Analysis
-
max time kernel
51s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
28/11/2023, 08:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe
Resource
win7-20231023-en
windows7-x64
14 signatures
150 seconds
General
-
Target
9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe
-
Size
1.5MB
-
MD5
fb4eb25f8dc7685292534db502a6405f
-
SHA1
fecb32a482ff3a841f99fd44c034e28ea477bea4
-
SHA256
9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7
-
SHA512
35ed8f546f9635b986cd85dca51248021f981cfa15d91deb761c7fadd0bd961f419d48ec50ace8dd7511def9a7563a4d7e9001df1ffc411c0fe69273f3298d02
-
SSDEEP
24576:YLFZeV9rUW3uRIgRNMj88q9s14+6fsqetItnwn56fTT3RO9q:2FgVIRIgRNMY8qq1bSsqEw/3x
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3635043082-2972811465-3176142135-1000\Control Panel\International\Geo\Nation 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe -
resource yara_rule behavioral2/memory/1768-2-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/1768-4-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/1768-5-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/1768-6-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/1768-7-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/1768-9-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/1768-17-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/1768-18-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/1768-19-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/1768-20-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/1768-21-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/1768-22-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/1768-24-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/1768-25-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/1768-26-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/1768-28-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/1768-29-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/1768-30-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/1768-32-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/1768-38-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/1768-40-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/1768-42-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/1768-45-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/1768-47-0x0000000002490000-0x000000000354A000-memory.dmp upx behavioral2/memory/3284-68-0x0000000002BF0000-0x0000000003CAA000-memory.dmp upx behavioral2/memory/3284-70-0x0000000002BF0000-0x0000000003CAA000-memory.dmp upx behavioral2/memory/3284-71-0x0000000002BF0000-0x0000000003CAA000-memory.dmp upx behavioral2/memory/3284-72-0x0000000002BF0000-0x0000000003CAA000-memory.dmp upx behavioral2/memory/3284-73-0x0000000002BF0000-0x0000000003CAA000-memory.dmp upx behavioral2/memory/3284-79-0x0000000002BF0000-0x0000000003CAA000-memory.dmp upx behavioral2/memory/3284-80-0x0000000002BF0000-0x0000000003CAA000-memory.dmp upx behavioral2/memory/3284-81-0x0000000002BF0000-0x0000000003CAA000-memory.dmp upx behavioral2/memory/3284-137-0x0000000002BF0000-0x0000000003CAA000-memory.dmp upx -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe -
Enumerates connected drives 3 TTPs 12 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe File opened (read-only) \??\L: 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe File opened (read-only) \??\M: 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe File opened (read-only) \??\I: 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe File opened (read-only) \??\G: 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe File opened (read-only) \??\I: 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe File opened (read-only) \??\J: 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe File opened (read-only) \??\E: 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe File opened (read-only) \??\G: 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe File opened (read-only) \??\H: 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe File opened (read-only) \??\E: 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe File opened (read-only) \??\H: 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e5831aa 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe File opened for modification C:\Windows\SYSTEM.INI 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe File created C:\Windows\e58b188 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 3284 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 3284 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 3284 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 3284 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Token: SeDebugPrivilege 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1768 wrote to memory of 796 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 8 PID 1768 wrote to memory of 800 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 83 PID 1768 wrote to memory of 64 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 9 PID 1768 wrote to memory of 2396 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 57 PID 1768 wrote to memory of 2420 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 56 PID 1768 wrote to memory of 2508 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 55 PID 1768 wrote to memory of 3408 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 46 PID 1768 wrote to memory of 3608 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 45 PID 1768 wrote to memory of 3824 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 20 PID 1768 wrote to memory of 3952 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 19 PID 1768 wrote to memory of 4048 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 18 PID 1768 wrote to memory of 1044 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 44 PID 1768 wrote to memory of 1436 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 43 PID 1768 wrote to memory of 2068 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 41 PID 1768 wrote to memory of 2448 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 31 PID 1768 wrote to memory of 2148 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 21 PID 1768 wrote to memory of 1556 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 27 PID 1768 wrote to memory of 2200 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 26 PID 1768 wrote to memory of 1424 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 22 PID 1768 wrote to memory of 4060 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 86 PID 1768 wrote to memory of 3284 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 89 PID 1768 wrote to memory of 3284 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 89 PID 1768 wrote to memory of 3284 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 89 PID 1768 wrote to memory of 796 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 8 PID 1768 wrote to memory of 800 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 83 PID 1768 wrote to memory of 64 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 9 PID 1768 wrote to memory of 2396 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 57 PID 1768 wrote to memory of 2420 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 56 PID 1768 wrote to memory of 2508 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 55 PID 1768 wrote to memory of 3408 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 46 PID 1768 wrote to memory of 3608 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 45 PID 1768 wrote to memory of 3824 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 20 PID 1768 wrote to memory of 3952 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 19 PID 1768 wrote to memory of 4048 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 18 PID 1768 wrote to memory of 1044 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 44 PID 1768 wrote to memory of 1436 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 43 PID 1768 wrote to memory of 2068 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 41 PID 1768 wrote to memory of 2448 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 31 PID 1768 wrote to memory of 2148 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 21 PID 1768 wrote to memory of 1556 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 27 PID 1768 wrote to memory of 1424 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 22 PID 1768 wrote to memory of 4060 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 86 PID 1768 wrote to memory of 3284 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 89 PID 1768 wrote to memory of 3284 1768 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 89 PID 3284 wrote to memory of 796 3284 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 8 PID 3284 wrote to memory of 800 3284 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 83 PID 3284 wrote to memory of 64 3284 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 9 PID 3284 wrote to memory of 2396 3284 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 57 PID 3284 wrote to memory of 2420 3284 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 56 PID 3284 wrote to memory of 2508 3284 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 55 PID 3284 wrote to memory of 3408 3284 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 46 PID 3284 wrote to memory of 3608 3284 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 45 PID 3284 wrote to memory of 3824 3284 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 20 PID 3284 wrote to memory of 3952 3284 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 19 PID 3284 wrote to memory of 4048 3284 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 18 PID 3284 wrote to memory of 1044 3284 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 44 PID 3284 wrote to memory of 1436 3284 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 43 PID 3284 wrote to memory of 2068 3284 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 41 PID 3284 wrote to memory of 2448 3284 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 31 PID 3284 wrote to memory of 2148 3284 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 21 PID 3284 wrote to memory of 1556 3284 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 27 PID 3284 wrote to memory of 1424 3284 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 22 PID 3284 wrote to memory of 4060 3284 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 86 PID 3284 wrote to memory of 796 3284 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe 8 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:796
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:64
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4048
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3952
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3824
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca1⤵PID:2148
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1424
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:2200
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:1556
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:2448
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2068
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1436
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1044
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3608
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe"C:\Users\Admin\AppData\Local\Temp\9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe"C:\Users\Admin\AppData\Local\Temp\9bbb3527fa49e57aedd8740130a1ea1da320e1a8ce768bc1e884010273b64be7.exe" --ws3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3284
-
-
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2508
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2420
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2396
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:800
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4060
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD52987c52d6c1ed9f9e36379830011a3e8
SHA112e6e5387fb02b207b3cb723b99034246163a155
SHA25615cb9c44fe91f2f222c5eae716de0c6783b793888f6d43b64ba49b88124f53eb
SHA5122c1ecd4f061aed93485f7c8654fccacd92a56a04b5cc705efd8729bbeed13d8d8271ee07705498a6f06c25c423067cf8797ea042aa65cebc4575e2313537e727
-
Filesize
5.1MB
MD50c43f7ea0bf6612e04f13a713319368b
SHA19444ca99a9813bf983eeea2f7bbc6d48a0125d94
SHA2560bfaf7c2df5b8efa6d7ce7d7b24e0bd98377a383a9f62de6eb4f860cebed3d35
SHA512ca6d601e12ceab576a4ab5a67ac0ead8bbc0d2c86a85df6f46d0c83a3050e5bd4898522edc3b800770f80d2b68aa7258e3f70cf06237c24de49816f9bd8c5339
-
Filesize
97KB
MD541bc7162882fe16c27d1028342c5ef78
SHA106a9ae056ee4cbca714198af3103240844e35632
SHA2567920e9ac3f499c29cea7121bab8ebc55668d23c65f0f04ea47f0440e85580ce5
SHA51298c748b9e644d8d628eb5fecae628140f12db6b074ae0655e67232f1b95a2e62edc2d228c9d9705149e3e7f2fc35b290408f340a0c2e0268203102123edf5a44