Analysis
- max time kernel
152s - max time network
161s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
01/12/2022, 22:21
Static task
static1
Behavioral task
behavioral1
Sample
d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe
Resource
win7-20221111-en
windows7-x64
2 signatures
150 seconds
General
- Target d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe
- Size 116KB
- Sample221201-19vy5sbb61
- SHA256 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351
- MD5 a66ba66659cc6f23f97c1a44feb97b40
- SHA1 cd01fbca93fab351509f8848de0b0534915950ad
- SHA512 5554392d157275e6c27da0c736155def21463e903c532169baded5e3c2a69523af7b41514d7edc351e5bfd1486accd2a7782f7c98b0210d15dfc222f2cf89e1c
- SSDEEP 1536:/953sm22O/aocGQqETk0vl/5Ft2exSb36edOyFLcSl/79mM+13BBp8eCV3:1Q/ao+qa1TrxSbXRR1/Zx+/bI3
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe - Disables Task Manager via registry modification
- Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 4160 netsh.exe -
resource yara_rule behavioral2/memory/1512-132-0x0000000002970000-0x00000000039A3000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe - Drops file in Program Files directory 8 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe File created C:\Program Files\Symantec\LiveUpdate\LUALL.EXE d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe - Modifies registry class 38 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 56003100000000006b557d6c12004170704461746100400009000400efbe6b557d6c8455b3312e00000089e1010000000100000000000000000000000000000020f30e004100700070004400610074006100000016000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 50003100000000006b55b26e10004c6f63616c003c0009000400efbe6b557d6c8455b3312e0000009ce10100000001000000000000000000000000000000e996ac004c006f00630061006c00000014000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4e003100000000008455ca31100054656d7000003a0009000400efbe6b557d6c8455cb312e0000009de1010000000100000000000000000000000000000038861601540065006d007000000014000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 = cc003100000000008455ca3112004436324231347e310000b40009000400efbe8455ca318455ca312e000000312e02000000080000000000000000000000000000003886160164003600320062003100340037003900370034003900350039003200310032003900360063006600340035003300390039003600340066006200650035003100640035003100650034003500630064003200310063006300340039006400390030003000380030006100660064006400360065006300660033003300350031006c00000018000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\MRUListEx = ffffffff explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" explorer.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 78003100000000006b557d6c1100557365727300640009000400efbe874f77488455b3312e000000c70500000000010000000000000000003a0000000000d967240055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 50003100000000006b556872100041646d696e003c0009000400efbe6b557d6c8455b3312e0000007ee101000000010000000000000000000000000000001b6e8500410064006d0069006e00000014000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\NodeSlot = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4732 explorer.exe - Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4732 explorer.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe Token: SeDebugPrivilege 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 4732 explorer.exe 4732 explorer.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1512 wrote to memory of 4160 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 85 PID 1512 wrote to memory of 4160 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 85 PID 1512 wrote to memory of 4160 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 85 PID 1512 wrote to memory of 772 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 75 PID 1512 wrote to memory of 780 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 74 PID 1512 wrote to memory of 1016 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 70 PID 1512 wrote to memory of 2760 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 32 PID 1512 wrote to memory of 2788 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 31 PID 1512 wrote to memory of 2868 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 30 PID 1512 wrote to memory of 2584 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 29 PID 1512 wrote to memory of 1388 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 28 PID 1512 wrote to memory of 3252 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 27 PID 1512 wrote to memory of 3344 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 26 PID 1512 wrote to memory of 3408 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 1 PID 1512 wrote to memory of 3504 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 25 PID 1512 wrote to memory of 3692 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 24 PID 1512 wrote to memory of 4668 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 21 PID 1512 wrote to memory of 440 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 2 PID 1512 wrote to memory of 4968 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 5 PID 1512 wrote to memory of 1936 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 3 PID 1512 wrote to memory of 4160 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 85 PID 1512 wrote to memory of 4160 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 85 PID 1512 wrote to memory of 532 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 86 PID 1512 wrote to memory of 1832 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 87 PID 1512 wrote to memory of 1832 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 87 PID 1512 wrote to memory of 1832 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 87 PID 1512 wrote to memory of 772 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 75 PID 1512 wrote to memory of 780 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 74 PID 1512 wrote to memory of 1016 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 70 PID 1512 wrote to memory of 2760 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 32 PID 1512 wrote to memory of 2788 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 31 PID 1512 wrote to memory of 2868 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 30 PID 1512 wrote to memory of 2584 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 29 PID 1512 wrote to memory of 1388 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 28 PID 1512 wrote to memory of 3252 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 27 PID 1512 wrote to memory of 3344 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 26 PID 1512 wrote to memory of 3408 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 1 PID 1512 wrote to memory of 3504 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 25 PID 1512 wrote to memory of 3692 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 24 PID 1512 wrote to memory of 4668 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 21 PID 1512 wrote to memory of 440 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 2 PID 1512 wrote to memory of 4968 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 5 PID 1512 wrote to memory of 1936 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 3 PID 1512 wrote to memory of 4732 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 88 PID 1512 wrote to memory of 772 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 75 PID 1512 wrote to memory of 780 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 74 PID 1512 wrote to memory of 1016 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 70 PID 1512 wrote to memory of 2760 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 32 PID 1512 wrote to memory of 2788 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 31 PID 1512 wrote to memory of 2868 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 30 PID 1512 wrote to memory of 2584 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 29 PID 1512 wrote to memory of 1388 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 28 PID 1512 wrote to memory of 3252 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 27 PID 1512 wrote to memory of 3344 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 26 PID 1512 wrote to memory of 3408 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 1 PID 1512 wrote to memory of 3504 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 25 PID 1512 wrote to memory of 3692 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 24 PID 1512 wrote to memory of 4668 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 21 PID 1512 wrote to memory of 440 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 2 PID 1512 wrote to memory of 1936 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 3 PID 1512 wrote to memory of 4732 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 88 PID 1512 wrote to memory of 772 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 75 PID 1512 wrote to memory of 780 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 74 PID 1512 wrote to memory of 1016 1512 d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe 70 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe
Processes
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3408
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:440
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1936
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:4968
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4668
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3692
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3504
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3344
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3252
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:1388
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe"C:\Users\Admin\AppData\Local\Temp\d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351.exe"2⤵
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1512 -
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode disable3⤵
- Modifies Windows Firewall
PID:4160 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:532
-
-
-
C:\Windows\SysWOW64\explorer.exeexplorer d62b14797495921296cf4539964fbe51d51e45cd21cc49d90080afdd6ecf3351l3⤵PID:1832
-
-
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2868
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2788
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2760
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1016
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:772
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4732
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4180
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵PID:2884
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:60