Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
22/10/2023, 17:27
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.bf0252fb37b0ea288eb95f7a1efab790.dll
Resource
win7-20230831-en
General
-
Target
NEAS.bf0252fb37b0ea288eb95f7a1efab790.dll
-
Size
120KB
-
MD5
bf0252fb37b0ea288eb95f7a1efab790
-
SHA1
7ec6826af6c96c1eb16407951398578a6795d435
-
SHA256
07f30401b80deb5f5d379207df94bb69da730c9f3c4f55a7e9f9456a3f4c247a
-
SHA512
9a7a63ecba6e9d8cdeda2cdc05ce4c8729a9d3f40984961f3b1efe4c4c342fb112383124dde8312cb082b7ef152b017db84eebea399694457a6c43197d0cadb2
-
SSDEEP
1536:62FwS9Jjdr8umXZWuXEgBAu0xo64IN7QEdTgJo6b0f83TXuPSdtA:62FdRxy7Xloxo64abIA8Ta2
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57e918.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e580887.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e580887.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e580887.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57e918.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57e918.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57e918.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e580887.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57e918.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57e918.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e580887.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e580887.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e580887.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e580887.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57e918.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57e918.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e580887.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e580887.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57e918.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57e918.exe -
Executes dropped EXE 3 IoCs
pid Process 4996 e57e918.exe 2308 e57ef71.exe 4084 e580887.exe -
resource yara_rule behavioral2/memory/4996-7-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4996-9-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4996-10-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4996-18-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4996-25-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4996-31-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4996-32-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4996-33-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4996-35-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4996-34-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4996-36-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4996-37-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4996-38-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4996-39-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4996-48-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4996-57-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4996-59-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4996-62-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4996-64-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4996-70-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4084-97-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx behavioral2/memory/4084-99-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx behavioral2/memory/4084-100-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx behavioral2/memory/4084-101-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx behavioral2/memory/4084-102-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx behavioral2/memory/4084-105-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx behavioral2/memory/4084-120-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57e918.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57e918.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e580887.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e580887.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e580887.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e580887.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e580887.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e580887.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57e918.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57e918.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57e918.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57e918.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57e918.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e580887.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e580887.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57e918.exe -
Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: e57e918.exe File opened (read-only) \??\G: e57e918.exe File opened (read-only) \??\H: e57e918.exe File opened (read-only) \??\I: e57e918.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e57ed4e e57e918.exe File opened for modification C:\Windows\SYSTEM.INI e57e918.exe File created C:\Windows\e58501f e580887.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4996 e57e918.exe 4996 e57e918.exe 4996 e57e918.exe 4996 e57e918.exe 4084 e580887.exe 4084 e580887.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe Token: SeDebugPrivilege 4996 e57e918.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2400 wrote to memory of 564 2400 rundll32.exe 84 PID 2400 wrote to memory of 564 2400 rundll32.exe 84 PID 2400 wrote to memory of 564 2400 rundll32.exe 84 PID 564 wrote to memory of 4996 564 rundll32.exe 86 PID 564 wrote to memory of 4996 564 rundll32.exe 86 PID 564 wrote to memory of 4996 564 rundll32.exe 86 PID 4996 wrote to memory of 792 4996 e57e918.exe 8 PID 4996 wrote to memory of 800 4996 e57e918.exe 9 PID 4996 wrote to memory of 332 4996 e57e918.exe 10 PID 4996 wrote to memory of 2312 4996 e57e918.exe 59 PID 4996 wrote to memory of 2324 4996 e57e918.exe 58 PID 4996 wrote to memory of 2540 4996 e57e918.exe 55 PID 4996 wrote to memory of 3256 4996 e57e918.exe 45 PID 4996 wrote to memory of 3404 4996 e57e918.exe 44 PID 4996 wrote to memory of 3636 4996 e57e918.exe 43 PID 4996 wrote to memory of 3860 4996 e57e918.exe 19 PID 4996 wrote to memory of 3932 4996 e57e918.exe 20 PID 4996 wrote to memory of 4020 4996 e57e918.exe 42 PID 4996 wrote to memory of 3524 4996 e57e918.exe 41 PID 4996 wrote to memory of 488 4996 e57e918.exe 39 PID 4996 wrote to memory of 4944 4996 e57e918.exe 30 PID 4996 wrote to memory of 3424 4996 e57e918.exe 27 PID 4996 wrote to memory of 2688 4996 e57e918.exe 26 PID 4996 wrote to memory of 2372 4996 e57e918.exe 24 PID 4996 wrote to memory of 5092 4996 e57e918.exe 23 PID 4996 wrote to memory of 2400 4996 e57e918.exe 53 PID 4996 wrote to memory of 564 4996 e57e918.exe 84 PID 4996 wrote to memory of 564 4996 e57e918.exe 84 PID 4996 wrote to memory of 2236 4996 e57e918.exe 85 PID 564 wrote to memory of 2308 564 rundll32.exe 87 PID 564 wrote to memory of 2308 564 rundll32.exe 87 PID 564 wrote to memory of 2308 564 rundll32.exe 87 PID 564 wrote to memory of 4084 564 rundll32.exe 88 PID 564 wrote to memory of 4084 564 rundll32.exe 88 PID 564 wrote to memory of 4084 564 rundll32.exe 88 PID 4996 wrote to memory of 792 4996 e57e918.exe 8 PID 4996 wrote to memory of 800 4996 e57e918.exe 9 PID 4996 wrote to memory of 332 4996 e57e918.exe 10 PID 4996 wrote to memory of 2312 4996 e57e918.exe 59 PID 4996 wrote to memory of 2324 4996 e57e918.exe 58 PID 4996 wrote to memory of 2540 4996 e57e918.exe 55 PID 4996 wrote to memory of 3256 4996 e57e918.exe 45 PID 4996 wrote to memory of 3404 4996 e57e918.exe 44 PID 4996 wrote to memory of 3636 4996 e57e918.exe 43 PID 4996 wrote to memory of 3860 4996 e57e918.exe 19 PID 4996 wrote to memory of 3932 4996 e57e918.exe 20 PID 4996 wrote to memory of 4020 4996 e57e918.exe 42 PID 4996 wrote to memory of 3524 4996 e57e918.exe 41 PID 4996 wrote to memory of 488 4996 e57e918.exe 39 PID 4996 wrote to memory of 4944 4996 e57e918.exe 30 PID 4996 wrote to memory of 3424 4996 e57e918.exe 27 PID 4996 wrote to memory of 2688 4996 e57e918.exe 26 PID 4996 wrote to memory of 2372 4996 e57e918.exe 24 PID 4996 wrote to memory of 5092 4996 e57e918.exe 23 PID 4996 wrote to memory of 2308 4996 e57e918.exe 87 PID 4996 wrote to memory of 2308 4996 e57e918.exe 87 PID 4996 wrote to memory of 4084 4996 e57e918.exe 88 PID 4996 wrote to memory of 4084 4996 e57e918.exe 88 PID 4084 wrote to memory of 792 4084 e580887.exe 8 PID 4084 wrote to memory of 800 4084 e580887.exe 9 PID 4084 wrote to memory of 332 4084 e580887.exe 10 PID 4084 wrote to memory of 2312 4084 e580887.exe 59 PID 4084 wrote to memory of 2324 4084 e580887.exe 58 PID 4084 wrote to memory of 2540 4084 e580887.exe 55 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57e918.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e580887.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:792
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:800
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:332
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3860
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3932
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:5092
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:2372
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2688
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3424
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4944
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:488
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3524
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4020
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3636
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3404
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3256
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.bf0252fb37b0ea288eb95f7a1efab790.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.bf0252fb37b0ea288eb95f7a1efab790.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Users\Admin\AppData\Local\Temp\e57e918.exeC:\Users\Admin\AppData\Local\Temp\e57e918.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4996
-
-
C:\Users\Admin\AppData\Local\Temp\e57ef71.exeC:\Users\Admin\AppData\Local\Temp\e57ef71.exe4⤵
- Executes dropped EXE
PID:2308
-
-
C:\Users\Admin\AppData\Local\Temp\e580887.exeC:\Users\Admin\AppData\Local\Temp\e580887.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4084
-
-
-
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2540
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2324
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2312
-
C:\Windows\system32\BackgroundTaskHost.exe"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider1⤵PID:2236
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5db1af904d9e9fb4b76fd4df6de08899a
SHA1c8dce04f015b3dbcc1b8327cbac33019af86d25f
SHA2562a8b3e1bfcf42a04156b3cfab9256c9720541bd059f3ec38c6fc15aa3a550797
SHA512be59925891e6d50ad8f9b735dba09d892f13eeb30385e0ac42a17b6352a6418069f103735df00b05464ce991bc2b742b6628b3c2bd46858687a26531db190311
-
Filesize
97KB
MD5db1af904d9e9fb4b76fd4df6de08899a
SHA1c8dce04f015b3dbcc1b8327cbac33019af86d25f
SHA2562a8b3e1bfcf42a04156b3cfab9256c9720541bd059f3ec38c6fc15aa3a550797
SHA512be59925891e6d50ad8f9b735dba09d892f13eeb30385e0ac42a17b6352a6418069f103735df00b05464ce991bc2b742b6628b3c2bd46858687a26531db190311
-
Filesize
97KB
MD5db1af904d9e9fb4b76fd4df6de08899a
SHA1c8dce04f015b3dbcc1b8327cbac33019af86d25f
SHA2562a8b3e1bfcf42a04156b3cfab9256c9720541bd059f3ec38c6fc15aa3a550797
SHA512be59925891e6d50ad8f9b735dba09d892f13eeb30385e0ac42a17b6352a6418069f103735df00b05464ce991bc2b742b6628b3c2bd46858687a26531db190311
-
Filesize
97KB
MD5db1af904d9e9fb4b76fd4df6de08899a
SHA1c8dce04f015b3dbcc1b8327cbac33019af86d25f
SHA2562a8b3e1bfcf42a04156b3cfab9256c9720541bd059f3ec38c6fc15aa3a550797
SHA512be59925891e6d50ad8f9b735dba09d892f13eeb30385e0ac42a17b6352a6418069f103735df00b05464ce991bc2b742b6628b3c2bd46858687a26531db190311
-
Filesize
97KB
MD5db1af904d9e9fb4b76fd4df6de08899a
SHA1c8dce04f015b3dbcc1b8327cbac33019af86d25f
SHA2562a8b3e1bfcf42a04156b3cfab9256c9720541bd059f3ec38c6fc15aa3a550797
SHA512be59925891e6d50ad8f9b735dba09d892f13eeb30385e0ac42a17b6352a6418069f103735df00b05464ce991bc2b742b6628b3c2bd46858687a26531db190311
-
Filesize
97KB
MD5db1af904d9e9fb4b76fd4df6de08899a
SHA1c8dce04f015b3dbcc1b8327cbac33019af86d25f
SHA2562a8b3e1bfcf42a04156b3cfab9256c9720541bd059f3ec38c6fc15aa3a550797
SHA512be59925891e6d50ad8f9b735dba09d892f13eeb30385e0ac42a17b6352a6418069f103735df00b05464ce991bc2b742b6628b3c2bd46858687a26531db190311
-
Filesize
97KB
MD5db1af904d9e9fb4b76fd4df6de08899a
SHA1c8dce04f015b3dbcc1b8327cbac33019af86d25f
SHA2562a8b3e1bfcf42a04156b3cfab9256c9720541bd059f3ec38c6fc15aa3a550797
SHA512be59925891e6d50ad8f9b735dba09d892f13eeb30385e0ac42a17b6352a6418069f103735df00b05464ce991bc2b742b6628b3c2bd46858687a26531db190311
-
Filesize
257B
MD52ec6c2128485e1d4a320d46f7ecf8336
SHA1f594dea4155d4374222816f2dd0090e34b8e13db
SHA2560db9d4e58c8190c18095ef41ab8fc4fd38c9e7465a25b66932d69b016608d210
SHA51280223d4f2150415eba11e325f98142f816581633030ed2e608c991129c6fbeb269a4bfc6ad7c27d98a29e144ef107dd4848249535e1cfdf3a8322c734292b923