Analysis
-
max time kernel
122s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29-01-2024 11:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7fbed750de373c17bcc9ade20a93477f.exe
Resource
win7-20231215-en
windows7-x64
16 signatures
150 seconds
General
-
Target
7fbed750de373c17bcc9ade20a93477f.exe
-
Size
100KB
-
MD5
7fbed750de373c17bcc9ade20a93477f
-
SHA1
ed79f69a0c599d7c13995decc601cbe0d0940c10
-
SHA256
1c483c16954c800300b3a95c3d772af31a6dc5ce7c011b58dd6348e9d9638bde
-
SHA512
dc8b4f3eebe8edca5d71e93ddfd8ef6a83375c43cde7a6334c474152df6461beaa9f007f30305722ea0e380b763711dc902ca5ae71fa7e86c4c378a359cce6fd
-
SSDEEP
1536:5rzlFRLKVkUgMC2xfK7HylWkSs3Qd6kPv+NTyCXQygInH:5rRFRLKaHMpxfuoSsQd6KvJ
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 7fbed750de373c17bcc9ade20a93477f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 7fbed750de373c17bcc9ade20a93477f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 7fbed750de373c17bcc9ade20a93477f.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7fbed750de373c17bcc9ade20a93477f.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 7fbed750de373c17bcc9ade20a93477f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 7fbed750de373c17bcc9ade20a93477f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 7fbed750de373c17bcc9ade20a93477f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 7fbed750de373c17bcc9ade20a93477f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 7fbed750de373c17bcc9ade20a93477f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 7fbed750de373c17bcc9ade20a93477f.exe -
resource yara_rule behavioral2/memory/808-2-0x0000000002180000-0x000000000320E000-memory.dmp upx behavioral2/memory/808-4-0x0000000002180000-0x000000000320E000-memory.dmp upx behavioral2/memory/808-5-0x0000000002180000-0x000000000320E000-memory.dmp upx behavioral2/memory/808-8-0x0000000002180000-0x000000000320E000-memory.dmp upx behavioral2/memory/808-11-0x0000000002180000-0x000000000320E000-memory.dmp upx behavioral2/memory/808-12-0x0000000002180000-0x000000000320E000-memory.dmp upx behavioral2/memory/808-13-0x0000000002180000-0x000000000320E000-memory.dmp upx behavioral2/memory/808-14-0x0000000002180000-0x000000000320E000-memory.dmp upx behavioral2/memory/808-15-0x0000000002180000-0x000000000320E000-memory.dmp upx behavioral2/memory/808-16-0x0000000002180000-0x000000000320E000-memory.dmp upx behavioral2/memory/808-17-0x0000000002180000-0x000000000320E000-memory.dmp upx behavioral2/memory/808-18-0x0000000002180000-0x000000000320E000-memory.dmp upx behavioral2/memory/808-19-0x0000000002180000-0x000000000320E000-memory.dmp upx behavioral2/memory/808-20-0x0000000002180000-0x000000000320E000-memory.dmp upx behavioral2/memory/808-22-0x0000000002180000-0x000000000320E000-memory.dmp upx behavioral2/memory/808-23-0x0000000002180000-0x000000000320E000-memory.dmp upx behavioral2/memory/808-24-0x0000000002180000-0x000000000320E000-memory.dmp upx behavioral2/memory/808-26-0x0000000002180000-0x000000000320E000-memory.dmp upx behavioral2/memory/808-27-0x0000000002180000-0x000000000320E000-memory.dmp upx behavioral2/memory/808-29-0x0000000002180000-0x000000000320E000-memory.dmp upx behavioral2/memory/808-31-0x0000000002180000-0x000000000320E000-memory.dmp upx behavioral2/memory/808-34-0x0000000002180000-0x000000000320E000-memory.dmp upx behavioral2/memory/808-36-0x0000000002180000-0x000000000320E000-memory.dmp upx behavioral2/memory/808-38-0x0000000002180000-0x000000000320E000-memory.dmp upx behavioral2/memory/808-45-0x0000000002180000-0x000000000320E000-memory.dmp upx behavioral2/memory/808-47-0x0000000002180000-0x000000000320E000-memory.dmp upx behavioral2/memory/808-49-0x0000000002180000-0x000000000320E000-memory.dmp upx behavioral2/memory/808-51-0x0000000002180000-0x000000000320E000-memory.dmp upx behavioral2/memory/808-53-0x0000000002180000-0x000000000320E000-memory.dmp upx behavioral2/memory/808-56-0x0000000002180000-0x000000000320E000-memory.dmp upx behavioral2/memory/808-58-0x0000000002180000-0x000000000320E000-memory.dmp upx behavioral2/memory/808-60-0x0000000002180000-0x000000000320E000-memory.dmp upx behavioral2/memory/808-62-0x0000000002180000-0x000000000320E000-memory.dmp upx behavioral2/memory/808-64-0x0000000002180000-0x000000000320E000-memory.dmp upx behavioral2/memory/808-66-0x0000000002180000-0x000000000320E000-memory.dmp upx behavioral2/memory/808-68-0x0000000002180000-0x000000000320E000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 7fbed750de373c17bcc9ade20a93477f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 7fbed750de373c17bcc9ade20a93477f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 7fbed750de373c17bcc9ade20a93477f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 7fbed750de373c17bcc9ade20a93477f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 7fbed750de373c17bcc9ade20a93477f.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 7fbed750de373c17bcc9ade20a93477f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 7fbed750de373c17bcc9ade20a93477f.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7fbed750de373c17bcc9ade20a93477f.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: 7fbed750de373c17bcc9ade20a93477f.exe File opened (read-only) \??\H: 7fbed750de373c17bcc9ade20a93477f.exe File opened (read-only) \??\W: 7fbed750de373c17bcc9ade20a93477f.exe File opened (read-only) \??\E: 7fbed750de373c17bcc9ade20a93477f.exe File opened (read-only) \??\Q: 7fbed750de373c17bcc9ade20a93477f.exe File opened (read-only) \??\R: 7fbed750de373c17bcc9ade20a93477f.exe File opened (read-only) \??\U: 7fbed750de373c17bcc9ade20a93477f.exe File opened (read-only) \??\V: 7fbed750de373c17bcc9ade20a93477f.exe File opened (read-only) \??\X: 7fbed750de373c17bcc9ade20a93477f.exe File opened (read-only) \??\Z: 7fbed750de373c17bcc9ade20a93477f.exe File opened (read-only) \??\L: 7fbed750de373c17bcc9ade20a93477f.exe File opened (read-only) \??\J: 7fbed750de373c17bcc9ade20a93477f.exe File opened (read-only) \??\K: 7fbed750de373c17bcc9ade20a93477f.exe File opened (read-only) \??\M: 7fbed750de373c17bcc9ade20a93477f.exe File opened (read-only) \??\T: 7fbed750de373c17bcc9ade20a93477f.exe File opened (read-only) \??\I: 7fbed750de373c17bcc9ade20a93477f.exe File opened (read-only) \??\O: 7fbed750de373c17bcc9ade20a93477f.exe File opened (read-only) \??\P: 7fbed750de373c17bcc9ade20a93477f.exe File opened (read-only) \??\S: 7fbed750de373c17bcc9ade20a93477f.exe File opened (read-only) \??\Y: 7fbed750de373c17bcc9ade20a93477f.exe File opened (read-only) \??\N: 7fbed750de373c17bcc9ade20a93477f.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification F:\autorun.inf 7fbed750de373c17bcc9ade20a93477f.exe File opened for modification C:\autorun.inf 7fbed750de373c17bcc9ade20a93477f.exe -
Drops file in Program Files directory 11 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe 7fbed750de373c17bcc9ade20a93477f.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe 7fbed750de373c17bcc9ade20a93477f.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe 7fbed750de373c17bcc9ade20a93477f.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe 7fbed750de373c17bcc9ade20a93477f.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe 7fbed750de373c17bcc9ade20a93477f.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe 7fbed750de373c17bcc9ade20a93477f.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe 7fbed750de373c17bcc9ade20a93477f.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe 7fbed750de373c17bcc9ade20a93477f.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe 7fbed750de373c17bcc9ade20a93477f.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe 7fbed750de373c17bcc9ade20a93477f.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe 7fbed750de373c17bcc9ade20a93477f.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 7fbed750de373c17bcc9ade20a93477f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings 7fbed750de373c17bcc9ade20a93477f.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 808 7fbed750de373c17bcc9ade20a93477f.exe 808 7fbed750de373c17bcc9ade20a93477f.exe 808 7fbed750de373c17bcc9ade20a93477f.exe 808 7fbed750de373c17bcc9ade20a93477f.exe 808 7fbed750de373c17bcc9ade20a93477f.exe 808 7fbed750de373c17bcc9ade20a93477f.exe 808 7fbed750de373c17bcc9ade20a93477f.exe 808 7fbed750de373c17bcc9ade20a93477f.exe 808 7fbed750de373c17bcc9ade20a93477f.exe 808 7fbed750de373c17bcc9ade20a93477f.exe 808 7fbed750de373c17bcc9ade20a93477f.exe 808 7fbed750de373c17bcc9ade20a93477f.exe 808 7fbed750de373c17bcc9ade20a93477f.exe 808 7fbed750de373c17bcc9ade20a93477f.exe 808 7fbed750de373c17bcc9ade20a93477f.exe 808 7fbed750de373c17bcc9ade20a93477f.exe 808 7fbed750de373c17bcc9ade20a93477f.exe 808 7fbed750de373c17bcc9ade20a93477f.exe 808 7fbed750de373c17bcc9ade20a93477f.exe 808 7fbed750de373c17bcc9ade20a93477f.exe 808 7fbed750de373c17bcc9ade20a93477f.exe 808 7fbed750de373c17bcc9ade20a93477f.exe 808 7fbed750de373c17bcc9ade20a93477f.exe 808 7fbed750de373c17bcc9ade20a93477f.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe Token: SeDebugPrivilege 808 7fbed750de373c17bcc9ade20a93477f.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 808 wrote to memory of 780 808 7fbed750de373c17bcc9ade20a93477f.exe 8 PID 808 wrote to memory of 784 808 7fbed750de373c17bcc9ade20a93477f.exe 82 PID 808 wrote to memory of 336 808 7fbed750de373c17bcc9ade20a93477f.exe 9 PID 808 wrote to memory of 2608 808 7fbed750de373c17bcc9ade20a93477f.exe 53 PID 808 wrote to memory of 2636 808 7fbed750de373c17bcc9ade20a93477f.exe 52 PID 808 wrote to memory of 2856 808 7fbed750de373c17bcc9ade20a93477f.exe 47 PID 808 wrote to memory of 3416 808 7fbed750de373c17bcc9ade20a93477f.exe 43 PID 808 wrote to memory of 3564 808 7fbed750de373c17bcc9ade20a93477f.exe 42 PID 808 wrote to memory of 3744 808 7fbed750de373c17bcc9ade20a93477f.exe 41 PID 808 wrote to memory of 3876 808 7fbed750de373c17bcc9ade20a93477f.exe 40 PID 808 wrote to memory of 3944 808 7fbed750de373c17bcc9ade20a93477f.exe 39 PID 808 wrote to memory of 4044 808 7fbed750de373c17bcc9ade20a93477f.exe 38 PID 808 wrote to memory of 3776 808 7fbed750de373c17bcc9ade20a93477f.exe 37 PID 808 wrote to memory of 372 808 7fbed750de373c17bcc9ade20a93477f.exe 35 PID 808 wrote to memory of 2700 808 7fbed750de373c17bcc9ade20a93477f.exe 24 PID 808 wrote to memory of 780 808 7fbed750de373c17bcc9ade20a93477f.exe 8 PID 808 wrote to memory of 784 808 7fbed750de373c17bcc9ade20a93477f.exe 82 PID 808 wrote to memory of 336 808 7fbed750de373c17bcc9ade20a93477f.exe 9 PID 808 wrote to memory of 2608 808 7fbed750de373c17bcc9ade20a93477f.exe 53 PID 808 wrote to memory of 2636 808 7fbed750de373c17bcc9ade20a93477f.exe 52 PID 808 wrote to memory of 2856 808 7fbed750de373c17bcc9ade20a93477f.exe 47 PID 808 wrote to memory of 3416 808 7fbed750de373c17bcc9ade20a93477f.exe 43 PID 808 wrote to memory of 3564 808 7fbed750de373c17bcc9ade20a93477f.exe 42 PID 808 wrote to memory of 3744 808 7fbed750de373c17bcc9ade20a93477f.exe 41 PID 808 wrote to memory of 3876 808 7fbed750de373c17bcc9ade20a93477f.exe 40 PID 808 wrote to memory of 3944 808 7fbed750de373c17bcc9ade20a93477f.exe 39 PID 808 wrote to memory of 4044 808 7fbed750de373c17bcc9ade20a93477f.exe 38 PID 808 wrote to memory of 3776 808 7fbed750de373c17bcc9ade20a93477f.exe 37 PID 808 wrote to memory of 372 808 7fbed750de373c17bcc9ade20a93477f.exe 35 PID 808 wrote to memory of 2700 808 7fbed750de373c17bcc9ade20a93477f.exe 24 PID 808 wrote to memory of 780 808 7fbed750de373c17bcc9ade20a93477f.exe 8 PID 808 wrote to memory of 784 808 7fbed750de373c17bcc9ade20a93477f.exe 82 PID 808 wrote to memory of 336 808 7fbed750de373c17bcc9ade20a93477f.exe 9 PID 808 wrote to memory of 2608 808 7fbed750de373c17bcc9ade20a93477f.exe 53 PID 808 wrote to memory of 2636 808 7fbed750de373c17bcc9ade20a93477f.exe 52 PID 808 wrote to memory of 2856 808 7fbed750de373c17bcc9ade20a93477f.exe 47 PID 808 wrote to memory of 3416 808 7fbed750de373c17bcc9ade20a93477f.exe 43 PID 808 wrote to memory of 3564 808 7fbed750de373c17bcc9ade20a93477f.exe 42 PID 808 wrote to memory of 3744 808 7fbed750de373c17bcc9ade20a93477f.exe 41 PID 808 wrote to memory of 3876 808 7fbed750de373c17bcc9ade20a93477f.exe 40 PID 808 wrote to memory of 3944 808 7fbed750de373c17bcc9ade20a93477f.exe 39 PID 808 wrote to memory of 4044 808 7fbed750de373c17bcc9ade20a93477f.exe 38 PID 808 wrote to memory of 3776 808 7fbed750de373c17bcc9ade20a93477f.exe 37 PID 808 wrote to memory of 372 808 7fbed750de373c17bcc9ade20a93477f.exe 35 PID 808 wrote to memory of 2700 808 7fbed750de373c17bcc9ade20a93477f.exe 24 PID 808 wrote to memory of 780 808 7fbed750de373c17bcc9ade20a93477f.exe 8 PID 808 wrote to memory of 784 808 7fbed750de373c17bcc9ade20a93477f.exe 82 PID 808 wrote to memory of 336 808 7fbed750de373c17bcc9ade20a93477f.exe 9 PID 808 wrote to memory of 2608 808 7fbed750de373c17bcc9ade20a93477f.exe 53 PID 808 wrote to memory of 2636 808 7fbed750de373c17bcc9ade20a93477f.exe 52 PID 808 wrote to memory of 2856 808 7fbed750de373c17bcc9ade20a93477f.exe 47 PID 808 wrote to memory of 3416 808 7fbed750de373c17bcc9ade20a93477f.exe 43 PID 808 wrote to memory of 3564 808 7fbed750de373c17bcc9ade20a93477f.exe 42 PID 808 wrote to memory of 3744 808 7fbed750de373c17bcc9ade20a93477f.exe 41 PID 808 wrote to memory of 3876 808 7fbed750de373c17bcc9ade20a93477f.exe 40 PID 808 wrote to memory of 3944 808 7fbed750de373c17bcc9ade20a93477f.exe 39 PID 808 wrote to memory of 4044 808 7fbed750de373c17bcc9ade20a93477f.exe 38 PID 808 wrote to memory of 3776 808 7fbed750de373c17bcc9ade20a93477f.exe 37 PID 808 wrote to memory of 372 808 7fbed750de373c17bcc9ade20a93477f.exe 35 PID 808 wrote to memory of 2700 808 7fbed750de373c17bcc9ade20a93477f.exe 24 PID 808 wrote to memory of 780 808 7fbed750de373c17bcc9ade20a93477f.exe 8 PID 808 wrote to memory of 784 808 7fbed750de373c17bcc9ade20a93477f.exe 82 PID 808 wrote to memory of 336 808 7fbed750de373c17bcc9ade20a93477f.exe 9 PID 808 wrote to memory of 2608 808 7fbed750de373c17bcc9ade20a93477f.exe 53 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7fbed750de373c17bcc9ade20a93477f.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:336
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\7fbed750de373c17bcc9ade20a93477f.exe"C:\Users\Admin\AppData\Local\Temp\7fbed750de373c17bcc9ade20a93477f.exe"1⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:808
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:372
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3776
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4044
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3944
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3876
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3744
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3564
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3416
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2856
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2636
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2608
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD52d109eddb05e07ed2eb760d78035c8d6
SHA11d1da821f2d3f62abe9d20051c97d868c3f9e08f
SHA2564302271666b9e9f53d394d18d931ff84b5fb5ef868a939f6fbbe567f7b1e6fc3
SHA512212768c27a02566d4f6718de95161745e303bb163223a80f891b07295c7e0379015758e8aa400c3abb8b4c08816ad0785f4830693fff4547320fff05365b7c8b