Analysis
-
max time kernel
124s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 06:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2bde763b72af5906018a546aa9de3e8f.exe
Resource
win7-20231215-en
windows7-x64
13 signatures
150 seconds
General
-
Target
2bde763b72af5906018a546aa9de3e8f.exe
-
Size
100KB
-
MD5
2bde763b72af5906018a546aa9de3e8f
-
SHA1
01d6e19db56e3637e3f874123400aa4f10fe39c9
-
SHA256
1e9adeb5f82c163f864f24e3269ba196bea6b8f5d1a9675bd9b197d78bd11848
-
SHA512
a9adf9e27265583d44c7baffd4493879433d73112d84431f49df015e02cef23b2ca0abf49f6578f08cb26ece5dc974acfa84d49b09e0743d432c02bc9dab3a45
-
SSDEEP
1536:VQ5sKLG49vNG7U3U3AMoUoDYhgOHUJvt21EUCUAHJwsPe6g/x:VCJ9vNQsU3PkDUgOHUJV2OkFw+x
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2bde763b72af5906018a546aa9de3e8f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2bde763b72af5906018a546aa9de3e8f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2bde763b72af5906018a546aa9de3e8f.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2bde763b72af5906018a546aa9de3e8f.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2bde763b72af5906018a546aa9de3e8f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2bde763b72af5906018a546aa9de3e8f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2bde763b72af5906018a546aa9de3e8f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2bde763b72af5906018a546aa9de3e8f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2bde763b72af5906018a546aa9de3e8f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2bde763b72af5906018a546aa9de3e8f.exe -
resource yara_rule behavioral2/memory/4780-2-0x00000000022D0000-0x000000000335E000-memory.dmp upx behavioral2/memory/4780-4-0x00000000022D0000-0x000000000335E000-memory.dmp upx behavioral2/memory/4780-5-0x00000000022D0000-0x000000000335E000-memory.dmp upx behavioral2/memory/4780-6-0x00000000022D0000-0x000000000335E000-memory.dmp upx behavioral2/memory/4780-11-0x00000000022D0000-0x000000000335E000-memory.dmp upx behavioral2/memory/4780-12-0x00000000022D0000-0x000000000335E000-memory.dmp upx behavioral2/memory/4780-13-0x00000000022D0000-0x000000000335E000-memory.dmp upx behavioral2/memory/4780-14-0x00000000022D0000-0x000000000335E000-memory.dmp upx behavioral2/memory/4780-15-0x00000000022D0000-0x000000000335E000-memory.dmp upx behavioral2/memory/4780-16-0x00000000022D0000-0x000000000335E000-memory.dmp upx behavioral2/memory/4780-17-0x00000000022D0000-0x000000000335E000-memory.dmp upx behavioral2/memory/4780-18-0x00000000022D0000-0x000000000335E000-memory.dmp upx behavioral2/memory/4780-19-0x00000000022D0000-0x000000000335E000-memory.dmp upx behavioral2/memory/4780-20-0x00000000022D0000-0x000000000335E000-memory.dmp upx behavioral2/memory/4780-22-0x00000000022D0000-0x000000000335E000-memory.dmp upx behavioral2/memory/4780-23-0x00000000022D0000-0x000000000335E000-memory.dmp upx behavioral2/memory/4780-24-0x00000000022D0000-0x000000000335E000-memory.dmp upx behavioral2/memory/4780-26-0x00000000022D0000-0x000000000335E000-memory.dmp upx behavioral2/memory/4780-27-0x00000000022D0000-0x000000000335E000-memory.dmp upx behavioral2/memory/4780-29-0x00000000022D0000-0x000000000335E000-memory.dmp upx behavioral2/memory/4780-31-0x00000000022D0000-0x000000000335E000-memory.dmp upx behavioral2/memory/4780-34-0x00000000022D0000-0x000000000335E000-memory.dmp upx behavioral2/memory/4780-36-0x00000000022D0000-0x000000000335E000-memory.dmp upx behavioral2/memory/4780-38-0x00000000022D0000-0x000000000335E000-memory.dmp upx behavioral2/memory/4780-40-0x00000000022D0000-0x000000000335E000-memory.dmp upx behavioral2/memory/4780-42-0x00000000022D0000-0x000000000335E000-memory.dmp upx behavioral2/memory/4780-44-0x00000000022D0000-0x000000000335E000-memory.dmp upx behavioral2/memory/4780-47-0x00000000022D0000-0x000000000335E000-memory.dmp upx behavioral2/memory/4780-53-0x00000000022D0000-0x000000000335E000-memory.dmp upx behavioral2/memory/4780-55-0x00000000022D0000-0x000000000335E000-memory.dmp upx behavioral2/memory/4780-58-0x00000000022D0000-0x000000000335E000-memory.dmp upx behavioral2/memory/4780-60-0x00000000022D0000-0x000000000335E000-memory.dmp upx behavioral2/memory/4780-62-0x00000000022D0000-0x000000000335E000-memory.dmp upx behavioral2/memory/4780-64-0x00000000022D0000-0x000000000335E000-memory.dmp upx behavioral2/memory/4780-66-0x00000000022D0000-0x000000000335E000-memory.dmp upx behavioral2/memory/4780-68-0x00000000022D0000-0x000000000335E000-memory.dmp upx behavioral2/memory/4780-69-0x00000000022D0000-0x000000000335E000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2bde763b72af5906018a546aa9de3e8f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2bde763b72af5906018a546aa9de3e8f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2bde763b72af5906018a546aa9de3e8f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2bde763b72af5906018a546aa9de3e8f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2bde763b72af5906018a546aa9de3e8f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2bde763b72af5906018a546aa9de3e8f.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 2bde763b72af5906018a546aa9de3e8f.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2bde763b72af5906018a546aa9de3e8f.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: 2bde763b72af5906018a546aa9de3e8f.exe File opened (read-only) \??\O: 2bde763b72af5906018a546aa9de3e8f.exe File opened (read-only) \??\W: 2bde763b72af5906018a546aa9de3e8f.exe File opened (read-only) \??\G: 2bde763b72af5906018a546aa9de3e8f.exe File opened (read-only) \??\I: 2bde763b72af5906018a546aa9de3e8f.exe File opened (read-only) \??\L: 2bde763b72af5906018a546aa9de3e8f.exe File opened (read-only) \??\N: 2bde763b72af5906018a546aa9de3e8f.exe File opened (read-only) \??\S: 2bde763b72af5906018a546aa9de3e8f.exe File opened (read-only) \??\E: 2bde763b72af5906018a546aa9de3e8f.exe File opened (read-only) \??\Q: 2bde763b72af5906018a546aa9de3e8f.exe File opened (read-only) \??\T: 2bde763b72af5906018a546aa9de3e8f.exe File opened (read-only) \??\Z: 2bde763b72af5906018a546aa9de3e8f.exe File opened (read-only) \??\V: 2bde763b72af5906018a546aa9de3e8f.exe File opened (read-only) \??\X: 2bde763b72af5906018a546aa9de3e8f.exe File opened (read-only) \??\H: 2bde763b72af5906018a546aa9de3e8f.exe File opened (read-only) \??\J: 2bde763b72af5906018a546aa9de3e8f.exe File opened (read-only) \??\K: 2bde763b72af5906018a546aa9de3e8f.exe File opened (read-only) \??\P: 2bde763b72af5906018a546aa9de3e8f.exe File opened (read-only) \??\R: 2bde763b72af5906018a546aa9de3e8f.exe File opened (read-only) \??\U: 2bde763b72af5906018a546aa9de3e8f.exe File opened (read-only) \??\Y: 2bde763b72af5906018a546aa9de3e8f.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf 2bde763b72af5906018a546aa9de3e8f.exe File opened for modification F:\autorun.inf 2bde763b72af5906018a546aa9de3e8f.exe -
Drops file in Program Files directory 11 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe 2bde763b72af5906018a546aa9de3e8f.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe 2bde763b72af5906018a546aa9de3e8f.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe 2bde763b72af5906018a546aa9de3e8f.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe 2bde763b72af5906018a546aa9de3e8f.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe 2bde763b72af5906018a546aa9de3e8f.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe 2bde763b72af5906018a546aa9de3e8f.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe 2bde763b72af5906018a546aa9de3e8f.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe 2bde763b72af5906018a546aa9de3e8f.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe 2bde763b72af5906018a546aa9de3e8f.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe 2bde763b72af5906018a546aa9de3e8f.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe 2bde763b72af5906018a546aa9de3e8f.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 2bde763b72af5906018a546aa9de3e8f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings 2bde763b72af5906018a546aa9de3e8f.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 4780 2bde763b72af5906018a546aa9de3e8f.exe 4780 2bde763b72af5906018a546aa9de3e8f.exe 4780 2bde763b72af5906018a546aa9de3e8f.exe 4780 2bde763b72af5906018a546aa9de3e8f.exe 4780 2bde763b72af5906018a546aa9de3e8f.exe 4780 2bde763b72af5906018a546aa9de3e8f.exe 4780 2bde763b72af5906018a546aa9de3e8f.exe 4780 2bde763b72af5906018a546aa9de3e8f.exe 4780 2bde763b72af5906018a546aa9de3e8f.exe 4780 2bde763b72af5906018a546aa9de3e8f.exe 4780 2bde763b72af5906018a546aa9de3e8f.exe 4780 2bde763b72af5906018a546aa9de3e8f.exe 4780 2bde763b72af5906018a546aa9de3e8f.exe 4780 2bde763b72af5906018a546aa9de3e8f.exe 4780 2bde763b72af5906018a546aa9de3e8f.exe 4780 2bde763b72af5906018a546aa9de3e8f.exe 4780 2bde763b72af5906018a546aa9de3e8f.exe 4780 2bde763b72af5906018a546aa9de3e8f.exe 4780 2bde763b72af5906018a546aa9de3e8f.exe 4780 2bde763b72af5906018a546aa9de3e8f.exe 4780 2bde763b72af5906018a546aa9de3e8f.exe 4780 2bde763b72af5906018a546aa9de3e8f.exe 4780 2bde763b72af5906018a546aa9de3e8f.exe 4780 2bde763b72af5906018a546aa9de3e8f.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe Token: SeDebugPrivilege 4780 2bde763b72af5906018a546aa9de3e8f.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4780 wrote to memory of 784 4780 2bde763b72af5906018a546aa9de3e8f.exe 8 PID 4780 wrote to memory of 792 4780 2bde763b72af5906018a546aa9de3e8f.exe 84 PID 4780 wrote to memory of 324 4780 2bde763b72af5906018a546aa9de3e8f.exe 9 PID 4780 wrote to memory of 2508 4780 2bde763b72af5906018a546aa9de3e8f.exe 53 PID 4780 wrote to memory of 2524 4780 2bde763b72af5906018a546aa9de3e8f.exe 52 PID 4780 wrote to memory of 2824 4780 2bde763b72af5906018a546aa9de3e8f.exe 46 PID 4780 wrote to memory of 3332 4780 2bde763b72af5906018a546aa9de3e8f.exe 41 PID 4780 wrote to memory of 3472 4780 2bde763b72af5906018a546aa9de3e8f.exe 40 PID 4780 wrote to memory of 3676 4780 2bde763b72af5906018a546aa9de3e8f.exe 39 PID 4780 wrote to memory of 3768 4780 2bde763b72af5906018a546aa9de3e8f.exe 38 PID 4780 wrote to memory of 3888 4780 2bde763b72af5906018a546aa9de3e8f.exe 13 PID 4780 wrote to memory of 3972 4780 2bde763b72af5906018a546aa9de3e8f.exe 37 PID 4780 wrote to memory of 3608 4780 2bde763b72af5906018a546aa9de3e8f.exe 36 PID 4780 wrote to memory of 1936 4780 2bde763b72af5906018a546aa9de3e8f.exe 34 PID 4780 wrote to memory of 1544 4780 2bde763b72af5906018a546aa9de3e8f.exe 26 PID 4780 wrote to memory of 2548 4780 2bde763b72af5906018a546aa9de3e8f.exe 17 PID 4780 wrote to memory of 832 4780 2bde763b72af5906018a546aa9de3e8f.exe 22 PID 4780 wrote to memory of 2920 4780 2bde763b72af5906018a546aa9de3e8f.exe 21 PID 4780 wrote to memory of 4512 4780 2bde763b72af5906018a546aa9de3e8f.exe 88 PID 4780 wrote to memory of 2540 4780 2bde763b72af5906018a546aa9de3e8f.exe 89 PID 4780 wrote to memory of 784 4780 2bde763b72af5906018a546aa9de3e8f.exe 8 PID 4780 wrote to memory of 792 4780 2bde763b72af5906018a546aa9de3e8f.exe 84 PID 4780 wrote to memory of 324 4780 2bde763b72af5906018a546aa9de3e8f.exe 9 PID 4780 wrote to memory of 2508 4780 2bde763b72af5906018a546aa9de3e8f.exe 53 PID 4780 wrote to memory of 2524 4780 2bde763b72af5906018a546aa9de3e8f.exe 52 PID 4780 wrote to memory of 2824 4780 2bde763b72af5906018a546aa9de3e8f.exe 46 PID 4780 wrote to memory of 3332 4780 2bde763b72af5906018a546aa9de3e8f.exe 41 PID 4780 wrote to memory of 3472 4780 2bde763b72af5906018a546aa9de3e8f.exe 40 PID 4780 wrote to memory of 3676 4780 2bde763b72af5906018a546aa9de3e8f.exe 39 PID 4780 wrote to memory of 3768 4780 2bde763b72af5906018a546aa9de3e8f.exe 38 PID 4780 wrote to memory of 3888 4780 2bde763b72af5906018a546aa9de3e8f.exe 13 PID 4780 wrote to memory of 3972 4780 2bde763b72af5906018a546aa9de3e8f.exe 37 PID 4780 wrote to memory of 3608 4780 2bde763b72af5906018a546aa9de3e8f.exe 36 PID 4780 wrote to memory of 1936 4780 2bde763b72af5906018a546aa9de3e8f.exe 34 PID 4780 wrote to memory of 1544 4780 2bde763b72af5906018a546aa9de3e8f.exe 26 PID 4780 wrote to memory of 2548 4780 2bde763b72af5906018a546aa9de3e8f.exe 17 PID 4780 wrote to memory of 832 4780 2bde763b72af5906018a546aa9de3e8f.exe 22 PID 4780 wrote to memory of 2920 4780 2bde763b72af5906018a546aa9de3e8f.exe 21 PID 4780 wrote to memory of 4512 4780 2bde763b72af5906018a546aa9de3e8f.exe 88 PID 4780 wrote to memory of 2540 4780 2bde763b72af5906018a546aa9de3e8f.exe 89 PID 4780 wrote to memory of 784 4780 2bde763b72af5906018a546aa9de3e8f.exe 8 PID 4780 wrote to memory of 792 4780 2bde763b72af5906018a546aa9de3e8f.exe 84 PID 4780 wrote to memory of 324 4780 2bde763b72af5906018a546aa9de3e8f.exe 9 PID 4780 wrote to memory of 2508 4780 2bde763b72af5906018a546aa9de3e8f.exe 53 PID 4780 wrote to memory of 2524 4780 2bde763b72af5906018a546aa9de3e8f.exe 52 PID 4780 wrote to memory of 2824 4780 2bde763b72af5906018a546aa9de3e8f.exe 46 PID 4780 wrote to memory of 3332 4780 2bde763b72af5906018a546aa9de3e8f.exe 41 PID 4780 wrote to memory of 3472 4780 2bde763b72af5906018a546aa9de3e8f.exe 40 PID 4780 wrote to memory of 3676 4780 2bde763b72af5906018a546aa9de3e8f.exe 39 PID 4780 wrote to memory of 3768 4780 2bde763b72af5906018a546aa9de3e8f.exe 38 PID 4780 wrote to memory of 3888 4780 2bde763b72af5906018a546aa9de3e8f.exe 13 PID 4780 wrote to memory of 3972 4780 2bde763b72af5906018a546aa9de3e8f.exe 37 PID 4780 wrote to memory of 3608 4780 2bde763b72af5906018a546aa9de3e8f.exe 36 PID 4780 wrote to memory of 1936 4780 2bde763b72af5906018a546aa9de3e8f.exe 34 PID 4780 wrote to memory of 1544 4780 2bde763b72af5906018a546aa9de3e8f.exe 26 PID 4780 wrote to memory of 2548 4780 2bde763b72af5906018a546aa9de3e8f.exe 17 PID 4780 wrote to memory of 832 4780 2bde763b72af5906018a546aa9de3e8f.exe 22 PID 4780 wrote to memory of 2920 4780 2bde763b72af5906018a546aa9de3e8f.exe 21 PID 4780 wrote to memory of 4512 4780 2bde763b72af5906018a546aa9de3e8f.exe 88 PID 4780 wrote to memory of 2540 4780 2bde763b72af5906018a546aa9de3e8f.exe 89 PID 4780 wrote to memory of 784 4780 2bde763b72af5906018a546aa9de3e8f.exe 8 PID 4780 wrote to memory of 792 4780 2bde763b72af5906018a546aa9de3e8f.exe 84 PID 4780 wrote to memory of 324 4780 2bde763b72af5906018a546aa9de3e8f.exe 9 PID 4780 wrote to memory of 2508 4780 2bde763b72af5906018a546aa9de3e8f.exe 53 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2bde763b72af5906018a546aa9de3e8f.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:324
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3888
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca1⤵PID:2548
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:2920
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:832
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:1544
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1936
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3608
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3972
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3768
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3676
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3472
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\2bde763b72af5906018a546aa9de3e8f.exe"C:\Users\Admin\AppData\Local\Temp\2bde763b72af5906018a546aa9de3e8f.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4780
-
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2824
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2524
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2508
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:792
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4512
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2540
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:4140
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD5041b2a349cb80481dc46f76037d80bcc
SHA16a0763e077bf48fefb50d341bdbd33729be45051
SHA2568c8de4516ed3dd3a9751a9690c1b60c63f31554163df64cb7f4587e4b9b2c266
SHA5123745fe27f7df88081a7e01764dafccd7cda853bb09eef2fca08df46b677fe6f4a2534b601fbd2938305adbd3e7535e66cb33cccf6c3e845c210c380fcce61370