Analysis
- max time kernel
159s - max time network
170s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
29/02/2024, 16:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
aee86a6fb2b296639cc1e2d550292919.exe
Resource
win7-20240221-en
windows7-x64
16 signatures
150 seconds
General
- Target aee86a6fb2b296639cc1e2d550292919.exe
- Size 97KB
- Sample240229-tfrw3aec37
- SHA256 fa22b7b157fc0497ac80c629293c3080ee073350a0c17a2677107089b0d5f8f9
- MD5 aee86a6fb2b296639cc1e2d550292919
- SHA1 cd712025fc8b5f48d73aabbbdcc5ec65e85d23c0
- SHA512 2d4ac564562b301cf31a7c0a66fe3fb212fe382ad40d40b5f314cd64bdcce3f6f7ab4acf999074648072bba55a40e53cb4023a10dedd8be956b20ed8287b2bd2
- SSDEEP 1536:vsQWr0dn+n/oRodpABHwDXeDaoQJo1GmQL0TtxtJcSlLUr:EQWrSeoRodtDuDF1GmjPc2c
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" aee86a6fb2b296639cc1e2d550292919.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" aee86a6fb2b296639cc1e2d550292919.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" aee86a6fb2b296639cc1e2d550292919.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" aee86a6fb2b296639cc1e2d550292919.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" aee86a6fb2b296639cc1e2d550292919.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" aee86a6fb2b296639cc1e2d550292919.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" aee86a6fb2b296639cc1e2d550292919.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" aee86a6fb2b296639cc1e2d550292919.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" aee86a6fb2b296639cc1e2d550292919.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" aee86a6fb2b296639cc1e2d550292919.exe -
resource yara_rule behavioral2/memory/2880-2-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/2880-4-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/2880-5-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/2880-6-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/2880-8-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/2880-17-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/2880-18-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/2880-19-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/2880-20-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/2880-21-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/2880-22-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/2880-23-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/2880-24-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/2880-25-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/2880-26-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/2880-28-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/2880-29-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/2880-31-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/2880-34-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/2880-35-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/2880-37-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/2880-44-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/2880-47-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/2880-49-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/2880-51-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/2880-53-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/2880-55-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/2880-57-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/2880-59-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/2880-61-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/2880-63-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/2880-64-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/2880-65-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/2880-66-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/2880-68-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/2880-69-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/2880-72-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/2880-74-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/2880-75-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/2880-88-0x00000000007F0000-0x00000000018AA000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" aee86a6fb2b296639cc1e2d550292919.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" aee86a6fb2b296639cc1e2d550292919.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" aee86a6fb2b296639cc1e2d550292919.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" aee86a6fb2b296639cc1e2d550292919.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" aee86a6fb2b296639cc1e2d550292919.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc aee86a6fb2b296639cc1e2d550292919.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" aee86a6fb2b296639cc1e2d550292919.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" aee86a6fb2b296639cc1e2d550292919.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: aee86a6fb2b296639cc1e2d550292919.exe File opened (read-only) \??\E: aee86a6fb2b296639cc1e2d550292919.exe File opened (read-only) \??\K: aee86a6fb2b296639cc1e2d550292919.exe File opened (read-only) \??\N: aee86a6fb2b296639cc1e2d550292919.exe File opened (read-only) \??\O: aee86a6fb2b296639cc1e2d550292919.exe File opened (read-only) \??\Z: aee86a6fb2b296639cc1e2d550292919.exe File opened (read-only) \??\G: aee86a6fb2b296639cc1e2d550292919.exe File opened (read-only) \??\I: aee86a6fb2b296639cc1e2d550292919.exe File opened (read-only) \??\Q: aee86a6fb2b296639cc1e2d550292919.exe File opened (read-only) \??\V: aee86a6fb2b296639cc1e2d550292919.exe File opened (read-only) \??\J: aee86a6fb2b296639cc1e2d550292919.exe File opened (read-only) \??\R: aee86a6fb2b296639cc1e2d550292919.exe File opened (read-only) \??\S: aee86a6fb2b296639cc1e2d550292919.exe File opened (read-only) \??\W: aee86a6fb2b296639cc1e2d550292919.exe File opened (read-only) \??\U: aee86a6fb2b296639cc1e2d550292919.exe File opened (read-only) \??\X: aee86a6fb2b296639cc1e2d550292919.exe File opened (read-only) \??\Y: aee86a6fb2b296639cc1e2d550292919.exe File opened (read-only) \??\H: aee86a6fb2b296639cc1e2d550292919.exe File opened (read-only) \??\L: aee86a6fb2b296639cc1e2d550292919.exe File opened (read-only) \??\M: aee86a6fb2b296639cc1e2d550292919.exe File opened (read-only) \??\P: aee86a6fb2b296639cc1e2d550292919.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf aee86a6fb2b296639cc1e2d550292919.exe File opened for modification F:\autorun.inf aee86a6fb2b296639cc1e2d550292919.exe - Drops file in Program Files directory 11 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe aee86a6fb2b296639cc1e2d550292919.exe File opened for modification C:\Program Files\7-Zip\7zG.exe aee86a6fb2b296639cc1e2d550292919.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe aee86a6fb2b296639cc1e2d550292919.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe aee86a6fb2b296639cc1e2d550292919.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe aee86a6fb2b296639cc1e2d550292919.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe aee86a6fb2b296639cc1e2d550292919.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe aee86a6fb2b296639cc1e2d550292919.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe aee86a6fb2b296639cc1e2d550292919.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe aee86a6fb2b296639cc1e2d550292919.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe aee86a6fb2b296639cc1e2d550292919.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe aee86a6fb2b296639cc1e2d550292919.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI aee86a6fb2b296639cc1e2d550292919.exe File created C:\Windows\e581aa7 aee86a6fb2b296639cc1e2d550292919.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings aee86a6fb2b296639cc1e2d550292919.exe - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 2880 aee86a6fb2b296639cc1e2d550292919.exe 2880 aee86a6fb2b296639cc1e2d550292919.exe 2880 aee86a6fb2b296639cc1e2d550292919.exe 2880 aee86a6fb2b296639cc1e2d550292919.exe 2880 aee86a6fb2b296639cc1e2d550292919.exe 2880 aee86a6fb2b296639cc1e2d550292919.exe 2880 aee86a6fb2b296639cc1e2d550292919.exe 2880 aee86a6fb2b296639cc1e2d550292919.exe 2880 aee86a6fb2b296639cc1e2d550292919.exe 2880 aee86a6fb2b296639cc1e2d550292919.exe 2880 aee86a6fb2b296639cc1e2d550292919.exe 2880 aee86a6fb2b296639cc1e2d550292919.exe 2880 aee86a6fb2b296639cc1e2d550292919.exe 2880 aee86a6fb2b296639cc1e2d550292919.exe 2880 aee86a6fb2b296639cc1e2d550292919.exe 2880 aee86a6fb2b296639cc1e2d550292919.exe 2880 aee86a6fb2b296639cc1e2d550292919.exe 2880 aee86a6fb2b296639cc1e2d550292919.exe 2880 aee86a6fb2b296639cc1e2d550292919.exe 2880 aee86a6fb2b296639cc1e2d550292919.exe 2880 aee86a6fb2b296639cc1e2d550292919.exe 2880 aee86a6fb2b296639cc1e2d550292919.exe 2880 aee86a6fb2b296639cc1e2d550292919.exe 2880 aee86a6fb2b296639cc1e2d550292919.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe Token: SeDebugPrivilege 2880 aee86a6fb2b296639cc1e2d550292919.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2880 wrote to memory of 800 2880 aee86a6fb2b296639cc1e2d550292919.exe 8 PID 2880 wrote to memory of 796 2880 aee86a6fb2b296639cc1e2d550292919.exe 16 PID 2880 wrote to memory of 60 2880 aee86a6fb2b296639cc1e2d550292919.exe 10 PID 2880 wrote to memory of 2700 2880 aee86a6fb2b296639cc1e2d550292919.exe 37 PID 2880 wrote to memory of 2736 2880 aee86a6fb2b296639cc1e2d550292919.exe 36 PID 2880 wrote to memory of 2992 2880 aee86a6fb2b296639cc1e2d550292919.exe 73 PID 2880 wrote to memory of 3408 2880 aee86a6fb2b296639cc1e2d550292919.exe 68 PID 2880 wrote to memory of 3580 2880 aee86a6fb2b296639cc1e2d550292919.exe 67 PID 2880 wrote to memory of 3768 2880 aee86a6fb2b296639cc1e2d550292919.exe 66 PID 2880 wrote to memory of 3856 2880 aee86a6fb2b296639cc1e2d550292919.exe 65 PID 2880 wrote to memory of 3936 2880 aee86a6fb2b296639cc1e2d550292919.exe 40 PID 2880 wrote to memory of 4028 2880 aee86a6fb2b296639cc1e2d550292919.exe 41 PID 2880 wrote to memory of 3692 2880 aee86a6fb2b296639cc1e2d550292919.exe 46 PID 2880 wrote to memory of 2208 2880 aee86a6fb2b296639cc1e2d550292919.exe 44 PID 2880 wrote to memory of 4452 2880 aee86a6fb2b296639cc1e2d550292919.exe 58 PID 2880 wrote to memory of 4168 2880 aee86a6fb2b296639cc1e2d550292919.exe 48 PID 2880 wrote to memory of 4292 2880 aee86a6fb2b296639cc1e2d550292919.exe 52 PID 2880 wrote to memory of 2876 2880 aee86a6fb2b296639cc1e2d550292919.exe 51 PID 2880 wrote to memory of 3976 2880 aee86a6fb2b296639cc1e2d550292919.exe 88 PID 2880 wrote to memory of 800 2880 aee86a6fb2b296639cc1e2d550292919.exe 8 PID 2880 wrote to memory of 796 2880 aee86a6fb2b296639cc1e2d550292919.exe 16 PID 2880 wrote to memory of 60 2880 aee86a6fb2b296639cc1e2d550292919.exe 10 PID 2880 wrote to memory of 2700 2880 aee86a6fb2b296639cc1e2d550292919.exe 37 PID 2880 wrote to memory of 2736 2880 aee86a6fb2b296639cc1e2d550292919.exe 36 PID 2880 wrote to memory of 2992 2880 aee86a6fb2b296639cc1e2d550292919.exe 73 PID 2880 wrote to memory of 3408 2880 aee86a6fb2b296639cc1e2d550292919.exe 68 PID 2880 wrote to memory of 3580 2880 aee86a6fb2b296639cc1e2d550292919.exe 67 PID 2880 wrote to memory of 3768 2880 aee86a6fb2b296639cc1e2d550292919.exe 66 PID 2880 wrote to memory of 3856 2880 aee86a6fb2b296639cc1e2d550292919.exe 65 PID 2880 wrote to memory of 3936 2880 aee86a6fb2b296639cc1e2d550292919.exe 40 PID 2880 wrote to memory of 4028 2880 aee86a6fb2b296639cc1e2d550292919.exe 41 PID 2880 wrote to memory of 3692 2880 aee86a6fb2b296639cc1e2d550292919.exe 46 PID 2880 wrote to memory of 2208 2880 aee86a6fb2b296639cc1e2d550292919.exe 44 PID 2880 wrote to memory of 4452 2880 aee86a6fb2b296639cc1e2d550292919.exe 58 PID 2880 wrote to memory of 4168 2880 aee86a6fb2b296639cc1e2d550292919.exe 48 PID 2880 wrote to memory of 4292 2880 aee86a6fb2b296639cc1e2d550292919.exe 52 PID 2880 wrote to memory of 2876 2880 aee86a6fb2b296639cc1e2d550292919.exe 51 PID 2880 wrote to memory of 3976 2880 aee86a6fb2b296639cc1e2d550292919.exe 88 PID 2880 wrote to memory of 4556 2880 aee86a6fb2b296639cc1e2d550292919.exe 91 PID 2880 wrote to memory of 392 2880 aee86a6fb2b296639cc1e2d550292919.exe 92 PID 2880 wrote to memory of 800 2880 aee86a6fb2b296639cc1e2d550292919.exe 8 PID 2880 wrote to memory of 796 2880 aee86a6fb2b296639cc1e2d550292919.exe 16 PID 2880 wrote to memory of 60 2880 aee86a6fb2b296639cc1e2d550292919.exe 10 PID 2880 wrote to memory of 2700 2880 aee86a6fb2b296639cc1e2d550292919.exe 37 PID 2880 wrote to memory of 2736 2880 aee86a6fb2b296639cc1e2d550292919.exe 36 PID 2880 wrote to memory of 2992 2880 aee86a6fb2b296639cc1e2d550292919.exe 73 PID 2880 wrote to memory of 3408 2880 aee86a6fb2b296639cc1e2d550292919.exe 68 PID 2880 wrote to memory of 3580 2880 aee86a6fb2b296639cc1e2d550292919.exe 67 PID 2880 wrote to memory of 3768 2880 aee86a6fb2b296639cc1e2d550292919.exe 66 PID 2880 wrote to memory of 3856 2880 aee86a6fb2b296639cc1e2d550292919.exe 65 PID 2880 wrote to memory of 3936 2880 aee86a6fb2b296639cc1e2d550292919.exe 40 PID 2880 wrote to memory of 4028 2880 aee86a6fb2b296639cc1e2d550292919.exe 41 PID 2880 wrote to memory of 3692 2880 aee86a6fb2b296639cc1e2d550292919.exe 46 PID 2880 wrote to memory of 2208 2880 aee86a6fb2b296639cc1e2d550292919.exe 44 PID 2880 wrote to memory of 4452 2880 aee86a6fb2b296639cc1e2d550292919.exe 58 PID 2880 wrote to memory of 4168 2880 aee86a6fb2b296639cc1e2d550292919.exe 48 PID 2880 wrote to memory of 4292 2880 aee86a6fb2b296639cc1e2d550292919.exe 52 PID 2880 wrote to memory of 2876 2880 aee86a6fb2b296639cc1e2d550292919.exe 51 PID 2880 wrote to memory of 3976 2880 aee86a6fb2b296639cc1e2d550292919.exe 88 PID 2880 wrote to memory of 4556 2880 aee86a6fb2b296639cc1e2d550292919.exe 91 PID 2880 wrote to memory of 800 2880 aee86a6fb2b296639cc1e2d550292919.exe 8 PID 2880 wrote to memory of 796 2880 aee86a6fb2b296639cc1e2d550292919.exe 16 PID 2880 wrote to memory of 60 2880 aee86a6fb2b296639cc1e2d550292919.exe 10 PID 2880 wrote to memory of 2700 2880 aee86a6fb2b296639cc1e2d550292919.exe 37 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" aee86a6fb2b296639cc1e2d550292919.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:800
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:60
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:796
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2736
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2700
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3936
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4028
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2208
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3692
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca1⤵PID:4168
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:2876
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:4292
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4452
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3856
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3768
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3580
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\aee86a6fb2b296639cc1e2d550292919.exe"C:\Users\Admin\AppData\Local\Temp\aee86a6fb2b296639cc1e2d550292919.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2880
-
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2992
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3976
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4556
-
C:\Windows\System32\wuapihost.exeC:\Windows\System32\wuapihost.exe -Embedding1⤵PID:392
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵PID:4732
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ctrsc.pif
- Size 97KB
- SHA256 2ffbf6c057b8a90534cabd052a0d7281d15ee3254b90312fb53b6b7abfd861c2
- MD5 11389f9d4ce66e8ee73ed04a830bf684
- SHA1 d34857486b80ab314d5e22ecfbc2bdc8b1659a34
- SHA512 51cf9cac50012852f0665f087301c9fc7c8322530bbf2ef70ac1fa3f26363a6add9aaba36ba581405ac28f9f0cf804b688ecc3043dfb084b9e26eac8da83812d
- SSDEEP 1536:FCIeES6JWpYkx2FmQ3pATH5LvPSQFiyb:FmPYkM+HdKQFV
- MD5 SHA1 SHA512 SSDEEP