Analysis
-
max time kernel
122s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28/02/2024, 18:25
Static task
static1
Behavioral task
behavioral1
Sample
ac8d2f29a8aeda66b3e78c9f385bf324.exe
Resource
win7-20240221-en
General
-
Target
ac8d2f29a8aeda66b3e78c9f385bf324.exe
-
Size
100KB
-
MD5
ac8d2f29a8aeda66b3e78c9f385bf324
-
SHA1
96d5a109525d999f97c0c39e3b4f9ea1187a9c0c
-
SHA256
09b1efc7d167638f8ebd2fa0cb61dfb51564d75b7cdaa8b39e545906dae2eedb
-
SHA512
e2601862854a44d2c7e69fed203dd73c5be88cfa50e8c7c3e6c0bb099fd634e12d1c10e5c48de5c88ab24929f9180495cbdfb4d03bdd259d2ceff82ea899c8a6
-
SSDEEP
1536:QWswr6szE6YaDE1YC9zRNW/sThk0fODNa2IjO4La:QPwmCE6YV1YC9zOsODN94L
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" ac8d2f29a8aeda66b3e78c9f385bf324.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" ac8d2f29a8aeda66b3e78c9f385bf324.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" ac8d2f29a8aeda66b3e78c9f385bf324.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ac8d2f29a8aeda66b3e78c9f385bf324.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ac8d2f29a8aeda66b3e78c9f385bf324.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ac8d2f29a8aeda66b3e78c9f385bf324.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ac8d2f29a8aeda66b3e78c9f385bf324.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ac8d2f29a8aeda66b3e78c9f385bf324.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ac8d2f29a8aeda66b3e78c9f385bf324.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" ac8d2f29a8aeda66b3e78c9f385bf324.exe -
resource yara_rule behavioral2/memory/2052-2-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/2052-4-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/2052-5-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/2052-10-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/2052-11-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/2052-12-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/2052-13-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/2052-14-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/2052-15-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/2052-16-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/2052-17-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/2052-18-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/2052-19-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/2052-20-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/2052-22-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/2052-23-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/2052-24-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/2052-26-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/2052-27-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/2052-29-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/2052-31-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/2052-34-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/2052-36-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/2052-38-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/2052-40-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/2052-42-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/2052-49-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/2052-51-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/2052-53-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/2052-55-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/2052-57-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/2052-58-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/2052-60-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/2052-62-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/2052-65-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/2052-67-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/2052-69-0x0000000002330000-0x00000000033BE000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" ac8d2f29a8aeda66b3e78c9f385bf324.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc ac8d2f29a8aeda66b3e78c9f385bf324.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ac8d2f29a8aeda66b3e78c9f385bf324.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ac8d2f29a8aeda66b3e78c9f385bf324.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ac8d2f29a8aeda66b3e78c9f385bf324.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ac8d2f29a8aeda66b3e78c9f385bf324.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ac8d2f29a8aeda66b3e78c9f385bf324.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ac8d2f29a8aeda66b3e78c9f385bf324.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: ac8d2f29a8aeda66b3e78c9f385bf324.exe File opened (read-only) \??\P: ac8d2f29a8aeda66b3e78c9f385bf324.exe File opened (read-only) \??\T: ac8d2f29a8aeda66b3e78c9f385bf324.exe File opened (read-only) \??\E: ac8d2f29a8aeda66b3e78c9f385bf324.exe File opened (read-only) \??\H: ac8d2f29a8aeda66b3e78c9f385bf324.exe File opened (read-only) \??\O: ac8d2f29a8aeda66b3e78c9f385bf324.exe File opened (read-only) \??\R: ac8d2f29a8aeda66b3e78c9f385bf324.exe File opened (read-only) \??\S: ac8d2f29a8aeda66b3e78c9f385bf324.exe File opened (read-only) \??\G: ac8d2f29a8aeda66b3e78c9f385bf324.exe File opened (read-only) \??\N: ac8d2f29a8aeda66b3e78c9f385bf324.exe File opened (read-only) \??\Q: ac8d2f29a8aeda66b3e78c9f385bf324.exe File opened (read-only) \??\V: ac8d2f29a8aeda66b3e78c9f385bf324.exe File opened (read-only) \??\X: ac8d2f29a8aeda66b3e78c9f385bf324.exe File opened (read-only) \??\Y: ac8d2f29a8aeda66b3e78c9f385bf324.exe File opened (read-only) \??\J: ac8d2f29a8aeda66b3e78c9f385bf324.exe File opened (read-only) \??\M: ac8d2f29a8aeda66b3e78c9f385bf324.exe File opened (read-only) \??\U: ac8d2f29a8aeda66b3e78c9f385bf324.exe File opened (read-only) \??\W: ac8d2f29a8aeda66b3e78c9f385bf324.exe File opened (read-only) \??\Z: ac8d2f29a8aeda66b3e78c9f385bf324.exe File opened (read-only) \??\K: ac8d2f29a8aeda66b3e78c9f385bf324.exe File opened (read-only) \??\L: ac8d2f29a8aeda66b3e78c9f385bf324.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf ac8d2f29a8aeda66b3e78c9f385bf324.exe File opened for modification F:\autorun.inf ac8d2f29a8aeda66b3e78c9f385bf324.exe -
Drops file in Program Files directory 11 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe ac8d2f29a8aeda66b3e78c9f385bf324.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe ac8d2f29a8aeda66b3e78c9f385bf324.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe ac8d2f29a8aeda66b3e78c9f385bf324.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe ac8d2f29a8aeda66b3e78c9f385bf324.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe ac8d2f29a8aeda66b3e78c9f385bf324.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe ac8d2f29a8aeda66b3e78c9f385bf324.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe ac8d2f29a8aeda66b3e78c9f385bf324.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe ac8d2f29a8aeda66b3e78c9f385bf324.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe ac8d2f29a8aeda66b3e78c9f385bf324.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe ac8d2f29a8aeda66b3e78c9f385bf324.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe ac8d2f29a8aeda66b3e78c9f385bf324.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI ac8d2f29a8aeda66b3e78c9f385bf324.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings ac8d2f29a8aeda66b3e78c9f385bf324.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe Token: SeDebugPrivilege 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2052 wrote to memory of 776 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 3 PID 2052 wrote to memory of 784 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 10 PID 2052 wrote to memory of 1012 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 6 PID 2052 wrote to memory of 2628 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 64 PID 2052 wrote to memory of 2676 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 63 PID 2052 wrote to memory of 2816 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 61 PID 2052 wrote to memory of 3504 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 53 PID 2052 wrote to memory of 3660 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 52 PID 2052 wrote to memory of 3856 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 51 PID 2052 wrote to memory of 3948 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 50 PID 2052 wrote to memory of 4012 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 24 PID 2052 wrote to memory of 4092 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 49 PID 2052 wrote to memory of 3432 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 47 PID 2052 wrote to memory of 1644 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 45 PID 2052 wrote to memory of 4428 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 34 PID 2052 wrote to memory of 4384 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 28 PID 2052 wrote to memory of 2176 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 27 PID 2052 wrote to memory of 388 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 26 PID 2052 wrote to memory of 776 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 3 PID 2052 wrote to memory of 784 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 10 PID 2052 wrote to memory of 1012 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 6 PID 2052 wrote to memory of 2628 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 64 PID 2052 wrote to memory of 2676 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 63 PID 2052 wrote to memory of 2816 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 61 PID 2052 wrote to memory of 3504 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 53 PID 2052 wrote to memory of 3660 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 52 PID 2052 wrote to memory of 3856 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 51 PID 2052 wrote to memory of 3948 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 50 PID 2052 wrote to memory of 4012 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 24 PID 2052 wrote to memory of 4092 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 49 PID 2052 wrote to memory of 3432 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 47 PID 2052 wrote to memory of 1644 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 45 PID 2052 wrote to memory of 4428 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 34 PID 2052 wrote to memory of 4384 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 28 PID 2052 wrote to memory of 2176 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 27 PID 2052 wrote to memory of 388 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 26 PID 2052 wrote to memory of 4952 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 88 PID 2052 wrote to memory of 5080 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 89 PID 2052 wrote to memory of 776 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 3 PID 2052 wrote to memory of 784 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 10 PID 2052 wrote to memory of 1012 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 6 PID 2052 wrote to memory of 2628 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 64 PID 2052 wrote to memory of 2676 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 63 PID 2052 wrote to memory of 2816 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 61 PID 2052 wrote to memory of 3504 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 53 PID 2052 wrote to memory of 3660 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 52 PID 2052 wrote to memory of 3856 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 51 PID 2052 wrote to memory of 3948 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 50 PID 2052 wrote to memory of 4012 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 24 PID 2052 wrote to memory of 4092 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 49 PID 2052 wrote to memory of 3432 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 47 PID 2052 wrote to memory of 1644 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 45 PID 2052 wrote to memory of 4428 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 34 PID 2052 wrote to memory of 4384 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 28 PID 2052 wrote to memory of 2176 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 27 PID 2052 wrote to memory of 4952 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 88 PID 2052 wrote to memory of 5080 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 89 PID 2052 wrote to memory of 776 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 3 PID 2052 wrote to memory of 784 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 10 PID 2052 wrote to memory of 1012 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 6 PID 2052 wrote to memory of 2628 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 64 PID 2052 wrote to memory of 2676 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 63 PID 2052 wrote to memory of 2816 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 61 PID 2052 wrote to memory of 3504 2052 ac8d2f29a8aeda66b3e78c9f385bf324.exe 53 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ac8d2f29a8aeda66b3e78c9f385bf324.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:776
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1012
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4012
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:388
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:2176
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca1⤵PID:4384
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4428
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1644
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\ac8d2f29a8aeda66b3e78c9f385bf324.exe"C:\Users\Admin\AppData\Local\Temp\ac8d2f29a8aeda66b3e78c9f385bf324.exe"1⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2052
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4092
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3948
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3856
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3660
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3504
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2816
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2676
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2628
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4952
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:5080
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD5ba21058cedf7e509ec0b191a16a44f52
SHA1183dc54229f95409d3d6ff46d4958ffafeb04554
SHA256d2d50b8e377a44f6a80388951438f176543390999278ae5b94ea1d6bf46ce562
SHA512618fb5bac48dfe23df54a10104b20fb3e774e5fa5eccc0b7970e5cae6e2b95759f73411fc8c7d6fe29db94e5ffe45ed8726ccdc86ecbac470fed2e1ed2737476