Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
11/03/2024, 16:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c10553511b6669c5f10256e66955ace9.exe
Resource
win7-20240221-en
windows7-x64
18 signatures
150 seconds
General
-
Target
c10553511b6669c5f10256e66955ace9.exe
-
Size
100KB
-
MD5
c10553511b6669c5f10256e66955ace9
-
SHA1
52f174ca6ac799250d0711ba57e358fccd5e23b7
-
SHA256
16e79ee3a6f24f935377544b9a71da95db4a5e3f8858b9256872e88382a38c39
-
SHA512
46fc619e5e2970ca8b0a6f8bd110da793810cef3bd0c778c389257b4e7242e73cb26fa3751ef8fab911a396eae8eae5c0ee1f828ed4c15d5c7f2339e06896126
-
SSDEEP
1536:gxKxJQwrnt71IVojM2mKfwQtnIgqAMhyS0Hkj1GeRyR1d:goxJQQ1jjMnK8gqAM0S0Hy1b0
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" c10553511b6669c5f10256e66955ace9.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" c10553511b6669c5f10256e66955ace9.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" c10553511b6669c5f10256e66955ace9.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" c10553511b6669c5f10256e66955ace9.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" c10553511b6669c5f10256e66955ace9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" c10553511b6669c5f10256e66955ace9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" c10553511b6669c5f10256e66955ace9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" c10553511b6669c5f10256e66955ace9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" c10553511b6669c5f10256e66955ace9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" c10553511b6669c5f10256e66955ace9.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" c10553511b6669c5f10256e66955ace9.exe -
Disables Task Manager via registry modification
-
resource yara_rule behavioral2/memory/1740-1-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/1740-3-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/1740-4-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/1740-7-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/1740-10-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/1740-11-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/1740-12-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/1740-13-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/1740-14-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/1740-15-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/1740-16-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/1740-17-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/1740-18-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/1740-19-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/1740-21-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/1740-22-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/1740-23-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/1740-25-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/1740-26-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/1740-28-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/1740-30-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/1740-33-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/1740-35-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/1740-37-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/1740-39-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/1740-41-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/1740-43-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/1740-45-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/1740-53-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/1740-55-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/1740-56-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/1740-57-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/1740-59-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/1740-61-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/1740-63-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/1740-65-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/1740-67-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/1740-68-0x0000000002190000-0x000000000321E000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" c10553511b6669c5f10256e66955ace9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" c10553511b6669c5f10256e66955ace9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" c10553511b6669c5f10256e66955ace9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" c10553511b6669c5f10256e66955ace9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" c10553511b6669c5f10256e66955ace9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" c10553511b6669c5f10256e66955ace9.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc c10553511b6669c5f10256e66955ace9.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" c10553511b6669c5f10256e66955ace9.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: c10553511b6669c5f10256e66955ace9.exe File opened (read-only) \??\J: c10553511b6669c5f10256e66955ace9.exe File opened (read-only) \??\K: c10553511b6669c5f10256e66955ace9.exe File opened (read-only) \??\Q: c10553511b6669c5f10256e66955ace9.exe File opened (read-only) \??\S: c10553511b6669c5f10256e66955ace9.exe File opened (read-only) \??\E: c10553511b6669c5f10256e66955ace9.exe File opened (read-only) \??\O: c10553511b6669c5f10256e66955ace9.exe File opened (read-only) \??\T: c10553511b6669c5f10256e66955ace9.exe File opened (read-only) \??\W: c10553511b6669c5f10256e66955ace9.exe File opened (read-only) \??\G: c10553511b6669c5f10256e66955ace9.exe File opened (read-only) \??\L: c10553511b6669c5f10256e66955ace9.exe File opened (read-only) \??\U: c10553511b6669c5f10256e66955ace9.exe File opened (read-only) \??\X: c10553511b6669c5f10256e66955ace9.exe File opened (read-only) \??\Z: c10553511b6669c5f10256e66955ace9.exe File opened (read-only) \??\H: c10553511b6669c5f10256e66955ace9.exe File opened (read-only) \??\M: c10553511b6669c5f10256e66955ace9.exe File opened (read-only) \??\N: c10553511b6669c5f10256e66955ace9.exe File opened (read-only) \??\P: c10553511b6669c5f10256e66955ace9.exe File opened (read-only) \??\R: c10553511b6669c5f10256e66955ace9.exe File opened (read-only) \??\V: c10553511b6669c5f10256e66955ace9.exe File opened (read-only) \??\Y: c10553511b6669c5f10256e66955ace9.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf c10553511b6669c5f10256e66955ace9.exe File opened for modification F:\autorun.inf c10553511b6669c5f10256e66955ace9.exe -
Drops file in Program Files directory 11 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe c10553511b6669c5f10256e66955ace9.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe c10553511b6669c5f10256e66955ace9.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe c10553511b6669c5f10256e66955ace9.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe c10553511b6669c5f10256e66955ace9.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe c10553511b6669c5f10256e66955ace9.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe c10553511b6669c5f10256e66955ace9.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe c10553511b6669c5f10256e66955ace9.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe c10553511b6669c5f10256e66955ace9.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe c10553511b6669c5f10256e66955ace9.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe c10553511b6669c5f10256e66955ace9.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe c10553511b6669c5f10256e66955ace9.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI c10553511b6669c5f10256e66955ace9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings c10553511b6669c5f10256e66955ace9.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 1740 c10553511b6669c5f10256e66955ace9.exe 1740 c10553511b6669c5f10256e66955ace9.exe 1740 c10553511b6669c5f10256e66955ace9.exe 1740 c10553511b6669c5f10256e66955ace9.exe 1740 c10553511b6669c5f10256e66955ace9.exe 1740 c10553511b6669c5f10256e66955ace9.exe 1740 c10553511b6669c5f10256e66955ace9.exe 1740 c10553511b6669c5f10256e66955ace9.exe 1740 c10553511b6669c5f10256e66955ace9.exe 1740 c10553511b6669c5f10256e66955ace9.exe 1740 c10553511b6669c5f10256e66955ace9.exe 1740 c10553511b6669c5f10256e66955ace9.exe 1740 c10553511b6669c5f10256e66955ace9.exe 1740 c10553511b6669c5f10256e66955ace9.exe 1740 c10553511b6669c5f10256e66955ace9.exe 1740 c10553511b6669c5f10256e66955ace9.exe 1740 c10553511b6669c5f10256e66955ace9.exe 1740 c10553511b6669c5f10256e66955ace9.exe 1740 c10553511b6669c5f10256e66955ace9.exe 1740 c10553511b6669c5f10256e66955ace9.exe 1740 c10553511b6669c5f10256e66955ace9.exe 1740 c10553511b6669c5f10256e66955ace9.exe 1740 c10553511b6669c5f10256e66955ace9.exe 1740 c10553511b6669c5f10256e66955ace9.exe 1740 c10553511b6669c5f10256e66955ace9.exe 1740 c10553511b6669c5f10256e66955ace9.exe 1740 c10553511b6669c5f10256e66955ace9.exe 1740 c10553511b6669c5f10256e66955ace9.exe 1740 c10553511b6669c5f10256e66955ace9.exe 1740 c10553511b6669c5f10256e66955ace9.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe Token: SeDebugPrivilege 1740 c10553511b6669c5f10256e66955ace9.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1740 wrote to memory of 764 1740 c10553511b6669c5f10256e66955ace9.exe 8 PID 1740 wrote to memory of 772 1740 c10553511b6669c5f10256e66955ace9.exe 9 PID 1740 wrote to memory of 60 1740 c10553511b6669c5f10256e66955ace9.exe 13 PID 1740 wrote to memory of 2532 1740 c10553511b6669c5f10256e66955ace9.exe 43 PID 1740 wrote to memory of 2544 1740 c10553511b6669c5f10256e66955ace9.exe 44 PID 1740 wrote to memory of 2704 1740 c10553511b6669c5f10256e66955ace9.exe 47 PID 1740 wrote to memory of 3524 1740 c10553511b6669c5f10256e66955ace9.exe 56 PID 1740 wrote to memory of 3716 1740 c10553511b6669c5f10256e66955ace9.exe 58 PID 1740 wrote to memory of 3912 1740 c10553511b6669c5f10256e66955ace9.exe 59 PID 1740 wrote to memory of 4004 1740 c10553511b6669c5f10256e66955ace9.exe 60 PID 1740 wrote to memory of 4064 1740 c10553511b6669c5f10256e66955ace9.exe 61 PID 1740 wrote to memory of 2796 1740 c10553511b6669c5f10256e66955ace9.exe 62 PID 1740 wrote to memory of 4112 1740 c10553511b6669c5f10256e66955ace9.exe 63 PID 1740 wrote to memory of 2308 1740 c10553511b6669c5f10256e66955ace9.exe 75 PID 1740 wrote to memory of 3740 1740 c10553511b6669c5f10256e66955ace9.exe 76 PID 1740 wrote to memory of 764 1740 c10553511b6669c5f10256e66955ace9.exe 8 PID 1740 wrote to memory of 772 1740 c10553511b6669c5f10256e66955ace9.exe 9 PID 1740 wrote to memory of 60 1740 c10553511b6669c5f10256e66955ace9.exe 13 PID 1740 wrote to memory of 2532 1740 c10553511b6669c5f10256e66955ace9.exe 43 PID 1740 wrote to memory of 2544 1740 c10553511b6669c5f10256e66955ace9.exe 44 PID 1740 wrote to memory of 2704 1740 c10553511b6669c5f10256e66955ace9.exe 47 PID 1740 wrote to memory of 3524 1740 c10553511b6669c5f10256e66955ace9.exe 56 PID 1740 wrote to memory of 3716 1740 c10553511b6669c5f10256e66955ace9.exe 58 PID 1740 wrote to memory of 3912 1740 c10553511b6669c5f10256e66955ace9.exe 59 PID 1740 wrote to memory of 4004 1740 c10553511b6669c5f10256e66955ace9.exe 60 PID 1740 wrote to memory of 4064 1740 c10553511b6669c5f10256e66955ace9.exe 61 PID 1740 wrote to memory of 2796 1740 c10553511b6669c5f10256e66955ace9.exe 62 PID 1740 wrote to memory of 4112 1740 c10553511b6669c5f10256e66955ace9.exe 63 PID 1740 wrote to memory of 2308 1740 c10553511b6669c5f10256e66955ace9.exe 75 PID 1740 wrote to memory of 3740 1740 c10553511b6669c5f10256e66955ace9.exe 76 PID 1740 wrote to memory of 764 1740 c10553511b6669c5f10256e66955ace9.exe 8 PID 1740 wrote to memory of 772 1740 c10553511b6669c5f10256e66955ace9.exe 9 PID 1740 wrote to memory of 60 1740 c10553511b6669c5f10256e66955ace9.exe 13 PID 1740 wrote to memory of 2532 1740 c10553511b6669c5f10256e66955ace9.exe 43 PID 1740 wrote to memory of 2544 1740 c10553511b6669c5f10256e66955ace9.exe 44 PID 1740 wrote to memory of 2704 1740 c10553511b6669c5f10256e66955ace9.exe 47 PID 1740 wrote to memory of 3524 1740 c10553511b6669c5f10256e66955ace9.exe 56 PID 1740 wrote to memory of 3716 1740 c10553511b6669c5f10256e66955ace9.exe 58 PID 1740 wrote to memory of 3912 1740 c10553511b6669c5f10256e66955ace9.exe 59 PID 1740 wrote to memory of 4004 1740 c10553511b6669c5f10256e66955ace9.exe 60 PID 1740 wrote to memory of 4064 1740 c10553511b6669c5f10256e66955ace9.exe 61 PID 1740 wrote to memory of 2796 1740 c10553511b6669c5f10256e66955ace9.exe 62 PID 1740 wrote to memory of 4112 1740 c10553511b6669c5f10256e66955ace9.exe 63 PID 1740 wrote to memory of 2308 1740 c10553511b6669c5f10256e66955ace9.exe 75 PID 1740 wrote to memory of 3740 1740 c10553511b6669c5f10256e66955ace9.exe 76 PID 1740 wrote to memory of 764 1740 c10553511b6669c5f10256e66955ace9.exe 8 PID 1740 wrote to memory of 772 1740 c10553511b6669c5f10256e66955ace9.exe 9 PID 1740 wrote to memory of 60 1740 c10553511b6669c5f10256e66955ace9.exe 13 PID 1740 wrote to memory of 2532 1740 c10553511b6669c5f10256e66955ace9.exe 43 PID 1740 wrote to memory of 2544 1740 c10553511b6669c5f10256e66955ace9.exe 44 PID 1740 wrote to memory of 2704 1740 c10553511b6669c5f10256e66955ace9.exe 47 PID 1740 wrote to memory of 3524 1740 c10553511b6669c5f10256e66955ace9.exe 56 PID 1740 wrote to memory of 3716 1740 c10553511b6669c5f10256e66955ace9.exe 58 PID 1740 wrote to memory of 3912 1740 c10553511b6669c5f10256e66955ace9.exe 59 PID 1740 wrote to memory of 4004 1740 c10553511b6669c5f10256e66955ace9.exe 60 PID 1740 wrote to memory of 4064 1740 c10553511b6669c5f10256e66955ace9.exe 61 PID 1740 wrote to memory of 2796 1740 c10553511b6669c5f10256e66955ace9.exe 62 PID 1740 wrote to memory of 4112 1740 c10553511b6669c5f10256e66955ace9.exe 63 PID 1740 wrote to memory of 2308 1740 c10553511b6669c5f10256e66955ace9.exe 75 PID 1740 wrote to memory of 3740 1740 c10553511b6669c5f10256e66955ace9.exe 76 PID 1740 wrote to memory of 764 1740 c10553511b6669c5f10256e66955ace9.exe 8 PID 1740 wrote to memory of 772 1740 c10553511b6669c5f10256e66955ace9.exe 9 PID 1740 wrote to memory of 60 1740 c10553511b6669c5f10256e66955ace9.exe 13 PID 1740 wrote to memory of 2532 1740 c10553511b6669c5f10256e66955ace9.exe 43 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" c10553511b6669c5f10256e66955ace9.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:764
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:772
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:60
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2532
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2544
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2704
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\c10553511b6669c5f10256e66955ace9.exe"C:\Users\Admin\AppData\Local\Temp\c10553511b6669c5f10256e66955ace9.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1740
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3716
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3912
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4004
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4064
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2796
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4112
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:2308
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3740
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD5a313c9bcf5bd14eb49dfd12daad7c346
SHA1d76995a5072a719dd80035cce41167a67086ac89
SHA25688d043737f2304ab5f9692d5a80553d3cedc727f1f640bf50ab2042bc54b91e5
SHA5128572b58b8eeacd398510e89a9fe6bb992802cc1e1d2292371cce3cb7989f846686ca7849088abe142aee1a3d3b08af268fee649a5673f97e2c29f47e8a2262b8