Analysis
- max time kernel
131s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
01/03/2024, 19:39
Behavioral task
behavioral1
Sample
7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe
Resource
win7-20240221-en
windows7-x64
17 signatures
150 seconds
General
- Target 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe
- Size 2.7MB
- Sample240301-ydbvaacc5w
- SHA256 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa
- MD5 0a627967e64efce66cda02cd2201d2e9
- SHA1 28f77ddcdf86d52fc9bcbf57f0c26506934b08c5
- SHA512 919e54790dbbbab49490c3decfe6899019de9feffcefbf3a2610f3f4864b249c22b9ae40d4656f7c435c66d7b7f25089fa10d8715b8c017cb6f73812330180d9
- SSDEEP 49152:At8MGGGN/DJAyC4yHJvu/wRwAjGeRj56QT:+8MGGGZlAyCPVuMIQT
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe -
resource yara_rule behavioral2/memory/3316-0-0x0000000000400000-0x0000000000777000-memory.dmp upx behavioral2/memory/3316-2-0x00000000026E0000-0x000000000379A000-memory.dmp upx behavioral2/memory/3316-4-0x00000000026E0000-0x000000000379A000-memory.dmp upx behavioral2/memory/3316-5-0x00000000026E0000-0x000000000379A000-memory.dmp upx behavioral2/memory/3316-10-0x00000000026E0000-0x000000000379A000-memory.dmp upx behavioral2/memory/3316-11-0x00000000026E0000-0x000000000379A000-memory.dmp upx behavioral2/memory/3316-12-0x00000000026E0000-0x000000000379A000-memory.dmp upx behavioral2/memory/3316-13-0x00000000026E0000-0x000000000379A000-memory.dmp upx behavioral2/memory/3316-19-0x00000000026E0000-0x000000000379A000-memory.dmp upx behavioral2/memory/3316-20-0x00000000026E0000-0x000000000379A000-memory.dmp upx behavioral2/memory/3316-21-0x00000000026E0000-0x000000000379A000-memory.dmp upx behavioral2/memory/3316-22-0x00000000026E0000-0x000000000379A000-memory.dmp upx behavioral2/memory/3316-24-0x00000000026E0000-0x000000000379A000-memory.dmp upx behavioral2/memory/3316-25-0x00000000026E0000-0x000000000379A000-memory.dmp upx behavioral2/memory/3316-26-0x00000000026E0000-0x000000000379A000-memory.dmp upx behavioral2/memory/3316-29-0x00000000026E0000-0x000000000379A000-memory.dmp upx behavioral2/memory/3316-30-0x00000000026E0000-0x000000000379A000-memory.dmp upx behavioral2/memory/3316-31-0x00000000026E0000-0x000000000379A000-memory.dmp upx behavioral2/memory/3316-33-0x00000000026E0000-0x000000000379A000-memory.dmp upx behavioral2/memory/3316-42-0x0000000000400000-0x0000000000777000-memory.dmp upx behavioral2/memory/3316-34-0x00000000026E0000-0x000000000379A000-memory.dmp upx behavioral2/memory/3316-35-0x00000000026E0000-0x000000000379A000-memory.dmp upx behavioral2/memory/3316-44-0x00000000026E0000-0x000000000379A000-memory.dmp upx behavioral2/memory/3316-49-0x00000000026E0000-0x000000000379A000-memory.dmp upx behavioral2/memory/3316-51-0x00000000026E0000-0x000000000379A000-memory.dmp upx behavioral2/memory/3316-60-0x00000000026E0000-0x000000000379A000-memory.dmp upx behavioral2/memory/3316-62-0x00000000026E0000-0x000000000379A000-memory.dmp upx behavioral2/memory/3316-63-0x00000000026E0000-0x000000000379A000-memory.dmp upx behavioral2/memory/3316-67-0x00000000026E0000-0x000000000379A000-memory.dmp upx behavioral2/memory/3316-72-0x00000000026E0000-0x000000000379A000-memory.dmp upx behavioral2/memory/3316-73-0x00000000026E0000-0x000000000379A000-memory.dmp upx behavioral2/memory/3316-74-0x00000000026E0000-0x000000000379A000-memory.dmp upx behavioral2/memory/3316-76-0x00000000026E0000-0x000000000379A000-memory.dmp upx behavioral2/memory/3316-78-0x00000000026E0000-0x000000000379A000-memory.dmp upx behavioral2/memory/3316-81-0x00000000026E0000-0x000000000379A000-memory.dmp upx behavioral2/memory/3316-84-0x00000000026E0000-0x000000000379A000-memory.dmp upx behavioral2/memory/3316-85-0x00000000026E0000-0x000000000379A000-memory.dmp upx behavioral2/memory/3316-95-0x00000000026E0000-0x000000000379A000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe - Enumerates connected drives 3 TTPs 19 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe File opened (read-only) \??\G: 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe File opened (read-only) \??\I: 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe File opened (read-only) \??\J: 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe File opened (read-only) \??\Q: 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe File opened (read-only) \??\T: 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe File opened (read-only) \??\W: 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe File opened (read-only) \??\E: 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe File opened (read-only) \??\K: 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe File opened (read-only) \??\L: 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe File opened (read-only) \??\X: 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe File opened (read-only) \??\Y: 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe File opened (read-only) \??\M: 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe File opened (read-only) \??\P: 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe File opened (read-only) \??\U: 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe File opened (read-only) \??\V: 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe File opened (read-only) \??\B: 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe File opened (read-only) \??\N: 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe File opened (read-only) \??\O: 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe File opened for modification F:\autorun.inf 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\e578359 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe File opened for modification C:\Windows\SYSTEM.INI 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe Token: SeDebugPrivilege 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3316 wrote to memory of 792 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 9 PID 3316 wrote to memory of 796 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 10 PID 3316 wrote to memory of 332 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 13 PID 3316 wrote to memory of 2768 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 50 PID 3316 wrote to memory of 2844 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 51 PID 3316 wrote to memory of 2896 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 52 PID 3316 wrote to memory of 3364 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 57 PID 3316 wrote to memory of 3520 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 58 PID 3316 wrote to memory of 3728 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 59 PID 3316 wrote to memory of 3820 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 60 PID 3316 wrote to memory of 3936 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 61 PID 3316 wrote to memory of 4016 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 62 PID 3316 wrote to memory of 4100 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 63 PID 3316 wrote to memory of 2204 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 65 PID 3316 wrote to memory of 4660 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 75 PID 3316 wrote to memory of 1444 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 82 PID 3316 wrote to memory of 5024 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 83 PID 3316 wrote to memory of 756 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 84 PID 3316 wrote to memory of 792 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 9 PID 3316 wrote to memory of 796 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 10 PID 3316 wrote to memory of 332 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 13 PID 3316 wrote to memory of 2768 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 50 PID 3316 wrote to memory of 2844 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 51 PID 3316 wrote to memory of 2896 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 52 PID 3316 wrote to memory of 3364 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 57 PID 3316 wrote to memory of 3520 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 58 PID 3316 wrote to memory of 3728 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 59 PID 3316 wrote to memory of 3820 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 60 PID 3316 wrote to memory of 3936 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 61 PID 3316 wrote to memory of 4016 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 62 PID 3316 wrote to memory of 4100 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 63 PID 3316 wrote to memory of 2204 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 65 PID 3316 wrote to memory of 4660 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 75 PID 3316 wrote to memory of 1444 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 82 PID 3316 wrote to memory of 5024 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 83 PID 3316 wrote to memory of 756 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 84 PID 3316 wrote to memory of 792 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 9 PID 3316 wrote to memory of 796 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 10 PID 3316 wrote to memory of 332 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 13 PID 3316 wrote to memory of 2768 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 50 PID 3316 wrote to memory of 2844 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 51 PID 3316 wrote to memory of 2896 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 52 PID 3316 wrote to memory of 3364 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 57 PID 3316 wrote to memory of 3520 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 58 PID 3316 wrote to memory of 3728 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 59 PID 3316 wrote to memory of 3820 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 60 PID 3316 wrote to memory of 3936 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 61 PID 3316 wrote to memory of 4016 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 62 PID 3316 wrote to memory of 4100 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 63 PID 3316 wrote to memory of 2204 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 65 PID 3316 wrote to memory of 4660 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 75 PID 3316 wrote to memory of 1444 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 82 PID 3316 wrote to memory of 5024 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 83 PID 3316 wrote to memory of 756 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 84 PID 3316 wrote to memory of 972 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 87 PID 3316 wrote to memory of 792 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 9 PID 3316 wrote to memory of 796 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 10 PID 3316 wrote to memory of 332 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 13 PID 3316 wrote to memory of 2768 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 50 PID 3316 wrote to memory of 2844 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 51 PID 3316 wrote to memory of 2896 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 52 PID 3316 wrote to memory of 3364 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 57 PID 3316 wrote to memory of 3520 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 58 PID 3316 wrote to memory of 3728 3316 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe 59 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:792
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:796
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:332
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2768
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2844
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2896
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe"C:\Users\Admin\AppData\Local\Temp\7cd8df72bae75a4844426b0376984fa2d10f6b79cae532e43cacb5dd59f860aa.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3316
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3520
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3728
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3820
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3936
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4016
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4100
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2204
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4660
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:1444
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca1⤵PID:5024
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:756
-
C:\Windows\System32\wuapihost.exeC:\Windows\System32\wuapihost.exe -Embedding1⤵PID:972
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2488
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1232
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\viewrr.pif
- Size 97KB
- SHA256 12863aa82fe393bef7afd45eb2527f43bd432be36961b458dafdd560d67ef466
- MD5 4ae1ffd3fc55015171d31370a9d2c6bd
- SHA1 6e8c8ce6407541e8047cc7a8f0bd28d9335d64a7
- SHA512 a9e82308345fbbd6d004513b3c65168e95f7f9cfe33723df7d96c463a9a1684cd3a601b3290b4a5a0b2c6ddf28e838974de60b01a79bc51813bd63587acb1273
- SSDEEP 1536:oZswhw0TTuR9o6YGzonMWmPlb1r1jcj0kS+wGJnEXNAZkN8PpK1T3dbpGqj57sLi:oZBTTbbGyLKDkNxwAZkCP4zA
- MD5 SHA1 SHA512 SSDEEP