Analysis
- max time kernel
118s - max time network
119s - platform
windows7_x64 - resource
win7-20240220-en - resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system - submitted
16/03/2024, 19:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe
Resource
win7-20240220-en
windows7-x64
16 signatures
150 seconds
General
- Target 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe
- Size 1.2MB
- Sample240316-xranpsbe74
- SHA256 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c
- MD5 81d240d47cba4083c48f6ff1ba48dbae
- SHA1 d84fdeeeb3e219272e7f7bd7776ab47b86017389
- SHA512 7bfc5380f4c7692c4740dfc69b59dfb2820ed0381fc9352d85c755b0377e0d5f0322f59ccb32f19983966c9688fb9ac062a20e370d9262dd36560912ea080548
- SSDEEP 24576:bqo1V4IDQ1rThff+r/ibJIRYP6h95S+VlLExqWXTHRyWtv4r6PS8:bqoTDerQKwS+vExqWXTxyWF4r6PS8
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe -
resource yara_rule behavioral1/memory/2912-1-0x0000000001ED0000-0x0000000002F8A000-memory.dmp upx behavioral1/memory/2912-10-0x0000000001ED0000-0x0000000002F8A000-memory.dmp upx behavioral1/memory/2912-11-0x0000000001ED0000-0x0000000002F8A000-memory.dmp upx behavioral1/memory/2912-13-0x0000000001ED0000-0x0000000002F8A000-memory.dmp upx behavioral1/memory/2912-16-0x0000000001ED0000-0x0000000002F8A000-memory.dmp upx behavioral1/memory/2912-18-0x0000000001ED0000-0x0000000002F8A000-memory.dmp upx behavioral1/memory/2912-20-0x0000000001ED0000-0x0000000002F8A000-memory.dmp upx behavioral1/memory/2912-22-0x0000000001ED0000-0x0000000002F8A000-memory.dmp upx behavioral1/memory/2912-25-0x0000000001ED0000-0x0000000002F8A000-memory.dmp upx behavioral1/memory/2912-28-0x0000000001ED0000-0x0000000002F8A000-memory.dmp upx behavioral1/memory/2912-37-0x0000000001ED0000-0x0000000002F8A000-memory.dmp upx behavioral1/memory/2912-38-0x0000000001ED0000-0x0000000002F8A000-memory.dmp upx behavioral1/memory/2912-39-0x0000000001ED0000-0x0000000002F8A000-memory.dmp upx behavioral1/memory/2912-40-0x0000000001ED0000-0x0000000002F8A000-memory.dmp upx behavioral1/memory/2912-41-0x0000000001ED0000-0x0000000002F8A000-memory.dmp upx behavioral1/memory/2912-43-0x0000000001ED0000-0x0000000002F8A000-memory.dmp upx behavioral1/memory/2912-44-0x0000000001ED0000-0x0000000002F8A000-memory.dmp upx behavioral1/memory/2912-45-0x0000000001ED0000-0x0000000002F8A000-memory.dmp upx behavioral1/memory/2912-47-0x0000000001ED0000-0x0000000002F8A000-memory.dmp upx behavioral1/memory/2912-49-0x0000000001ED0000-0x0000000002F8A000-memory.dmp upx behavioral1/memory/2912-58-0x0000000001ED0000-0x0000000002F8A000-memory.dmp upx behavioral1/memory/2912-60-0x0000000001ED0000-0x0000000002F8A000-memory.dmp upx behavioral1/memory/2912-62-0x0000000001ED0000-0x0000000002F8A000-memory.dmp upx behavioral1/memory/2912-66-0x0000000001ED0000-0x0000000002F8A000-memory.dmp upx behavioral1/memory/2912-70-0x0000000001ED0000-0x0000000002F8A000-memory.dmp upx behavioral1/memory/2912-72-0x0000000001ED0000-0x0000000002F8A000-memory.dmp upx behavioral1/memory/2912-74-0x0000000001ED0000-0x0000000002F8A000-memory.dmp upx behavioral1/memory/2912-81-0x0000000001ED0000-0x0000000002F8A000-memory.dmp upx behavioral1/memory/2912-83-0x0000000001ED0000-0x0000000002F8A000-memory.dmp upx behavioral1/memory/2912-175-0x0000000001ED0000-0x0000000002F8A000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe File opened (read-only) \??\J: 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe File opened (read-only) \??\V: 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe File opened (read-only) \??\W: 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe File opened (read-only) \??\Z: 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe File opened (read-only) \??\G: 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe File opened (read-only) \??\L: 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe File opened (read-only) \??\M: 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe File opened (read-only) \??\N: 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe File opened (read-only) \??\S: 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe File opened (read-only) \??\X: 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe File opened (read-only) \??\Y: 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe File opened (read-only) \??\I: 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe File opened (read-only) \??\K: 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe File opened (read-only) \??\O: 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe File opened (read-only) \??\P: 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe File opened (read-only) \??\Q: 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe File opened (read-only) \??\R: 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe File opened (read-only) \??\T: 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe File opened (read-only) \??\E: 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe File opened (read-only) \??\U: 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe File opened for modification F:\autorun.inf 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\f761036 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe File opened for modification C:\Windows\SYSTEM.INI 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe - Suspicious use of AdjustPrivilegeToken 28 IoCs
description pid Process Token: SeDebugPrivilege 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe Token: SeDebugPrivilege 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe Token: SeDebugPrivilege 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe Token: SeDebugPrivilege 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe Token: SeDebugPrivilege 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe Token: SeDebugPrivilege 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe Token: SeDebugPrivilege 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe Token: SeDebugPrivilege 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe Token: SeDebugPrivilege 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe Token: SeDebugPrivilege 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe Token: SeDebugPrivilege 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe Token: SeDebugPrivilege 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe Token: SeDebugPrivilege 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe Token: SeDebugPrivilege 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe Token: SeDebugPrivilege 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe Token: SeDebugPrivilege 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe Token: SeDebugPrivilege 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe Token: SeDebugPrivilege 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe Token: SeDebugPrivilege 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe Token: SeDebugPrivilege 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe Token: SeDebugPrivilege 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe Token: SeDebugPrivilege 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe Token: SeDebugPrivilege 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe Token: SeDebugPrivilege 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe Token: SeDebugPrivilege 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe Token: SeDebugPrivilege 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe Token: SeDebugPrivilege 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe Token: SeDebugPrivilege 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2912 wrote to memory of 1036 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe 17 PID 2912 wrote to memory of 1064 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe 18 PID 2912 wrote to memory of 1104 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe 20 PID 2912 wrote to memory of 2120 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe 23 PID 2912 wrote to memory of 1036 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe 17 PID 2912 wrote to memory of 1064 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe 18 PID 2912 wrote to memory of 1104 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe 20 PID 2912 wrote to memory of 2120 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe 23 PID 2912 wrote to memory of 1036 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe 17 PID 2912 wrote to memory of 1064 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe 18 PID 2912 wrote to memory of 1104 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe 20 PID 2912 wrote to memory of 2120 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe 23 PID 2912 wrote to memory of 1036 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe 17 PID 2912 wrote to memory of 1064 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe 18 PID 2912 wrote to memory of 1104 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe 20 PID 2912 wrote to memory of 2120 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe 23 PID 2912 wrote to memory of 1036 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe 17 PID 2912 wrote to memory of 1064 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe 18 PID 2912 wrote to memory of 1104 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe 20 PID 2912 wrote to memory of 2120 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe 23 PID 2912 wrote to memory of 1036 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe 17 PID 2912 wrote to memory of 1064 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe 18 PID 2912 wrote to memory of 1104 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe 20 PID 2912 wrote to memory of 2120 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe 23 PID 2912 wrote to memory of 1036 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe 17 PID 2912 wrote to memory of 1064 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe 18 PID 2912 wrote to memory of 1104 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe 20 PID 2912 wrote to memory of 2120 2912 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe 23 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1036
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe"C:\Users\Admin\AppData\Local\Temp\4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2912
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1104
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:2120
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Helper_2345\temp\Helper_2345.CheckVersion.data
- Size 29B
- SHA256 5313e624a817ebcb34675027d12b87465de4fc4fdddfdd74d244490c4911b8e4
- MD5 99fb8e84b8aa92889349054a60e1f359
- SHA1 1b3dd1afb4fe4533ca16db4dd3e7845c13b0e1c5
- SHA512 2a99095109445c3ca1b9fad5c87fdfed331641401ca8d19d3ab4d109e18b9dc5feb739485f14f390bd3bcfa3a4325e3b1278fe1bb8690dd8df16edb9af52faac
- MD5 SHA1 SHA512
- Path F:\iwfyn.exe
- Size 97KB
- SHA256 7a1ee248d7325a5399c35a614eab75a933fb34427da2af9b296dfed24767173e
- MD5 194ba9d0c119203bb8e11ee6e397e87c
- SHA1 50a3477f5e2d61259a2900ace9a2c9af931e957e
- SHA512 4204d13db7b409ece03a7c6da55c33715fcbba98ce0a8235b0c14b2f08a3dea5283dec064d957efff1b5695e7a765db30198891a15623a731ed91000de603ff6
- SSDEEP 3072:EH/e8lwGuaP28MeoAZy7UKIQ/OabV/4p:EH7lNuaP28Me7y7UFejV4
- MD5 SHA1 SHA512 SSDEEP