Analysis
- max time kernel
122s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
27/02/2024, 01:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a7df4653ddfe0b699e02dc4f3512952a.exe
Resource
win7-20240221-en
windows7-x64
16 signatures
150 seconds
General
- Target a7df4653ddfe0b699e02dc4f3512952a.exe
- Size 100KB
- Sample240227-bwle4sdb43
- SHA256 3d239bc97ccf0be50bd55e5bdb89371c5747ca2585f2ece373a1d754a959bc6b
- MD5 a7df4653ddfe0b699e02dc4f3512952a
- SHA1 c99cbc1226bb371820427a9fb71aab537d9c6d95
- SHA512 0511983c3d39883ea93030e1855e971fe7b4549b5ded7162e23a51a29cc36497ea5f4faaf115275056671562ce660e7061715c17de3854b57e1d8476ca33326f
- SSDEEP 3072:KbwqLXeSvzWv6TZawxLS+PaiYF4nhys8:KMqj7vzWwLSsaiw2
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
-
http://www.klkjwre9fqwieluoi.info/
-
http://kukutrustnet777888.info/
Signatures
- Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" a7df4653ddfe0b699e02dc4f3512952a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" a7df4653ddfe0b699e02dc4f3512952a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" a7df4653ddfe0b699e02dc4f3512952a.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a7df4653ddfe0b699e02dc4f3512952a.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" a7df4653ddfe0b699e02dc4f3512952a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" a7df4653ddfe0b699e02dc4f3512952a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" a7df4653ddfe0b699e02dc4f3512952a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" a7df4653ddfe0b699e02dc4f3512952a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" a7df4653ddfe0b699e02dc4f3512952a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" a7df4653ddfe0b699e02dc4f3512952a.exe -
resource yara_rule behavioral2/memory/3356-1-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/3356-3-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/3356-4-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/3356-8-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/3356-9-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/3356-10-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/3356-11-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/3356-12-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/3356-13-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/3356-14-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/3356-15-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/3356-16-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/3356-17-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/3356-18-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/3356-20-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/3356-21-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/3356-22-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/3356-24-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/3356-25-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/3356-27-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/3356-29-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/3356-32-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/3356-34-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/3356-36-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/3356-38-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/3356-40-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/3356-42-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/3356-44-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/3356-51-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/3356-53-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/3356-55-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/3356-57-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/3356-59-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/3356-61-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/3356-63-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/3356-65-0x00000000021A0000-0x000000000322E000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" a7df4653ddfe0b699e02dc4f3512952a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" a7df4653ddfe0b699e02dc4f3512952a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" a7df4653ddfe0b699e02dc4f3512952a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" a7df4653ddfe0b699e02dc4f3512952a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" a7df4653ddfe0b699e02dc4f3512952a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" a7df4653ddfe0b699e02dc4f3512952a.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc a7df4653ddfe0b699e02dc4f3512952a.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a7df4653ddfe0b699e02dc4f3512952a.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: a7df4653ddfe0b699e02dc4f3512952a.exe File opened (read-only) \??\K: a7df4653ddfe0b699e02dc4f3512952a.exe File opened (read-only) \??\M: a7df4653ddfe0b699e02dc4f3512952a.exe File opened (read-only) \??\R: a7df4653ddfe0b699e02dc4f3512952a.exe File opened (read-only) \??\T: a7df4653ddfe0b699e02dc4f3512952a.exe File opened (read-only) \??\W: a7df4653ddfe0b699e02dc4f3512952a.exe File opened (read-only) \??\X: a7df4653ddfe0b699e02dc4f3512952a.exe File opened (read-only) \??\Y: a7df4653ddfe0b699e02dc4f3512952a.exe File opened (read-only) \??\G: a7df4653ddfe0b699e02dc4f3512952a.exe File opened (read-only) \??\I: a7df4653ddfe0b699e02dc4f3512952a.exe File opened (read-only) \??\P: a7df4653ddfe0b699e02dc4f3512952a.exe File opened (read-only) \??\S: a7df4653ddfe0b699e02dc4f3512952a.exe File opened (read-only) \??\U: a7df4653ddfe0b699e02dc4f3512952a.exe File opened (read-only) \??\V: a7df4653ddfe0b699e02dc4f3512952a.exe File opened (read-only) \??\Z: a7df4653ddfe0b699e02dc4f3512952a.exe File opened (read-only) \??\E: a7df4653ddfe0b699e02dc4f3512952a.exe File opened (read-only) \??\H: a7df4653ddfe0b699e02dc4f3512952a.exe File opened (read-only) \??\L: a7df4653ddfe0b699e02dc4f3512952a.exe File opened (read-only) \??\N: a7df4653ddfe0b699e02dc4f3512952a.exe File opened (read-only) \??\O: a7df4653ddfe0b699e02dc4f3512952a.exe File opened (read-only) \??\Q: a7df4653ddfe0b699e02dc4f3512952a.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf a7df4653ddfe0b699e02dc4f3512952a.exe File opened for modification F:\autorun.inf a7df4653ddfe0b699e02dc4f3512952a.exe - Drops file in Program Files directory 11 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe a7df4653ddfe0b699e02dc4f3512952a.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe a7df4653ddfe0b699e02dc4f3512952a.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe a7df4653ddfe0b699e02dc4f3512952a.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe a7df4653ddfe0b699e02dc4f3512952a.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe a7df4653ddfe0b699e02dc4f3512952a.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe a7df4653ddfe0b699e02dc4f3512952a.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe a7df4653ddfe0b699e02dc4f3512952a.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe a7df4653ddfe0b699e02dc4f3512952a.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe a7df4653ddfe0b699e02dc4f3512952a.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe a7df4653ddfe0b699e02dc4f3512952a.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe a7df4653ddfe0b699e02dc4f3512952a.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI a7df4653ddfe0b699e02dc4f3512952a.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings a7df4653ddfe0b699e02dc4f3512952a.exe - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 3356 a7df4653ddfe0b699e02dc4f3512952a.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe Token: SeDebugPrivilege 3356 a7df4653ddfe0b699e02dc4f3512952a.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3356 wrote to memory of 784 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 81 PID 3356 wrote to memory of 788 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 80 PID 3356 wrote to memory of 384 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 8 PID 3356 wrote to memory of 2428 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 19 PID 3356 wrote to memory of 2456 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 16 PID 3356 wrote to memory of 2592 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 56 PID 3356 wrote to memory of 3164 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 48 PID 3356 wrote to memory of 3488 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 46 PID 3356 wrote to memory of 3756 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 45 PID 3356 wrote to memory of 3848 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 44 PID 3356 wrote to memory of 3960 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 23 PID 3356 wrote to memory of 4036 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 43 PID 3356 wrote to memory of 3224 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 42 PID 3356 wrote to memory of 4392 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 40 PID 3356 wrote to memory of 4456 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 28 PID 3356 wrote to memory of 4024 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 25 PID 3356 wrote to memory of 1948 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 30 PID 3356 wrote to memory of 784 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 81 PID 3356 wrote to memory of 788 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 80 PID 3356 wrote to memory of 384 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 8 PID 3356 wrote to memory of 2428 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 19 PID 3356 wrote to memory of 2456 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 16 PID 3356 wrote to memory of 2592 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 56 PID 3356 wrote to memory of 3164 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 48 PID 3356 wrote to memory of 3488 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 46 PID 3356 wrote to memory of 3756 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 45 PID 3356 wrote to memory of 3848 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 44 PID 3356 wrote to memory of 3960 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 23 PID 3356 wrote to memory of 4036 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 43 PID 3356 wrote to memory of 3224 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 42 PID 3356 wrote to memory of 4392 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 40 PID 3356 wrote to memory of 4456 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 28 PID 3356 wrote to memory of 4024 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 25 PID 3356 wrote to memory of 1948 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 30 PID 3356 wrote to memory of 784 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 81 PID 3356 wrote to memory of 788 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 80 PID 3356 wrote to memory of 384 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 8 PID 3356 wrote to memory of 2428 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 19 PID 3356 wrote to memory of 2456 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 16 PID 3356 wrote to memory of 2592 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 56 PID 3356 wrote to memory of 3164 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 48 PID 3356 wrote to memory of 3488 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 46 PID 3356 wrote to memory of 3756 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 45 PID 3356 wrote to memory of 3848 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 44 PID 3356 wrote to memory of 3960 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 23 PID 3356 wrote to memory of 4036 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 43 PID 3356 wrote to memory of 3224 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 42 PID 3356 wrote to memory of 4392 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 40 PID 3356 wrote to memory of 4456 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 28 PID 3356 wrote to memory of 4024 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 25 PID 3356 wrote to memory of 1948 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 30 PID 3356 wrote to memory of 784 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 81 PID 3356 wrote to memory of 788 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 80 PID 3356 wrote to memory of 384 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 8 PID 3356 wrote to memory of 2428 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 19 PID 3356 wrote to memory of 2456 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 16 PID 3356 wrote to memory of 2592 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 56 PID 3356 wrote to memory of 3164 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 48 PID 3356 wrote to memory of 3488 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 46 PID 3356 wrote to memory of 3756 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 45 PID 3356 wrote to memory of 3848 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 44 PID 3356 wrote to memory of 3960 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 23 PID 3356 wrote to memory of 4036 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 43 PID 3356 wrote to memory of 3224 3356 a7df4653ddfe0b699e02dc4f3512952a.exe 42 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a7df4653ddfe0b699e02dc4f3512952a.exe
Processes
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:384
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2456
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2428
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3960
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca1⤵PID:4024
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4456
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:1948
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4392
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3224
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4036
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3848
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3756
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3488
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\a7df4653ddfe0b699e02dc4f3512952a.exe"C:\Users\Admin\AppData\Local\Temp\a7df4653ddfe0b699e02dc4f3512952a.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3356
-
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2592
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path F:\ltpny.exe
- Size 100KB
- SHA256 304b44b99a4865025c4e682ddc37c825695d88f8ddeaaf573f1e2607946c3bbe
- MD5 560f83a2223c2201a9cef0767cfdcb01
- SHA1 fd0954e879826a65518d2c17a4a6ee0498b680e9
- SHA512 bbc59d1915b97859d875e6a6ab99ebe0016bc7ef0ded17eca87cd34352c8c627c79ab275acf7c4b0ec6e69620a9aed80314cbaeb20877165b9651e149ccc7087
- SSDEEP 3072:mSO4kkZkzeQqEJaV7t44sNIMB8x+97Zcwv:U4kwkzeQnJaVi4sz7P
- MD5 SHA1 SHA512 SSDEEP