Analysis
-
max time kernel
123s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
19/02/2024, 21:55
Static task
static1
Behavioral task
behavioral1
Sample
0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe
Resource
win7-20231215-en
General
-
Target
0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe
-
Size
3.0MB
-
MD5
ca5633884f1c2afe5fb697a2eb8e6ceb
-
SHA1
430274f0f8397c09ffe863da74b616f0042e327d
-
SHA256
0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613
-
SHA512
b2b2cf1e38ac2ccf09ba9b57505e0f65c9db1aeb54001c2621b1a231b40ff4df24939f17350908963151fedd835f061075c7f2d6f293ce2fb707ac73ca502b33
-
SSDEEP
98304:81KtVejknMTKCr3Zk2jlEHCluHHYmCR4ZKE:yVzZqCluHHYR2n
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe -
resource yara_rule behavioral1/memory/1248-2-0x0000000002270000-0x000000000332A000-memory.dmp upx behavioral1/memory/1248-4-0x0000000002270000-0x000000000332A000-memory.dmp upx behavioral1/memory/1248-5-0x0000000002270000-0x000000000332A000-memory.dmp upx behavioral1/memory/1248-9-0x0000000002270000-0x000000000332A000-memory.dmp upx behavioral1/memory/1248-12-0x0000000002270000-0x000000000332A000-memory.dmp upx behavioral1/memory/1248-20-0x0000000002270000-0x000000000332A000-memory.dmp upx behavioral1/memory/1248-23-0x0000000002270000-0x000000000332A000-memory.dmp upx behavioral1/memory/1248-26-0x0000000002270000-0x000000000332A000-memory.dmp upx behavioral1/memory/1248-32-0x0000000002270000-0x000000000332A000-memory.dmp upx behavioral1/memory/1248-34-0x0000000002270000-0x000000000332A000-memory.dmp upx behavioral1/memory/1248-35-0x0000000002270000-0x000000000332A000-memory.dmp upx behavioral1/memory/1248-36-0x0000000002270000-0x000000000332A000-memory.dmp upx behavioral1/memory/1248-37-0x0000000002270000-0x000000000332A000-memory.dmp upx behavioral1/memory/1248-39-0x0000000002270000-0x000000000332A000-memory.dmp upx behavioral1/memory/1248-40-0x0000000002270000-0x000000000332A000-memory.dmp upx behavioral1/memory/1248-41-0x0000000002270000-0x000000000332A000-memory.dmp upx behavioral1/memory/1248-43-0x0000000002270000-0x000000000332A000-memory.dmp upx behavioral1/memory/1248-45-0x0000000002270000-0x000000000332A000-memory.dmp upx behavioral1/memory/1248-52-0x0000000002270000-0x000000000332A000-memory.dmp upx behavioral1/memory/1248-54-0x0000000002270000-0x000000000332A000-memory.dmp upx behavioral1/memory/1248-56-0x0000000002270000-0x000000000332A000-memory.dmp upx behavioral1/memory/1248-60-0x0000000002270000-0x000000000332A000-memory.dmp upx behavioral1/memory/1248-64-0x0000000002270000-0x000000000332A000-memory.dmp upx behavioral1/memory/1248-66-0x0000000002270000-0x000000000332A000-memory.dmp upx behavioral1/memory/1248-68-0x0000000002270000-0x000000000332A000-memory.dmp upx behavioral1/memory/1248-70-0x0000000002270000-0x000000000332A000-memory.dmp upx behavioral1/memory/1248-72-0x0000000002270000-0x000000000332A000-memory.dmp upx behavioral1/memory/1248-74-0x0000000002270000-0x000000000332A000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe File opened (read-only) \??\T: 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe File opened (read-only) \??\W: 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe File opened (read-only) \??\L: 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe File opened (read-only) \??\J: 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe File opened (read-only) \??\K: 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe File opened (read-only) \??\O: 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe File opened (read-only) \??\P: 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe File opened (read-only) \??\R: 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe File opened (read-only) \??\H: 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe File opened (read-only) \??\U: 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe File opened (read-only) \??\Y: 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe File opened (read-only) \??\Z: 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe File opened (read-only) \??\N: 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe File opened (read-only) \??\G: 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe File opened (read-only) \??\I: 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe File opened (read-only) \??\M: 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe File opened (read-only) \??\Q: 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe File opened (read-only) \??\V: 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe File opened (read-only) \??\X: 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe File opened (read-only) \??\E: 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe File opened for modification F:\autorun.inf 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe File opened for modification C:\Program Files\7-Zip\7z.exe 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\f761d31 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe File opened for modification C:\Windows\SYSTEM.INI 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe -
Suspicious use of AdjustPrivilegeToken 31 IoCs
description pid Process Token: SeDebugPrivilege 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe Token: SeDebugPrivilege 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe Token: SeDebugPrivilege 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe Token: SeDebugPrivilege 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe Token: SeDebugPrivilege 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe Token: SeDebugPrivilege 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe Token: SeDebugPrivilege 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe Token: SeDebugPrivilege 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe Token: SeDebugPrivilege 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe Token: SeDebugPrivilege 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe Token: SeDebugPrivilege 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe Token: SeDebugPrivilege 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe Token: SeDebugPrivilege 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe Token: SeDebugPrivilege 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe Token: SeDebugPrivilege 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe Token: SeDebugPrivilege 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe Token: SeDebugPrivilege 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe Token: SeDebugPrivilege 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe Token: SeDebugPrivilege 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe Token: SeDebugPrivilege 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe Token: SeDebugPrivilege 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe Token: SeDebugPrivilege 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe Token: SeDebugPrivilege 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe Token: SeDebugPrivilege 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe Token: SeDebugPrivilege 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe Token: SeDebugPrivilege 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe Token: SeDebugPrivilege 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe Token: SeDebugPrivilege 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe Token: SeDebugPrivilege 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe Token: SeDebugPrivilege 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe Token: SeDebugPrivilege 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe -
Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 1248 wrote to memory of 1072 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 9 PID 1248 wrote to memory of 1116 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 8 PID 1248 wrote to memory of 1140 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 7 PID 1248 wrote to memory of 1588 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 4 PID 1248 wrote to memory of 1072 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 9 PID 1248 wrote to memory of 1116 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 8 PID 1248 wrote to memory of 1140 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 7 PID 1248 wrote to memory of 1072 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 9 PID 1248 wrote to memory of 1116 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 8 PID 1248 wrote to memory of 1140 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 7 PID 1248 wrote to memory of 1072 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 9 PID 1248 wrote to memory of 1116 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 8 PID 1248 wrote to memory of 1140 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 7 PID 1248 wrote to memory of 1072 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 9 PID 1248 wrote to memory of 1116 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 8 PID 1248 wrote to memory of 1140 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 7 PID 1248 wrote to memory of 1072 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 9 PID 1248 wrote to memory of 1116 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 8 PID 1248 wrote to memory of 1140 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 7 PID 1248 wrote to memory of 1072 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 9 PID 1248 wrote to memory of 1116 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 8 PID 1248 wrote to memory of 1140 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 7 PID 1248 wrote to memory of 1072 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 9 PID 1248 wrote to memory of 1116 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 8 PID 1248 wrote to memory of 1140 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 7 PID 1248 wrote to memory of 1072 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 9 PID 1248 wrote to memory of 1116 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 8 PID 1248 wrote to memory of 1140 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 7 PID 1248 wrote to memory of 1072 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 9 PID 1248 wrote to memory of 1116 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 8 PID 1248 wrote to memory of 1140 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 7 PID 1248 wrote to memory of 1072 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 9 PID 1248 wrote to memory of 1116 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 8 PID 1248 wrote to memory of 1140 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 7 PID 1248 wrote to memory of 1072 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 9 PID 1248 wrote to memory of 1116 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 8 PID 1248 wrote to memory of 1140 1248 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe 7 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe
Processes
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1588
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe"C:\Users\Admin\AppData\Local\Temp\0687cd0cce318a55aa8486c3aef8ae063ad74d9414f1ece6a1c411da79ad7613.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1248
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1116
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1072
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD55e410052afcb975bed2f9aed1f15774c
SHA1392eb0d605c0e9fdb1d3927ec29e43c76f949d01
SHA256888ac1e94d7affd99b50810cb2bb1f8df19a886398b54727abb8aacd595097d6
SHA5123c4a19689eded8e65bbda8da17b49a95194c97698faebc83594ce85345bff6da8c6b365d601e096071606a2479f4d44f3f1047282ed934efcd2b338ffce32ba7