Analysis
- max time kernel
147s - max time network
163s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
29/02/2024, 16:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1c739a5deff56d0918ca4e0dd06ba93b.dll
Resource
win7-20240221-en
windows7-x64
17 signatures
150 seconds
General
- Target 1c739a5deff56d0918ca4e0dd06ba93b.dll
- Size 120KB
- Sample240229-tf7braec49
- SHA256 3113780511d6269f5431a8346ae5b010fb48da9e445b16306353dd7991fc49ad
- MD5 1c739a5deff56d0918ca4e0dd06ba93b
- SHA1 77d50603eaad6b1c0ce310980b8dc69178140550
- SHA512 a2e42a3b8241824390d252046aac42fb326322fd01b24d3795c56e693accb9041bddf37ab39b7b01bd836482f5904d1cb481993b645ccc5411046a03ccc48a6e
- SSDEEP 3072:3RtgD9PLKa1cwoaI/Z/skoeRHqZofjbqEr8b6:3oDJLL1zLQCeRKejwb
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e5789c1.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e5789c1.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e5789c1.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5789c1.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5789c1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5789c1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5789c1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5789c1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5789c1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5789c1.exe - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 21 IoCs
resource yara_rule behavioral2/memory/3812-7-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3812-9-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3812-10-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3812-17-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3812-25-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3812-31-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3812-40-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3812-42-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3812-43-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3812-44-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3812-45-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3812-46-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3812-47-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3812-48-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3812-58-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3812-59-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3812-60-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3812-62-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3812-63-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3812-66-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3812-69-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 26 IoCs
resource yara_rule behavioral2/memory/3812-7-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3812-9-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3812-10-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/4644-24-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/3812-17-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3812-25-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3812-31-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3116-39-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/3812-40-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3812-42-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3812-43-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3812-44-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3812-45-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3812-46-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3812-47-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3812-48-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3812-58-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3812-59-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3812-60-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3812-62-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3812-63-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3812-66-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/4644-89-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/3812-69-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/3116-93-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/3812-94-0x0000000000400000-0x0000000000412000-memory.dmp UPX - Executes dropped EXE 3 IoCs
pid Process 3812 e5789c1.exe 4644 e578e55.exe 3116 e57901a.exe -
resource yara_rule behavioral2/memory/3812-7-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3812-9-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3812-10-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3812-17-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3812-25-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3812-31-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3812-40-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3812-42-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3812-43-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3812-44-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3812-45-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3812-46-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3812-47-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3812-48-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3812-58-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3812-59-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3812-60-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3812-62-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3812-63-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3812-66-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3812-69-0x00000000007A0000-0x000000000185A000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5789c1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5789c1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5789c1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5789c1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5789c1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5789c1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e5789c1.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5789c1.exe - Enumerates connected drives 3 TTPs 5 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: e5789c1.exe File opened (read-only) \??\G: e5789c1.exe File opened (read-only) \??\H: e5789c1.exe File opened (read-only) \??\I: e5789c1.exe File opened (read-only) \??\J: e5789c1.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\e578bd5 e5789c1.exe File opened for modification C:\Windows\SYSTEM.INI e5789c1.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3812 e5789c1.exe 3812 e5789c1.exe 3812 e5789c1.exe 3812 e5789c1.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe Token: SeDebugPrivilege 3812 e5789c1.exe - Suspicious use of WriteProcessMemory 57 IoCs
description pid Process procid_target PID 1400 wrote to memory of 2952 1400 rundll32.exe 37 PID 1400 wrote to memory of 2952 1400 rundll32.exe 37 PID 1400 wrote to memory of 2952 1400 rundll32.exe 37 PID 2952 wrote to memory of 3812 2952 rundll32.exe 86 PID 2952 wrote to memory of 3812 2952 rundll32.exe 86 PID 2952 wrote to memory of 3812 2952 rundll32.exe 86 PID 3812 wrote to memory of 816 3812 e5789c1.exe 76 PID 3812 wrote to memory of 824 3812 e5789c1.exe 75 PID 3812 wrote to memory of 320 3812 e5789c1.exe 72 PID 3812 wrote to memory of 2644 3812 e5789c1.exe 41 PID 3812 wrote to memory of 2652 3812 e5789c1.exe 40 PID 3812 wrote to memory of 2812 3812 e5789c1.exe 35 PID 3812 wrote to memory of 3496 3812 e5789c1.exe 29 PID 3812 wrote to memory of 3664 3812 e5789c1.exe 28 PID 3812 wrote to memory of 3864 3812 e5789c1.exe 27 PID 3812 wrote to memory of 3956 3812 e5789c1.exe 26 PID 3812 wrote to memory of 4056 3812 e5789c1.exe 4 PID 3812 wrote to memory of 1448 3812 e5789c1.exe 25 PID 3812 wrote to memory of 4164 3812 e5789c1.exe 24 PID 3812 wrote to memory of 3300 3812 e5789c1.exe 12 PID 3812 wrote to memory of 4848 3812 e5789c1.exe 11 PID 3812 wrote to memory of 2488 3812 e5789c1.exe 6 PID 3812 wrote to memory of 2740 3812 e5789c1.exe 5 PID 3812 wrote to memory of 1400 3812 e5789c1.exe 17 PID 3812 wrote to memory of 2952 3812 e5789c1.exe 37 PID 3812 wrote to memory of 2952 3812 e5789c1.exe 37 PID 3812 wrote to memory of 3280 3812 e5789c1.exe 85 PID 2952 wrote to memory of 4644 2952 rundll32.exe 88 PID 2952 wrote to memory of 4644 2952 rundll32.exe 88 PID 2952 wrote to memory of 4644 2952 rundll32.exe 88 PID 3812 wrote to memory of 4808 3812 e5789c1.exe 87 PID 2952 wrote to memory of 3116 2952 rundll32.exe 89 PID 2952 wrote to memory of 3116 2952 rundll32.exe 89 PID 2952 wrote to memory of 3116 2952 rundll32.exe 89 PID 3812 wrote to memory of 816 3812 e5789c1.exe 76 PID 3812 wrote to memory of 824 3812 e5789c1.exe 75 PID 3812 wrote to memory of 320 3812 e5789c1.exe 72 PID 3812 wrote to memory of 2644 3812 e5789c1.exe 41 PID 3812 wrote to memory of 2652 3812 e5789c1.exe 40 PID 3812 wrote to memory of 2812 3812 e5789c1.exe 35 PID 3812 wrote to memory of 3496 3812 e5789c1.exe 29 PID 3812 wrote to memory of 3664 3812 e5789c1.exe 28 PID 3812 wrote to memory of 3864 3812 e5789c1.exe 27 PID 3812 wrote to memory of 3956 3812 e5789c1.exe 26 PID 3812 wrote to memory of 4056 3812 e5789c1.exe 4 PID 3812 wrote to memory of 1448 3812 e5789c1.exe 25 PID 3812 wrote to memory of 4164 3812 e5789c1.exe 24 PID 3812 wrote to memory of 3300 3812 e5789c1.exe 12 PID 3812 wrote to memory of 4848 3812 e5789c1.exe 11 PID 3812 wrote to memory of 2488 3812 e5789c1.exe 6 PID 3812 wrote to memory of 2740 3812 e5789c1.exe 5 PID 3812 wrote to memory of 3280 3812 e5789c1.exe 85 PID 3812 wrote to memory of 4808 3812 e5789c1.exe 87 PID 3812 wrote to memory of 4644 3812 e5789c1.exe 88 PID 3812 wrote to memory of 4644 3812 e5789c1.exe 88 PID 3812 wrote to memory of 3116 3812 e5789c1.exe 89 PID 3812 wrote to memory of 3116 3812 e5789c1.exe 89 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5789c1.exe
Processes
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4056
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:2740
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:2488
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4848
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:3300
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1c739a5deff56d0918ca4e0dd06ba93b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1c739a5deff56d0918ca4e0dd06ba93b.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\e5789c1.exeC:\Users\Admin\AppData\Local\Temp\e5789c1.exe3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3812
-
-
C:\Users\Admin\AppData\Local\Temp\e578e55.exeC:\Users\Admin\AppData\Local\Temp\e578e55.exe3⤵
- Executes dropped EXE
PID:4644
-
-
C:\Users\Admin\AppData\Local\Temp\e57901a.exeC:\Users\Admin\AppData\Local\Temp\e57901a.exe3⤵
- Executes dropped EXE
PID:3116
-
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4164
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1448
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3956
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3864
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3664
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3496
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2812
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2652
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2644
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:320
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:824
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:816
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3280
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4808
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\e5789c1.exe
- Size 97KB
- SHA256 484db0b154a5256433630e3553c66fefdb2df6758a4bbc3b61aa9d16cd2fa330
- MD5 e09ca8bfa111f6d624c420a203ed8047
- SHA1 61b3280a35e7de09f8a66fac50c3d8d08217bd37
- SHA512 c50a84e78c8d6bb9f4e114458349951b69daf2b566a492270a710502c6b675f7f2ab5d448349876037cba7bd1a786ced5671bae10ff168c2542b6dbbe2281b83
- SSDEEP 1536:F5cRgXBA5QSGVfqHpXyPdhUUOYTxT8WafDQ:gR2BAyEVyVhUGCD
- MD5 SHA1 SHA512 SSDEEP