Analysis
-
max time kernel
34s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 22:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3f330de4de9dde9297ca4e8513d6c6b1.exe
Resource
win7-20231129-en
windows7-x64
16 signatures
150 seconds
General
-
Target
3f330de4de9dde9297ca4e8513d6c6b1.exe
-
Size
100KB
-
MD5
3f330de4de9dde9297ca4e8513d6c6b1
-
SHA1
3f32d133a9ba2fcc815eb6c5de34658bd7e9f09d
-
SHA256
34b3ef765ce156ab94a562e025df783cdd2a6f3d5d4022cd2839713b45c3a229
-
SHA512
460ba9b0f4b39a78e52be65b382770ac1ae3605bd2308b3cbb5c385a0dda0800b95969b2659473c6409b6285d01caee800dae423a91869f8f1c6478f6ec703e7
-
SSDEEP
3072:U49ZW2hKwYeQJousk2zMSvOeLUEVfWPV7:PZeeKouskSMSDLXm
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 3f330de4de9dde9297ca4e8513d6c6b1.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 3f330de4de9dde9297ca4e8513d6c6b1.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 3f330de4de9dde9297ca4e8513d6c6b1.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 3f330de4de9dde9297ca4e8513d6c6b1.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 3f330de4de9dde9297ca4e8513d6c6b1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 3f330de4de9dde9297ca4e8513d6c6b1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 3f330de4de9dde9297ca4e8513d6c6b1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 3f330de4de9dde9297ca4e8513d6c6b1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 3f330de4de9dde9297ca4e8513d6c6b1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 3f330de4de9dde9297ca4e8513d6c6b1.exe -
resource yara_rule behavioral2/memory/456-2-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral2/memory/456-4-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral2/memory/456-5-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral2/memory/456-10-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral2/memory/456-11-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral2/memory/456-12-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral2/memory/456-13-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral2/memory/456-14-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral2/memory/456-15-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral2/memory/456-16-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral2/memory/456-17-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral2/memory/456-18-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral2/memory/456-19-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral2/memory/456-20-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral2/memory/456-22-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral2/memory/456-23-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral2/memory/456-24-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral2/memory/456-26-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral2/memory/456-27-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral2/memory/456-29-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral2/memory/456-31-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral2/memory/456-34-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral2/memory/456-36-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral2/memory/456-38-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral2/memory/456-41-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral2/memory/456-43-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral2/memory/456-45-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral2/memory/456-47-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral2/memory/456-49-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral2/memory/456-51-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral2/memory/456-52-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral2/memory/456-54-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral2/memory/456-60-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral2/memory/456-61-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral2/memory/456-62-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral2/memory/456-67-0x00000000022E0000-0x000000000336E000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 3f330de4de9dde9297ca4e8513d6c6b1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 3f330de4de9dde9297ca4e8513d6c6b1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 3f330de4de9dde9297ca4e8513d6c6b1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 3f330de4de9dde9297ca4e8513d6c6b1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 3f330de4de9dde9297ca4e8513d6c6b1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 3f330de4de9dde9297ca4e8513d6c6b1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 3f330de4de9dde9297ca4e8513d6c6b1.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 3f330de4de9dde9297ca4e8513d6c6b1.exe -
Enumerates connected drives 3 TTPs 16 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: 3f330de4de9dde9297ca4e8513d6c6b1.exe File opened (read-only) \??\V: 3f330de4de9dde9297ca4e8513d6c6b1.exe File opened (read-only) \??\I: 3f330de4de9dde9297ca4e8513d6c6b1.exe File opened (read-only) \??\M: 3f330de4de9dde9297ca4e8513d6c6b1.exe File opened (read-only) \??\L: 3f330de4de9dde9297ca4e8513d6c6b1.exe File opened (read-only) \??\O: 3f330de4de9dde9297ca4e8513d6c6b1.exe File opened (read-only) \??\P: 3f330de4de9dde9297ca4e8513d6c6b1.exe File opened (read-only) \??\H: 3f330de4de9dde9297ca4e8513d6c6b1.exe File opened (read-only) \??\K: 3f330de4de9dde9297ca4e8513d6c6b1.exe File opened (read-only) \??\W: 3f330de4de9dde9297ca4e8513d6c6b1.exe File opened (read-only) \??\G: 3f330de4de9dde9297ca4e8513d6c6b1.exe File opened (read-only) \??\Q: 3f330de4de9dde9297ca4e8513d6c6b1.exe File opened (read-only) \??\N: 3f330de4de9dde9297ca4e8513d6c6b1.exe File opened (read-only) \??\S: 3f330de4de9dde9297ca4e8513d6c6b1.exe File opened (read-only) \??\E: 3f330de4de9dde9297ca4e8513d6c6b1.exe File opened (read-only) \??\J: 3f330de4de9dde9297ca4e8513d6c6b1.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 3f330de4de9dde9297ca4e8513d6c6b1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\Local Settings 3f330de4de9dde9297ca4e8513d6c6b1.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 456 3f330de4de9dde9297ca4e8513d6c6b1.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe Token: SeDebugPrivilege 456 3f330de4de9dde9297ca4e8513d6c6b1.exe -
Suspicious use of WriteProcessMemory 61 IoCs
description pid Process procid_target PID 456 wrote to memory of 780 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 82 PID 456 wrote to memory of 788 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 81 PID 456 wrote to memory of 336 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 1 PID 456 wrote to memory of 2812 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 43 PID 456 wrote to memory of 2820 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 42 PID 456 wrote to memory of 3044 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 40 PID 456 wrote to memory of 3420 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 36 PID 456 wrote to memory of 3544 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 35 PID 456 wrote to memory of 3736 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 34 PID 456 wrote to memory of 3868 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 33 PID 456 wrote to memory of 3932 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 6 PID 456 wrote to memory of 4020 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 32 PID 456 wrote to memory of 4176 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 31 PID 456 wrote to memory of 4340 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 29 PID 456 wrote to memory of 2180 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 17 PID 456 wrote to memory of 3636 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 9 PID 456 wrote to memory of 3492 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 8 PID 456 wrote to memory of 4356 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 7 PID 456 wrote to memory of 1724 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 56 PID 456 wrote to memory of 4636 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 60 PID 456 wrote to memory of 780 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 82 PID 456 wrote to memory of 788 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 81 PID 456 wrote to memory of 336 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 1 PID 456 wrote to memory of 2812 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 43 PID 456 wrote to memory of 2820 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 42 PID 456 wrote to memory of 3044 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 40 PID 456 wrote to memory of 3420 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 36 PID 456 wrote to memory of 3544 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 35 PID 456 wrote to memory of 3736 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 34 PID 456 wrote to memory of 3868 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 33 PID 456 wrote to memory of 3932 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 6 PID 456 wrote to memory of 4020 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 32 PID 456 wrote to memory of 4176 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 31 PID 456 wrote to memory of 4340 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 29 PID 456 wrote to memory of 2180 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 17 PID 456 wrote to memory of 3636 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 9 PID 456 wrote to memory of 3492 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 8 PID 456 wrote to memory of 4356 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 7 PID 456 wrote to memory of 4636 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 60 PID 456 wrote to memory of 376 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 89 PID 456 wrote to memory of 3444 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 91 PID 456 wrote to memory of 780 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 82 PID 456 wrote to memory of 788 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 81 PID 456 wrote to memory of 336 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 1 PID 456 wrote to memory of 2812 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 43 PID 456 wrote to memory of 2820 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 42 PID 456 wrote to memory of 3044 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 40 PID 456 wrote to memory of 3420 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 36 PID 456 wrote to memory of 3544 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 35 PID 456 wrote to memory of 3736 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 34 PID 456 wrote to memory of 3868 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 33 PID 456 wrote to memory of 3932 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 6 PID 456 wrote to memory of 4020 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 32 PID 456 wrote to memory of 4176 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 31 PID 456 wrote to memory of 4340 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 29 PID 456 wrote to memory of 2180 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 17 PID 456 wrote to memory of 3636 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 9 PID 456 wrote to memory of 3492 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 8 PID 456 wrote to memory of 4356 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 7 PID 456 wrote to memory of 4636 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 60 PID 456 wrote to memory of 376 456 3f330de4de9dde9297ca4e8513d6c6b1.exe 89 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 3f330de4de9dde9297ca4e8513d6c6b1.exe
Processes
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:336
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3932
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:4356
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:3492
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca1⤵PID:3636
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\3f330de4de9dde9297ca4e8513d6c6b1.exe"C:\Users\Admin\AppData\Local\Temp\3f330de4de9dde9297ca4e8513d6c6b1.exe"1⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:456
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4340
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4176
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4020
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3868
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3736
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3544
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3420
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:3044
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2820
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2812
-
C:\Windows\system32\BackgroundTaskHost.exe"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider1⤵PID:1724
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4636
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:376
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵PID:3444
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD560796c362af13ed512f83a9e2cf25029
SHA19016ecdbfa1e2b5f65fe950e3facadffe73af716
SHA256ef441dea796974071e7f9053a2311755578b8d221a4158c45b96a5a23af99375
SHA5120583d6f90bb69f36395a3d0b0450d762d725bc040de2bbf15460c5d959255314e088b808d919bd189bcf0c7718ee43f58f3a011c599895ee2e9b3f9ea22c831b