Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29/02/2024, 06:18
Static task
static1
Behavioral task
behavioral1
Sample
ade2a2059d92f988de05067fd44491ef.exe
Resource
win7-20240221-en
General
-
Target
ade2a2059d92f988de05067fd44491ef.exe
-
Size
248KB
-
MD5
ade2a2059d92f988de05067fd44491ef
-
SHA1
6d393613db4d16a60d9d9478cc7fb21142229284
-
SHA256
75074c9368cf924de049bcc3e4a3cce7bbc7a2b721aa66a353a68528abba9fb0
-
SHA512
5b97929997037497700b15a9a44fce02a228ec49539e7f69a222239877de6342f2ed7ad6927e82556005125982abaf4ee18b5ed9faa260c200e5ffda2838f464
-
SSDEEP
3072:bIdcFLEdskgrt05bnwhVh6PTPlcfaPHVZxSf/2eYuhhleDbjc5jAZtGMTevwpTR4:UWjZ0xCVh659JSjREDbI5jwtX3z4
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" idemoodp0cetka.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" ade2a2059d92f988de05067fd44491ef.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" ade2a2059d92f988de05067fd44491ef.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" ade2a2059d92f988de05067fd44491ef.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" idemoodp0cetka.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" idemoodp0cetka.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ade2a2059d92f988de05067fd44491ef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" idemoodp0cetka.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ade2a2059d92f988de05067fd44491ef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ade2a2059d92f988de05067fd44491ef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" ade2a2059d92f988de05067fd44491ef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" idemoodp0cetka.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" idemoodp0cetka.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" idemoodp0cetka.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" idemoodp0cetka.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ade2a2059d92f988de05067fd44491ef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ade2a2059d92f988de05067fd44491ef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ade2a2059d92f988de05067fd44491ef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" idemoodp0cetka.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" idemoodp0cetka.exe -
Executes dropped EXE 2 IoCs
pid Process 4760 idemoodp0cetka.exe 2604 idemoodp0cetka.exe -
resource yara_rule behavioral2/memory/1432-1-0x0000000002AD0000-0x0000000003B5E000-memory.dmp upx behavioral2/memory/1432-4-0x0000000002AD0000-0x0000000003B5E000-memory.dmp upx behavioral2/memory/1432-7-0x0000000002AD0000-0x0000000003B5E000-memory.dmp upx behavioral2/memory/1432-11-0x0000000002AD0000-0x0000000003B5E000-memory.dmp upx behavioral2/memory/1432-12-0x0000000002AD0000-0x0000000003B5E000-memory.dmp upx behavioral2/memory/1432-13-0x0000000002AD0000-0x0000000003B5E000-memory.dmp upx behavioral2/memory/1432-18-0x0000000002AD0000-0x0000000003B5E000-memory.dmp upx behavioral2/memory/4760-32-0x0000000002AF0000-0x0000000003B7E000-memory.dmp upx behavioral2/memory/4760-35-0x0000000002AF0000-0x0000000003B7E000-memory.dmp upx behavioral2/memory/4760-37-0x0000000002AF0000-0x0000000003B7E000-memory.dmp upx behavioral2/memory/4760-41-0x0000000002AF0000-0x0000000003B7E000-memory.dmp upx behavioral2/memory/4760-44-0x0000000002AF0000-0x0000000003B7E000-memory.dmp upx behavioral2/memory/4760-45-0x0000000002AF0000-0x0000000003B7E000-memory.dmp upx behavioral2/memory/4760-47-0x0000000002AF0000-0x0000000003B7E000-memory.dmp upx behavioral2/memory/4760-50-0x0000000002AF0000-0x0000000003B7E000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ade2a2059d92f988de05067fd44491ef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" idemoodp0cetka.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc idemoodp0cetka.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ade2a2059d92f988de05067fd44491ef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ade2a2059d92f988de05067fd44491ef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" idemoodp0cetka.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" idemoodp0cetka.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" idemoodp0cetka.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" idemoodp0cetka.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ade2a2059d92f988de05067fd44491ef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ade2a2059d92f988de05067fd44491ef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" ade2a2059d92f988de05067fd44491ef.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc ade2a2059d92f988de05067fd44491ef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" idemoodp0cetka.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MS Service Manager = "C:\\Users\\Admin\\AppData\\Local\\Temp\\idemoodp0cetka.exe" ade2a2059d92f988de05067fd44491ef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MS Service Manager = "C:\\Users\\Admin\\AppData\\Local\\Temp\\idemoodp0cetka.exe" ade2a2059d92f988de05067fd44491ef.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ade2a2059d92f988de05067fd44491ef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" idemoodp0cetka.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1432 set thread context of 1324 1432 ade2a2059d92f988de05067fd44491ef.exe 87 PID 4760 set thread context of 2604 4760 idemoodp0cetka.exe 92 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI ade2a2059d92f988de05067fd44491ef.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1432 ade2a2059d92f988de05067fd44491ef.exe 1432 ade2a2059d92f988de05067fd44491ef.exe 4760 idemoodp0cetka.exe 4760 idemoodp0cetka.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe Token: SeDebugPrivilege 1432 ade2a2059d92f988de05067fd44491ef.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1432 ade2a2059d92f988de05067fd44491ef.exe 4760 idemoodp0cetka.exe -
Suspicious use of WriteProcessMemory 58 IoCs
description pid Process procid_target PID 1432 wrote to memory of 776 1432 ade2a2059d92f988de05067fd44491ef.exe 79 PID 1432 wrote to memory of 780 1432 ade2a2059d92f988de05067fd44491ef.exe 78 PID 1432 wrote to memory of 384 1432 ade2a2059d92f988de05067fd44491ef.exe 1 PID 1432 wrote to memory of 2428 1432 ade2a2059d92f988de05067fd44491ef.exe 45 PID 1432 wrote to memory of 2448 1432 ade2a2059d92f988de05067fd44491ef.exe 44 PID 1432 wrote to memory of 2568 1432 ade2a2059d92f988de05067fd44491ef.exe 41 PID 1432 wrote to memory of 3444 1432 ade2a2059d92f988de05067fd44491ef.exe 33 PID 1432 wrote to memory of 3636 1432 ade2a2059d92f988de05067fd44491ef.exe 31 PID 1432 wrote to memory of 3884 1432 ade2a2059d92f988de05067fd44491ef.exe 30 PID 1432 wrote to memory of 3980 1432 ade2a2059d92f988de05067fd44491ef.exe 29 PID 1432 wrote to memory of 4044 1432 ade2a2059d92f988de05067fd44491ef.exe 4 PID 1432 wrote to memory of 684 1432 ade2a2059d92f988de05067fd44491ef.exe 28 PID 1432 wrote to memory of 4120 1432 ade2a2059d92f988de05067fd44491ef.exe 27 PID 1432 wrote to memory of 2184 1432 ade2a2059d92f988de05067fd44491ef.exe 15 PID 1432 wrote to memory of 2444 1432 ade2a2059d92f988de05067fd44491ef.exe 14 PID 1432 wrote to memory of 4064 1432 ade2a2059d92f988de05067fd44491ef.exe 8 PID 1432 wrote to memory of 316 1432 ade2a2059d92f988de05067fd44491ef.exe 7 PID 1432 wrote to memory of 3836 1432 ade2a2059d92f988de05067fd44491ef.exe 6 PID 1432 wrote to memory of 1324 1432 ade2a2059d92f988de05067fd44491ef.exe 87 PID 1432 wrote to memory of 1324 1432 ade2a2059d92f988de05067fd44491ef.exe 87 PID 1432 wrote to memory of 1324 1432 ade2a2059d92f988de05067fd44491ef.exe 87 PID 1432 wrote to memory of 1324 1432 ade2a2059d92f988de05067fd44491ef.exe 87 PID 1432 wrote to memory of 1324 1432 ade2a2059d92f988de05067fd44491ef.exe 87 PID 1432 wrote to memory of 1324 1432 ade2a2059d92f988de05067fd44491ef.exe 87 PID 1432 wrote to memory of 1324 1432 ade2a2059d92f988de05067fd44491ef.exe 87 PID 1432 wrote to memory of 1324 1432 ade2a2059d92f988de05067fd44491ef.exe 87 PID 1324 wrote to memory of 4760 1324 ade2a2059d92f988de05067fd44491ef.exe 91 PID 1324 wrote to memory of 4760 1324 ade2a2059d92f988de05067fd44491ef.exe 91 PID 1324 wrote to memory of 4760 1324 ade2a2059d92f988de05067fd44491ef.exe 91 PID 4760 wrote to memory of 776 4760 idemoodp0cetka.exe 79 PID 4760 wrote to memory of 780 4760 idemoodp0cetka.exe 78 PID 4760 wrote to memory of 384 4760 idemoodp0cetka.exe 1 PID 4760 wrote to memory of 2428 4760 idemoodp0cetka.exe 45 PID 4760 wrote to memory of 2448 4760 idemoodp0cetka.exe 44 PID 4760 wrote to memory of 2568 4760 idemoodp0cetka.exe 41 PID 4760 wrote to memory of 3444 4760 idemoodp0cetka.exe 33 PID 4760 wrote to memory of 3636 4760 idemoodp0cetka.exe 31 PID 4760 wrote to memory of 3884 4760 idemoodp0cetka.exe 30 PID 4760 wrote to memory of 3980 4760 idemoodp0cetka.exe 29 PID 4760 wrote to memory of 4044 4760 idemoodp0cetka.exe 4 PID 4760 wrote to memory of 684 4760 idemoodp0cetka.exe 28 PID 4760 wrote to memory of 4120 4760 idemoodp0cetka.exe 27 PID 4760 wrote to memory of 2184 4760 idemoodp0cetka.exe 15 PID 4760 wrote to memory of 2444 4760 idemoodp0cetka.exe 14 PID 4760 wrote to memory of 4064 4760 idemoodp0cetka.exe 8 PID 4760 wrote to memory of 316 4760 idemoodp0cetka.exe 7 PID 4760 wrote to memory of 3836 4760 idemoodp0cetka.exe 6 PID 4760 wrote to memory of 1324 4760 idemoodp0cetka.exe 87 PID 4760 wrote to memory of 3948 4760 idemoodp0cetka.exe 89 PID 4760 wrote to memory of 2872 4760 idemoodp0cetka.exe 90 PID 4760 wrote to memory of 2604 4760 idemoodp0cetka.exe 92 PID 4760 wrote to memory of 2604 4760 idemoodp0cetka.exe 92 PID 4760 wrote to memory of 2604 4760 idemoodp0cetka.exe 92 PID 4760 wrote to memory of 2604 4760 idemoodp0cetka.exe 92 PID 4760 wrote to memory of 2604 4760 idemoodp0cetka.exe 92 PID 4760 wrote to memory of 2604 4760 idemoodp0cetka.exe 92 PID 4760 wrote to memory of 2604 4760 idemoodp0cetka.exe 92 PID 4760 wrote to memory of 2604 4760 idemoodp0cetka.exe 92 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ade2a2059d92f988de05067fd44491ef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" idemoodp0cetka.exe
Processes
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:384
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4044
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:3836
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:316
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca1⤵PID:4064
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2444
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:2184
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4120
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:684
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3980
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3884
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3636
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\ade2a2059d92f988de05067fd44491ef.exe"C:\Users\Admin\AppData\Local\Temp\ade2a2059d92f988de05067fd44491ef.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\ade2a2059d92f988de05067fd44491ef.exe"C:\Users\Admin\AppData\Local\Temp\ade2a2059d92f988de05067fd44491ef.exe"3⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\idemoodp0cetka.exe"C:\Users\Admin\AppData\Local\Temp\idemoodp0cetka.exe"4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\idemoodp0cetka.exe"C:\Users\Admin\AppData\Local\Temp\idemoodp0cetka.exe"5⤵
- Executes dropped EXE
PID:2604
-
-
-
-
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2568
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2448
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2428
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:776
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3948
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2872
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
248KB
MD5ade2a2059d92f988de05067fd44491ef
SHA16d393613db4d16a60d9d9478cc7fb21142229284
SHA25675074c9368cf924de049bcc3e4a3cce7bbc7a2b721aa66a353a68528abba9fb0
SHA5125b97929997037497700b15a9a44fce02a228ec49539e7f69a222239877de6342f2ed7ad6927e82556005125982abaf4ee18b5ed9faa260c200e5ffda2838f464
-
Filesize
257B
MD5b32cb20bda59bb9d5d1756c596c4ac82
SHA12a633939bbac09f5114167f93b574f1de31aded5
SHA256b6a616ca3e553b0cc7bed801d9bf6fc8bc26c3fdc97fdda6781b1d13e37723eb
SHA512159d71a0249fef9b0fbc9689218fff888efa5e99900e6c8c1c49743383a3b17a4a3981a7eff7c7819e92591a7361f06f0eb5ec1965f840503de5297715621310