Analysis
- max time kernel
91s - max time network
98s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
17/03/2024, 00:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cf859da0e0a21745830a60cbae011bba.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
General
- Target cf859da0e0a21745830a60cbae011bba.exe
- Size 332KB
- Sample240317-bbcmgaae97
- SHA256 8db86a2e07bee0d40bcc47bae205f1f59cc131b0b4b0405f297fa75b4142e541
- MD5 cf859da0e0a21745830a60cbae011bba
- SHA1 93c2b676f67c43720bc47bba35c579336de59b52
- SHA512 afe59a0c2df5027f2d16c0f1c6d01f63fb250cbb4f07b6e667763121280da23cff40aca0bb21aadd78f3425c8801e85f44f850d1cd6d276eaccf08e9d60bd0a3
- SSDEEP 3072:RUlC5OUidcq6al0P7r1fN4MCJJ+j07pJtr11d7OkQK/HDCMkcawCKnn1fxXQXx2E:RUlC5gv6al099YpR1okQk+wek2t1l
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cf859da0e0a21745830a60cbae011bba.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" cf859da0e0a21745830a60cbae011bba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" cf859da0e0a21745830a60cbae011bba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" cf859da0e0a21745830a60cbae011bba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" cf859da0e0a21745830a60cbae011bba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" cf859da0e0a21745830a60cbae011bba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" cf859da0e0a21745830a60cbae011bba.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" cf859da0e0a21745830a60cbae011bba.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\svchost.ini cf859da0e0a21745830a60cbae011bba.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2300 netsh.exe - Loads dropped DLL 1 IoCs
pid Process 3360 regsvr32.exe -
resource yara_rule behavioral2/memory/3984-1-0x0000000002BD0000-0x0000000003C02000-memory.dmp upx behavioral2/memory/3984-5-0x0000000002BD0000-0x0000000003C02000-memory.dmp upx behavioral2/memory/3984-7-0x0000000002BD0000-0x0000000003C02000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" cf859da0e0a21745830a60cbae011bba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" cf859da0e0a21745830a60cbae011bba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" cf859da0e0a21745830a60cbae011bba.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc cf859da0e0a21745830a60cbae011bba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" cf859da0e0a21745830a60cbae011bba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" cf859da0e0a21745830a60cbae011bba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" cf859da0e0a21745830a60cbae011bba.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\systemsrvload = "C:\\Windows\\system32\\drivers\\svchost.exe" cf859da0e0a21745830a60cbae011bba.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cf859da0e0a21745830a60cbae011bba.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\MSSTDFMT.DLL cf859da0e0a21745830a60cbae011bba.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI cf859da0e0a21745830a60cbae011bba.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6C51B910-900B-11D0-9484-00A0C91110ED} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99FF4677-FFC3-11D0-BD02-00C04FC2FB86}\InprocServer32\ = "C:\\Windows\\SysWow64\\MSSTDFMT.DLL" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6B263850-900B-11D0-9484-00A0C91110ED}\1.0\ = "Microsoft Data Formatting Object Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6B263850-900B-11D0-9484-00A0C91110ED}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\MSSTDFMT.DLL" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5DE7A180-91B1-11D0-9484-00A0C91110ED}\TypeLib\ = "{6B263850-900B-11D0-9484-00A0C91110ED}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSSTDFMT.StdDataFormat\ = "StdDataFormat Object" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSSTDFMT.StdDataFormat.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99FF4676-FFC3-11D0-BD02-00C04FC2FB86}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99FF4677-FFC3-11D0-BD02-00C04FC2FB86}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5DE7A180-91B1-11D0-9484-00A0C91110ED}\TypeLib\ = "{6B263850-900B-11D0-9484-00A0C91110ED}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{99FF4676-FFC3-11D0-BD02-00C04FC2FB86}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2B11E9B0-9F09-11D0-9484-00A0C91110ED}\ = "StdDataValue Object" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2B11E9B0-9F09-11D0-9484-00A0C91110ED}\VersionIndependentProgID\ = "MSSTDFMT.StdDataValue" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99FF4677-FFC3-11D0-BD02-00C04FC2FB86} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99FF4677-FFC3-11D0-BD02-00C04FC2FB86}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A1741EF6-FFC6-11D0-BD02-00C04FC2FB86}\ = "IDataFormatsDisp" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSSTDFMT.StdDataFormat.1\ = "StdDataFormat Object" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2B11E9B0-9F09-11D0-9484-00A0C91110ED} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSSTDFMT.StdDataValue regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6C51B910-900B-11D0-9484-00A0C91110ED}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99FF4677-FFC3-11D0-BD02-00C04FC2FB86}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{99FF4676-FFC3-11D0-BD02-00C04FC2FB86} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6C51B910-900B-11D0-9484-00A0C91110ED}\ = "IStdDataFormatDisp" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6C51B910-900B-11D0-9484-00A0C91110ED}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A1741EF6-FFC6-11D0-BD02-00C04FC2FB86} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1741EF6-FFC6-11D0-BD02-00C04FC2FB86}\ = "IDataFormatsDisp" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2B11E9B0-9F09-11D0-9484-00A0C91110ED}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99FF4677-FFC3-11D0-BD02-00C04FC2FB86}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6B263850-900B-11D0-9484-00A0C91110ED}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5DE7A180-91B1-11D0-9484-00A0C91110ED}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99FF4676-FFC3-11D0-BD02-00C04FC2FB86}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSSTDFMT.StdDataFormat\CLSID\ = "{6D835690-900B-11D0-9484-00A0C91110ED}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6C51B910-900B-11D0-9484-00A0C91110ED}\ = "IStdDataFormatDisp" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1741EF6-FFC6-11D0-BD02-00C04FC2FB86}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99FF4676-FFC3-11D0-BD02-00C04FC2FB86}\TypeLib\ = "{6B263850-900B-11D0-9484-00A0C91110ED}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6B263850-900B-11D0-9484-00A0C91110ED}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C2F13ED0-91B0-11D0-9484-00A0C91110ED}\ = "IStdDataFormatEvents" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6C51B910-900B-11D0-9484-00A0C91110ED}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSSTDFMT.StdDataFormat.1\CLSID\ = "{6D835690-900B-11D0-9484-00A0C91110ED}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6D835690-900B-11D0-9484-00A0C91110ED}\TypeLib\ = "{6B263850-900B-11D0-9484-00A0C91110ED}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99FF4677-FFC3-11D0-BD02-00C04FC2FB86}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSSTDFMT.StdDataFormats\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C2F13ED0-91B0-11D0-9484-00A0C91110ED}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6C51B910-900B-11D0-9484-00A0C91110ED}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A1741EF6-FFC6-11D0-BD02-00C04FC2FB86}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99FF4676-FFC3-11D0-BD02-00C04FC2FB86} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{699DDBCC-DC7E-11D0-BCF7-00C04FC2FB86}\ = "MSStdFmt Format Property Page Object" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSSTDFMT.StdDataFormats.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSSTDFMT.StdDataFormats.1\CLSID\ = "{99FF4677-FFC3-11D0-BD02-00C04FC2FB86}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C2F13ED0-91B0-11D0-9484-00A0C91110ED}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSSTDFMT.StdDataValue\CLSID\ = "{2B11E9B0-9F09-11D0-9484-00A0C91110ED}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1741EF6-FFC6-11D0-BD02-00C04FC2FB86}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1741EF6-FFC6-11D0-BD02-00C04FC2FB86}\TypeLib\ = "{6B263850-900B-11D0-9484-00A0C91110ED}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{99FF4676-FFC3-11D0-BD02-00C04FC2FB86}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5DE7A180-91B1-11D0-9484-00A0C91110ED}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C2F13ED0-91B0-11D0-9484-00A0C91110ED}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C2F13ED0-91B0-11D0-9484-00A0C91110ED}\TypeLib\ = "{6B263850-900B-11D0-9484-00A0C91110ED}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A1741EF6-FFC6-11D0-BD02-00C04FC2FB86}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99FF4677-FFC3-11D0-BD02-00C04FC2FB86}\TypeLib\ = "{6B263850-900B-11D0-9484-00A0C91110ED}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5DE7A180-91B1-11D0-9484-00A0C91110ED} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5DE7A180-91B1-11D0-9484-00A0C91110ED}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5DE7A180-91B1-11D0-9484-00A0C91110ED}\ = "IStdDataValueDisp" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{699DDBCC-DC7E-11D0-BCF7-00C04FC2FB86} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSSTDFMT.StdDataFormats.1\ = "StdDataFormats Object" regsvr32.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3984 cf859da0e0a21745830a60cbae011bba.exe 3984 cf859da0e0a21745830a60cbae011bba.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe Token: SeDebugPrivilege 3984 cf859da0e0a21745830a60cbae011bba.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3984 cf859da0e0a21745830a60cbae011bba.exe - Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 3984 wrote to memory of 2300 3984 cf859da0e0a21745830a60cbae011bba.exe 84 PID 3984 wrote to memory of 2300 3984 cf859da0e0a21745830a60cbae011bba.exe 84 PID 3984 wrote to memory of 2300 3984 cf859da0e0a21745830a60cbae011bba.exe 84 PID 3984 wrote to memory of 3360 3984 cf859da0e0a21745830a60cbae011bba.exe 85 PID 3984 wrote to memory of 3360 3984 cf859da0e0a21745830a60cbae011bba.exe 85 PID 3984 wrote to memory of 3360 3984 cf859da0e0a21745830a60cbae011bba.exe 85 PID 3984 wrote to memory of 776 3984 cf859da0e0a21745830a60cbae011bba.exe 8 PID 3984 wrote to memory of 784 3984 cf859da0e0a21745830a60cbae011bba.exe 9 PID 3984 wrote to memory of 316 3984 cf859da0e0a21745830a60cbae011bba.exe 13 PID 3984 wrote to memory of 2572 3984 cf859da0e0a21745830a60cbae011bba.exe 45 PID 3984 wrote to memory of 2584 3984 cf859da0e0a21745830a60cbae011bba.exe 46 PID 3984 wrote to memory of 2768 3984 cf859da0e0a21745830a60cbae011bba.exe 49 PID 3984 wrote to memory of 3492 3984 cf859da0e0a21745830a60cbae011bba.exe 57 PID 3984 wrote to memory of 3640 3984 cf859da0e0a21745830a60cbae011bba.exe 58 PID 3984 wrote to memory of 3820 3984 cf859da0e0a21745830a60cbae011bba.exe 59 PID 3984 wrote to memory of 3908 3984 cf859da0e0a21745830a60cbae011bba.exe 60 PID 3984 wrote to memory of 3972 3984 cf859da0e0a21745830a60cbae011bba.exe 61 PID 3984 wrote to memory of 4056 3984 cf859da0e0a21745830a60cbae011bba.exe 62 PID 3984 wrote to memory of 3772 3984 cf859da0e0a21745830a60cbae011bba.exe 63 PID 3984 wrote to memory of 4188 3984 cf859da0e0a21745830a60cbae011bba.exe 65 PID 3984 wrote to memory of 4432 3984 cf859da0e0a21745830a60cbae011bba.exe 76 PID 3984 wrote to memory of 2300 3984 cf859da0e0a21745830a60cbae011bba.exe 84 PID 3984 wrote to memory of 2300 3984 cf859da0e0a21745830a60cbae011bba.exe 84 PID 3984 wrote to memory of 3360 3984 cf859da0e0a21745830a60cbae011bba.exe 85 PID 3984 wrote to memory of 3360 3984 cf859da0e0a21745830a60cbae011bba.exe 85 PID 3984 wrote to memory of 1544 3984 cf859da0e0a21745830a60cbae011bba.exe 86 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cf859da0e0a21745830a60cbae011bba.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:776
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:316
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2572
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2584
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2768
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\cf859da0e0a21745830a60cbae011bba.exe"C:\Users\Admin\AppData\Local\Temp\cf859da0e0a21745830a60cbae011bba.exe"2⤵
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3984 -
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode disable3⤵
- Modifies Windows Firewall
PID:2300 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:1544
-
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s C:\Windows\system32\MSSTDFMT.DLL3⤵
- Loads dropped DLL
- Modifies registry class
PID:3360
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3640
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3820
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3908
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3972
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4056
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3772
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4188
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4432
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\MSSTDFMT.DLL
- Size 57KB
- SHA256 8c10106b2ebe36373e0cbdf3691d8a05b47fc5b4473de4aacef964fad43a6cd1
- MD5 0b22a1104493a0bc6d13713a6a5ed3d1
- SHA1 4b99dcab33c3380443e21eaeb8c41f1f66ab80c5
- SHA512 30ba20963f76942e8d29d92772638d1ab638cb192a8f43eccd8d48897cb64e1dde45e5851bdbca0cdf4750f0c32410eb3aac923ba43af8b99ce19e44f0453a94
- SSDEEP 1536:QDooIvKGBVSqowywzR0NIpZbmejhs9PD0P1r:sUidcq6al0P
- MD5 SHA1 SHA512 SSDEEP