zFM.exe	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zG.exe	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\Uninstall.exe	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7z.exe	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SYSTEM.INI	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
Token: SeDebugPrivilege	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 756	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	8
PID 4616 wrote to memory of 760	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	19
PID 4616 wrote to memory of 60	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	12
PID 4616 wrote to memory of 2360	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	42
PID 4616 wrote to memory of 2372	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	43
PID 4616 wrote to memory of 2460	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	46
PID 4616 wrote to memory of 724	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	54
PID 4616 wrote to memory of 3088	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	55
PID 4616 wrote to memory of 3284	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	56
PID 4616 wrote to memory of 3380	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	57
PID 4616 wrote to memory of 3452	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	58
PID 4616 wrote to memory of 3540	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	59
PID 4616 wrote to memory of 3836	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	79
PID 4616 wrote to memory of 4808	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	76
PID 4616 wrote to memory of 756	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	8
PID 4616 wrote to memory of 760	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	19
PID 4616 wrote to memory of 60	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	12
PID 4616 wrote to memory of 2360	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	42
PID 4616 wrote to memory of 2372	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	43
PID 4616 wrote to memory of 2460	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	46
PID 4616 wrote to memory of 724	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	54
PID 4616 wrote to memory of 3088	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	55
PID 4616 wrote to memory of 3284	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	56
PID 4616 wrote to memory of 3380	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	57
PID 4616 wrote to memory of 3452	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	58
PID 4616 wrote to memory of 3540	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	59
PID 4616 wrote to memory of 3836	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	79
PID 4616 wrote to memory of 4808	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	76
PID 4616 wrote to memory of 756	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	8
PID 4616 wrote to memory of 760	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	19
PID 4616 wrote to memory of 60	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	12
PID 4616 wrote to memory of 2360	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	42
PID 4616 wrote to memory of 2372	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	43
PID 4616 wrote to memory of 2460	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	46
PID 4616 wrote to memory of 724	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	54
PID 4616 wrote to memory of 3088	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	55
PID 4616 wrote to memory of 3284	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	56
PID 4616 wrote to memory of 3380	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	57
PID 4616 wrote to memory of 3452	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	58
PID 4616 wrote to memory of 3540	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	59
PID 4616 wrote to memory of 3836	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	79
PID 4616 wrote to memory of 4808	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	76
PID 4616 wrote to memory of 756	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	8
PID 4616 wrote to memory of 760	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	19
PID 4616 wrote to memory of 60	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	12
PID 4616 wrote to memory of 2360	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	42
PID 4616 wrote to memory of 2372	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	43
PID 4616 wrote to memory of 2460	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	46
PID 4616 wrote to memory of 724	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	54
PID 4616 wrote to memory of 3088	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	55
PID 4616 wrote to memory of 3284	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	56
PID 4616 wrote to memory of 3380	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	57
PID 4616 wrote to memory of 3452	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	58
PID 4616 wrote to memory of 3540	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	59
PID 4616 wrote to memory of 3836	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	79
PID 4616 wrote to memory of 4808	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	76
PID 4616 wrote to memory of 756	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	8
PID 4616 wrote to memory of 760	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	19
PID 4616 wrote to memory of 60	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	12
PID 4616 wrote to memory of 2360	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	42
PID 4616 wrote to memory of 2372	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	43
PID 4616 wrote to memory of 2460	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	46
PID 4616 wrote to memory of 724	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	54
PID 4616 wrote to memory of 3088	4616	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe	55

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:756

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:60

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:760

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2372

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2460

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:724
- C:\Users\Admin\AppData\Local\Temp\916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe
  "C:\Users\Admin\AppData\Local\Temp\916c3c52c3442ab1f8de312466894b5a3c880072a17249c9e86e461fe3758a96.exe"
  2⤵
  - UAC bypass
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3088

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3284

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3380

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3452

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3540

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4808

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3836

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4616-133-0x0000000000400000-0x00000000008D6000-memory.dmp

Filesize
4.8MB

Download
memory/4616-132-0x0000000002840000-0x0000000003870000-memory.dmp

Filesize
16.2MB

Download
memory/4616-134-0x0000000002840000-0x0000000003870000-memory.dmp

Filesize
16.2MB

Download
memory/4616-135-0x0000000000400000-0x00000000008D6000-memory.dmp

Filesize
4.8MB

Download
memory/4616-136-0x0000000002840000-0x0000000003870000-memory.dmp

Filesize
16.2MB

Download
memory/4616-137-0x0000000002840000-0x0000000003870000-memory.dmp

Filesize
16.2MB

Download
memory/4616-138-0x0000000000400000-0x00000000008D6000-memory.dmp

Filesize
4.8MB

Download