Analysis
- max time kernel
142s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
21/02/2024, 07:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe
Resource
win7-20231129-en
windows7-x64
15 signatures
150 seconds
General
- Target efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe
- Size 4.9MB
- Sample240221-jebtcadd63
- SHA256 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714
- MD5 8ca033b4f6ad41791a7aacb45396f048
- SHA1 0d8a8fa29274074f9d69e76fe5cc736ec7b0cdba
- SHA512 c852b741754ae029bd780adeb71b94b6c692aefb49baaee358600cb02e8941ea6c55290e530e855a691a2dba3164f5b2235038d661d5fd982262aaaa9c72b113
- SSDEEP 24576:uVyYn7ZLqvCS8hANkawqRYDIB2UdGS76i32jFii:aYBpYeGSX325B
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe -
resource yara_rule behavioral2/memory/1044-1-0x0000000002480000-0x000000000353A000-memory.dmp upx behavioral2/memory/1044-3-0x0000000002480000-0x000000000353A000-memory.dmp upx behavioral2/memory/1044-4-0x0000000002480000-0x000000000353A000-memory.dmp upx behavioral2/memory/1044-9-0x0000000002480000-0x000000000353A000-memory.dmp upx behavioral2/memory/1044-10-0x0000000002480000-0x000000000353A000-memory.dmp upx behavioral2/memory/1044-11-0x0000000002480000-0x000000000353A000-memory.dmp upx behavioral2/memory/1044-12-0x0000000002480000-0x000000000353A000-memory.dmp upx behavioral2/memory/1044-13-0x0000000002480000-0x000000000353A000-memory.dmp upx behavioral2/memory/1044-14-0x0000000002480000-0x000000000353A000-memory.dmp upx behavioral2/memory/1044-15-0x0000000002480000-0x000000000353A000-memory.dmp upx behavioral2/memory/1044-21-0x0000000002480000-0x000000000353A000-memory.dmp upx behavioral2/memory/1044-22-0x0000000002480000-0x000000000353A000-memory.dmp upx behavioral2/memory/1044-23-0x0000000002480000-0x000000000353A000-memory.dmp upx behavioral2/memory/1044-24-0x0000000002480000-0x000000000353A000-memory.dmp upx behavioral2/memory/1044-25-0x0000000002480000-0x000000000353A000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe - Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\e5768bc efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe File opened for modification C:\Windows\SYSTEM.INI efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\BrowserMachineCode efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\BrowserMachineCode\MachineGuid = "3C5C56D7FCB1C959DF0C05319CF2BF96" efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe Token: SeDebugPrivilege 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1044 wrote to memory of 2812 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe 69 PID 1044 wrote to memory of 2820 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe 68 PID 1044 wrote to memory of 3044 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe 66 PID 1044 wrote to memory of 3420 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe 63 PID 1044 wrote to memory of 3544 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe 62 PID 1044 wrote to memory of 3736 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe 40 PID 1044 wrote to memory of 3868 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe 39 PID 1044 wrote to memory of 3932 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe 38 PID 1044 wrote to memory of 4020 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe 61 PID 1044 wrote to memory of 4176 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe 60 PID 1044 wrote to memory of 4340 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe 58 PID 1044 wrote to memory of 2180 1044 efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe 49 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe
Processes
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3932
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3868
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3736
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:2180
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4340
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4176
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4020
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3544
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe"C:\Users\Admin\AppData\Local\Temp\efe5bcf6972da315764576095dded48dec0ed56c9474983e402a144eecdcf714.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1044
-
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:3044
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2820
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2812
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1