Analysis
-
max time kernel
150s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
14/03/2024, 20:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe
Resource
win7-20240215-en
windows7-x64
15 signatures
150 seconds
General
-
Target
6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe
-
Size
65KB
-
MD5
bf84dfd1b31610af5ceb4179b7e1458d
-
SHA1
3968111e1f49f55b643e3291544ab5e948094891
-
SHA256
6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849
-
SHA512
dfeddbceb7456353a335d64aac46bc61c57df3a9925ff98e1c92b7a136b4a1391aa690fc874611067ad35576959242bc783b52aee8c53a101e53ea54ca6a1da9
-
SSDEEP
1536:49Uvn/1Zg4pzyci4msuIGz46k8Cog+gcz1viLNn9Yh:YUftHpmci4mRHkloAO1aLNnih
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe -
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 19 IoCs
resource yara_rule behavioral2/memory/388-2-0x0000000000860000-0x000000000191A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/388-4-0x0000000000860000-0x000000000191A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/388-5-0x0000000000860000-0x000000000191A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/388-8-0x0000000000860000-0x000000000191A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/388-11-0x0000000000860000-0x000000000191A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/388-17-0x0000000000860000-0x000000000191A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/388-18-0x0000000000860000-0x000000000191A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/388-19-0x0000000000860000-0x000000000191A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/388-20-0x0000000000860000-0x000000000191A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/388-21-0x0000000000860000-0x000000000191A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/388-23-0x0000000000860000-0x000000000191A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/388-24-0x0000000000860000-0x000000000191A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/388-25-0x0000000000860000-0x000000000191A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/388-26-0x0000000000860000-0x000000000191A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/388-29-0x0000000000860000-0x000000000191A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/388-31-0x0000000000860000-0x000000000191A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/388-32-0x0000000000860000-0x000000000191A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/388-33-0x0000000000860000-0x000000000191A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/388-37-0x0000000000860000-0x000000000191A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine -
UPX dump on OEP (original entry point) 20 IoCs
resource yara_rule behavioral2/memory/388-2-0x0000000000860000-0x000000000191A000-memory.dmp UPX behavioral2/memory/388-4-0x0000000000860000-0x000000000191A000-memory.dmp UPX behavioral2/memory/388-5-0x0000000000860000-0x000000000191A000-memory.dmp UPX behavioral2/memory/388-8-0x0000000000860000-0x000000000191A000-memory.dmp UPX behavioral2/memory/388-11-0x0000000000860000-0x000000000191A000-memory.dmp UPX behavioral2/memory/388-17-0x0000000000860000-0x000000000191A000-memory.dmp UPX behavioral2/memory/388-18-0x0000000000860000-0x000000000191A000-memory.dmp UPX behavioral2/memory/388-19-0x0000000000860000-0x000000000191A000-memory.dmp UPX behavioral2/memory/388-20-0x0000000000860000-0x000000000191A000-memory.dmp UPX behavioral2/memory/388-21-0x0000000000860000-0x000000000191A000-memory.dmp UPX behavioral2/memory/388-23-0x0000000000860000-0x000000000191A000-memory.dmp UPX behavioral2/memory/388-24-0x0000000000860000-0x000000000191A000-memory.dmp UPX behavioral2/memory/388-25-0x0000000000860000-0x000000000191A000-memory.dmp UPX behavioral2/memory/388-26-0x0000000000860000-0x000000000191A000-memory.dmp UPX behavioral2/memory/388-29-0x0000000000860000-0x000000000191A000-memory.dmp UPX behavioral2/memory/388-31-0x0000000000860000-0x000000000191A000-memory.dmp UPX behavioral2/memory/388-32-0x0000000000860000-0x000000000191A000-memory.dmp UPX behavioral2/memory/388-33-0x0000000000860000-0x000000000191A000-memory.dmp UPX behavioral2/memory/388-37-0x0000000000860000-0x000000000191A000-memory.dmp UPX behavioral2/memory/388-56-0x0000000000400000-0x0000000000412000-memory.dmp UPX -
resource yara_rule behavioral2/memory/388-2-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/388-4-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/388-5-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/388-8-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/388-11-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/388-17-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/388-18-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/388-19-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/388-20-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/388-21-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/388-23-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/388-24-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/388-25-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/388-26-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/388-29-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/388-31-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/388-32-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/388-33-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/388-37-0x0000000000860000-0x000000000191A000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe -
Enumerates connected drives 3 TTPs 5 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe File opened (read-only) \??\I: 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe File opened (read-only) \??\J: 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe File opened (read-only) \??\E: 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe File opened (read-only) \??\G: 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe File created C:\Windows\e575dfe 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe Token: SeDebugPrivilege 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 388 wrote to memory of 796 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe 9 PID 388 wrote to memory of 804 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe 10 PID 388 wrote to memory of 336 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe 13 PID 388 wrote to memory of 2524 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe 43 PID 388 wrote to memory of 2568 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe 45 PID 388 wrote to memory of 2812 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe 51 PID 388 wrote to memory of 3408 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe 56 PID 388 wrote to memory of 3540 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe 57 PID 388 wrote to memory of 3764 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe 58 PID 388 wrote to memory of 3864 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe 59 PID 388 wrote to memory of 3976 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe 60 PID 388 wrote to memory of 4056 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe 61 PID 388 wrote to memory of 4136 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe 62 PID 388 wrote to memory of 4836 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe 74 PID 388 wrote to memory of 1844 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe 75 PID 388 wrote to memory of 2000 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe 83 PID 388 wrote to memory of 632 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe 84 PID 388 wrote to memory of 1484 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe 85 PID 388 wrote to memory of 3024 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe 88 PID 388 wrote to memory of 796 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe 9 PID 388 wrote to memory of 804 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe 10 PID 388 wrote to memory of 336 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe 13 PID 388 wrote to memory of 2524 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe 43 PID 388 wrote to memory of 2568 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe 45 PID 388 wrote to memory of 2812 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe 51 PID 388 wrote to memory of 3408 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe 56 PID 388 wrote to memory of 3540 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe 57 PID 388 wrote to memory of 3764 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe 58 PID 388 wrote to memory of 3864 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe 59 PID 388 wrote to memory of 3976 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe 60 PID 388 wrote to memory of 4056 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe 61 PID 388 wrote to memory of 4136 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe 62 PID 388 wrote to memory of 4836 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe 74 PID 388 wrote to memory of 1844 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe 75 PID 388 wrote to memory of 2000 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe 83 PID 388 wrote to memory of 632 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe 84 PID 388 wrote to memory of 1484 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe 85 PID 388 wrote to memory of 3024 388 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe 88 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:796
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:804
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:336
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2524
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2568
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2812
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe"C:\Users\Admin\AppData\Local\Temp\6c6b8a3bf7b5aee2b02d01b39a75b09f152c1a1577b4f17f30992a8199458849.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:388
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3540
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3764
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3864
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3976
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4056
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4136
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4836
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1844
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca1⤵PID:2000
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:632
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:1484
-
C:\Windows\system32\BackgroundTaskHost.exe"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider1⤵PID:3024
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5