Analysis
-
max time kernel
123s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2023 19:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6833ed1c29c0b27f3a7a2c00ced831f0.exe
Resource
win7-20231025-en
windows7-x64
16 signatures
150 seconds
General
-
Target
6833ed1c29c0b27f3a7a2c00ced831f0.exe
-
Size
65KB
-
MD5
6833ed1c29c0b27f3a7a2c00ced831f0
-
SHA1
4e4c63cf5ab07db76631643b4af3446d706b8b16
-
SHA256
2b97d9714d1a1a7baece3cee8937e6fa447391b0b6bdd60b9fbf8e47779aab27
-
SHA512
ab90387d4d5a6180861a5d988f19d18b0d8f79a5e6eaa6b0de95702910c640cb0775388afa616c9af3091efa3ffc35dd9bc650e0fbf62d86261fe99c13e796b3
-
SSDEEP
1536:xMwjyUGMNZCe2fqH06iXwNFzCL2qADHm9NJhORWuT1S76AtLkW9Ll:fjZGMLCeCg06OcAxVhOO7vkW95
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 6833ed1c29c0b27f3a7a2c00ced831f0.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 6833ed1c29c0b27f3a7a2c00ced831f0.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 6833ed1c29c0b27f3a7a2c00ced831f0.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6833ed1c29c0b27f3a7a2c00ced831f0.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 6833ed1c29c0b27f3a7a2c00ced831f0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 6833ed1c29c0b27f3a7a2c00ced831f0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 6833ed1c29c0b27f3a7a2c00ced831f0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 6833ed1c29c0b27f3a7a2c00ced831f0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 6833ed1c29c0b27f3a7a2c00ced831f0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 6833ed1c29c0b27f3a7a2c00ced831f0.exe -
resource yara_rule behavioral2/memory/2268-1-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/2268-3-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/2268-4-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/2268-5-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/2268-10-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/2268-11-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/2268-12-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/2268-13-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/2268-14-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/2268-15-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/2268-21-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/2268-22-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/2268-23-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/2268-24-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/2268-25-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/2268-27-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/2268-28-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/2268-29-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/2268-31-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/2268-34-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/2268-40-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/2268-41-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/2268-43-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/2268-46-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/2268-47-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/2268-50-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/2268-52-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/2268-54-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/2268-56-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/2268-58-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/2268-60-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/2268-62-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/2268-63-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/2268-64-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/2268-66-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/2268-69-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/2268-70-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/2268-72-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/2268-82-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/2268-87-0x0000000000870000-0x000000000192A000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 6833ed1c29c0b27f3a7a2c00ced831f0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 6833ed1c29c0b27f3a7a2c00ced831f0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 6833ed1c29c0b27f3a7a2c00ced831f0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 6833ed1c29c0b27f3a7a2c00ced831f0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 6833ed1c29c0b27f3a7a2c00ced831f0.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 6833ed1c29c0b27f3a7a2c00ced831f0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 6833ed1c29c0b27f3a7a2c00ced831f0.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6833ed1c29c0b27f3a7a2c00ced831f0.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: 6833ed1c29c0b27f3a7a2c00ced831f0.exe File opened (read-only) \??\K: 6833ed1c29c0b27f3a7a2c00ced831f0.exe File opened (read-only) \??\L: 6833ed1c29c0b27f3a7a2c00ced831f0.exe File opened (read-only) \??\O: 6833ed1c29c0b27f3a7a2c00ced831f0.exe File opened (read-only) \??\R: 6833ed1c29c0b27f3a7a2c00ced831f0.exe File opened (read-only) \??\U: 6833ed1c29c0b27f3a7a2c00ced831f0.exe File opened (read-only) \??\I: 6833ed1c29c0b27f3a7a2c00ced831f0.exe File opened (read-only) \??\N: 6833ed1c29c0b27f3a7a2c00ced831f0.exe File opened (read-only) \??\P: 6833ed1c29c0b27f3a7a2c00ced831f0.exe File opened (read-only) \??\Q: 6833ed1c29c0b27f3a7a2c00ced831f0.exe File opened (read-only) \??\S: 6833ed1c29c0b27f3a7a2c00ced831f0.exe File opened (read-only) \??\E: 6833ed1c29c0b27f3a7a2c00ced831f0.exe File opened (read-only) \??\G: 6833ed1c29c0b27f3a7a2c00ced831f0.exe File opened (read-only) \??\H: 6833ed1c29c0b27f3a7a2c00ced831f0.exe File opened (read-only) \??\T: 6833ed1c29c0b27f3a7a2c00ced831f0.exe File opened (read-only) \??\X: 6833ed1c29c0b27f3a7a2c00ced831f0.exe File opened (read-only) \??\Z: 6833ed1c29c0b27f3a7a2c00ced831f0.exe File opened (read-only) \??\M: 6833ed1c29c0b27f3a7a2c00ced831f0.exe File opened (read-only) \??\V: 6833ed1c29c0b27f3a7a2c00ced831f0.exe File opened (read-only) \??\W: 6833ed1c29c0b27f3a7a2c00ced831f0.exe File opened (read-only) \??\Y: 6833ed1c29c0b27f3a7a2c00ced831f0.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification F:\autorun.inf 6833ed1c29c0b27f3a7a2c00ced831f0.exe File opened for modification C:\autorun.inf 6833ed1c29c0b27f3a7a2c00ced831f0.exe -
Drops file in Program Files directory 11 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7zG.exe 6833ed1c29c0b27f3a7a2c00ced831f0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 6833ed1c29c0b27f3a7a2c00ced831f0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 6833ed1c29c0b27f3a7a2c00ced831f0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 6833ed1c29c0b27f3a7a2c00ced831f0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 6833ed1c29c0b27f3a7a2c00ced831f0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 6833ed1c29c0b27f3a7a2c00ced831f0.exe File opened for modification C:\Program Files\7-Zip\7z.exe 6833ed1c29c0b27f3a7a2c00ced831f0.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 6833ed1c29c0b27f3a7a2c00ced831f0.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 6833ed1c29c0b27f3a7a2c00ced831f0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 6833ed1c29c0b27f3a7a2c00ced831f0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 6833ed1c29c0b27f3a7a2c00ced831f0.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 6833ed1c29c0b27f3a7a2c00ced831f0.exe File created C:\Windows\e578c81 6833ed1c29c0b27f3a7a2c00ced831f0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000_Classes\Local Settings 6833ed1c29c0b27f3a7a2c00ced831f0.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe Token: SeDebugPrivilege 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2268 wrote to memory of 780 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 8 PID 2268 wrote to memory of 788 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 13 PID 2268 wrote to memory of 60 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 9 PID 2268 wrote to memory of 2512 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 58 PID 2268 wrote to memory of 2532 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 57 PID 2268 wrote to memory of 2636 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 55 PID 2268 wrote to memory of 3168 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 47 PID 2268 wrote to memory of 3492 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 44 PID 2268 wrote to memory of 3684 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 43 PID 2268 wrote to memory of 3876 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 42 PID 2268 wrote to memory of 3940 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 18 PID 2268 wrote to memory of 4024 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 19 PID 2268 wrote to memory of 3576 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 41 PID 2268 wrote to memory of 5084 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 33 PID 2268 wrote to memory of 1696 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 28 PID 2268 wrote to memory of 3116 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 31 PID 2268 wrote to memory of 3056 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 39 PID 2268 wrote to memory of 2400 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 36 PID 2268 wrote to memory of 3736 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 85 PID 2268 wrote to memory of 780 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 8 PID 2268 wrote to memory of 788 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 13 PID 2268 wrote to memory of 60 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 9 PID 2268 wrote to memory of 2512 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 58 PID 2268 wrote to memory of 2532 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 57 PID 2268 wrote to memory of 2636 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 55 PID 2268 wrote to memory of 3168 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 47 PID 2268 wrote to memory of 3492 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 44 PID 2268 wrote to memory of 3684 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 43 PID 2268 wrote to memory of 3876 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 42 PID 2268 wrote to memory of 3940 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 18 PID 2268 wrote to memory of 4024 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 19 PID 2268 wrote to memory of 3576 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 41 PID 2268 wrote to memory of 5084 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 33 PID 2268 wrote to memory of 1696 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 28 PID 2268 wrote to memory of 3116 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 31 PID 2268 wrote to memory of 3056 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 39 PID 2268 wrote to memory of 2400 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 36 PID 2268 wrote to memory of 780 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 8 PID 2268 wrote to memory of 788 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 13 PID 2268 wrote to memory of 60 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 9 PID 2268 wrote to memory of 2512 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 58 PID 2268 wrote to memory of 2532 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 57 PID 2268 wrote to memory of 2636 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 55 PID 2268 wrote to memory of 3168 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 47 PID 2268 wrote to memory of 3492 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 44 PID 2268 wrote to memory of 3684 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 43 PID 2268 wrote to memory of 3876 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 42 PID 2268 wrote to memory of 3940 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 18 PID 2268 wrote to memory of 4024 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 19 PID 2268 wrote to memory of 3576 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 41 PID 2268 wrote to memory of 5084 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 33 PID 2268 wrote to memory of 1696 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 28 PID 2268 wrote to memory of 3116 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 31 PID 2268 wrote to memory of 3056 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 39 PID 2268 wrote to memory of 780 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 8 PID 2268 wrote to memory of 788 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 13 PID 2268 wrote to memory of 60 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 9 PID 2268 wrote to memory of 2512 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 58 PID 2268 wrote to memory of 2532 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 57 PID 2268 wrote to memory of 2636 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 55 PID 2268 wrote to memory of 3168 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 47 PID 2268 wrote to memory of 3492 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 44 PID 2268 wrote to memory of 3684 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 43 PID 2268 wrote to memory of 3876 2268 6833ed1c29c0b27f3a7a2c00ced831f0.exe 42 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6833ed1c29c0b27f3a7a2c00ced831f0.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:60
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3940
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4024
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:1696
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3116
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:5084
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:2400
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3056
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3576
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3876
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3684
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3492
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\6833ed1c29c0b27f3a7a2c00ced831f0.exe"C:\Users\Admin\AppData\Local\Temp\6833ed1c29c0b27f3a7a2c00ced831f0.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2268
-
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2636
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2532
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2512
-
C:\Windows\system32\BackgroundTaskHost.exe"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider1⤵PID:3736
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5f54d590106f51d629af57920d781845d
SHA1bb55672cbe4c7eab9903bf96fc95ac074efd2f67
SHA25658c8e26afadfb3c5ae27f16dd605a16e655b72a6e1882e8074cd27acd4b237f4
SHA512c8767dc193f85b2a287f78460a1342ae2d12a29974f74a0b817f3e318cbbe52fd6254750871c72a39981013faffdd07cc1cf9486c05dad480d9efa5db337769b