Analysis
- max time kernel
22s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
18/03/2024, 00:51
Behavioral task
behavioral1
Sample
e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe
Resource
win7-20240215-en
windows7-x64
22 signatures
150 seconds
General
- Target e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe
- Size 617KB
- Sample240318-a7p21ada4v
- SHA256 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f
- MD5 35d3df83482038f4ecea9d399bd06283
- SHA1 31cf28f3b4a3268af9fe531799c445838b56ebee
- SHA512 e5794424d0f8c65b9682fce8ec4960d160c0c9b61adff041c72b3ba6d085e8264e39c943b03f93e7bed56c6f6a11ca690c18ded26d3d2a135126df459003e4a7
- SSDEEP 12288:+M5DSN6aAH0XNyDemerLa7gGpWa7U8oico9hJMBex+gQL0O:+M5D18NyrEGZNVlxnFO
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
-
http://www.klkjwre9fqwieluoi.info/
-
http://kukutrustnet777888.info/
Signatures
- Modifies firewall policy service 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" lsass.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" lsass.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" lsass.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" lsass.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" lsass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" lsass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" lsass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" lsass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" lsass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" lsass.exe - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 37 IoCs
resource yara_rule behavioral2/memory/2100-2-0x00000000023C0000-0x000000000344E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2100-4-0x00000000023C0000-0x000000000344E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2100-8-0x00000000023C0000-0x000000000344E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2100-10-0x00000000023C0000-0x000000000344E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2100-14-0x00000000023C0000-0x000000000344E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2100-16-0x00000000023C0000-0x000000000344E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2100-17-0x00000000023C0000-0x000000000344E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2100-18-0x00000000023C0000-0x000000000344E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4812-48-0x0000000003080000-0x000000000410E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4812-51-0x0000000003080000-0x000000000410E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4812-53-0x0000000003080000-0x000000000410E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4812-52-0x0000000003080000-0x000000000410E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4812-55-0x0000000003080000-0x000000000410E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4812-59-0x0000000003080000-0x000000000410E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4812-60-0x0000000003080000-0x000000000410E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4812-61-0x0000000003080000-0x000000000410E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4812-62-0x0000000003080000-0x000000000410E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4812-63-0x0000000003080000-0x000000000410E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4812-67-0x0000000003080000-0x000000000410E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4812-68-0x0000000003080000-0x000000000410E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4812-69-0x0000000003080000-0x000000000410E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4812-70-0x0000000003080000-0x000000000410E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4812-71-0x0000000003080000-0x000000000410E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4812-73-0x0000000003080000-0x000000000410E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4812-74-0x0000000003080000-0x000000000410E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4812-75-0x0000000003080000-0x000000000410E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4812-78-0x0000000003080000-0x000000000410E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4812-79-0x0000000003080000-0x000000000410E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4812-81-0x0000000003080000-0x000000000410E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4812-83-0x0000000003080000-0x000000000410E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4812-86-0x0000000003080000-0x000000000410E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4812-88-0x0000000003080000-0x000000000410E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4812-90-0x0000000003080000-0x000000000410E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4812-92-0x0000000003080000-0x000000000410E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4812-94-0x0000000003080000-0x000000000410E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4812-108-0x0000000003080000-0x000000000410E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/files/0x0008000000023220-130.dat INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 44 IoCs
resource yara_rule behavioral2/memory/2100-0-0x0000000000400000-0x00000000004C4000-memory.dmp UPX behavioral2/memory/2100-2-0x00000000023C0000-0x000000000344E000-memory.dmp UPX behavioral2/memory/2100-4-0x00000000023C0000-0x000000000344E000-memory.dmp UPX behavioral2/memory/2100-8-0x00000000023C0000-0x000000000344E000-memory.dmp UPX behavioral2/memory/2100-10-0x00000000023C0000-0x000000000344E000-memory.dmp UPX behavioral2/memory/2100-14-0x00000000023C0000-0x000000000344E000-memory.dmp UPX behavioral2/memory/2100-16-0x00000000023C0000-0x000000000344E000-memory.dmp UPX behavioral2/memory/2100-17-0x00000000023C0000-0x000000000344E000-memory.dmp UPX behavioral2/memory/2100-18-0x00000000023C0000-0x000000000344E000-memory.dmp UPX behavioral2/files/0x0007000000023205-22.dat UPX behavioral2/memory/4812-31-0x0000000000400000-0x00000000004C4000-memory.dmp UPX behavioral2/files/0x0007000000023206-35.dat UPX behavioral2/memory/2100-33-0x0000000000400000-0x00000000004C4000-memory.dmp UPX behavioral2/memory/4812-48-0x0000000003080000-0x000000000410E000-memory.dmp UPX behavioral2/memory/4812-49-0x0000000000400000-0x00000000004C4000-memory.dmp UPX behavioral2/memory/4812-51-0x0000000003080000-0x000000000410E000-memory.dmp UPX behavioral2/memory/4812-53-0x0000000003080000-0x000000000410E000-memory.dmp UPX behavioral2/memory/4812-52-0x0000000003080000-0x000000000410E000-memory.dmp UPX behavioral2/memory/4812-55-0x0000000003080000-0x000000000410E000-memory.dmp UPX behavioral2/memory/4812-59-0x0000000003080000-0x000000000410E000-memory.dmp UPX behavioral2/memory/4812-60-0x0000000003080000-0x000000000410E000-memory.dmp UPX behavioral2/memory/4812-61-0x0000000003080000-0x000000000410E000-memory.dmp UPX behavioral2/memory/4812-62-0x0000000003080000-0x000000000410E000-memory.dmp UPX behavioral2/memory/4812-63-0x0000000003080000-0x000000000410E000-memory.dmp UPX behavioral2/files/0x00080000000231ff-64.dat UPX behavioral2/memory/4812-67-0x0000000003080000-0x000000000410E000-memory.dmp UPX behavioral2/memory/4812-68-0x0000000003080000-0x000000000410E000-memory.dmp UPX behavioral2/memory/4812-69-0x0000000003080000-0x000000000410E000-memory.dmp UPX behavioral2/memory/4812-70-0x0000000003080000-0x000000000410E000-memory.dmp UPX behavioral2/memory/4812-71-0x0000000003080000-0x000000000410E000-memory.dmp UPX behavioral2/memory/4812-73-0x0000000003080000-0x000000000410E000-memory.dmp UPX behavioral2/memory/4812-74-0x0000000003080000-0x000000000410E000-memory.dmp UPX behavioral2/memory/4812-75-0x0000000003080000-0x000000000410E000-memory.dmp UPX behavioral2/memory/4812-76-0x0000000000400000-0x00000000004C4000-memory.dmp UPX behavioral2/memory/4812-78-0x0000000003080000-0x000000000410E000-memory.dmp UPX behavioral2/memory/4812-79-0x0000000003080000-0x000000000410E000-memory.dmp UPX behavioral2/memory/4812-81-0x0000000003080000-0x000000000410E000-memory.dmp UPX behavioral2/memory/4812-83-0x0000000003080000-0x000000000410E000-memory.dmp UPX behavioral2/memory/4812-86-0x0000000003080000-0x000000000410E000-memory.dmp UPX behavioral2/memory/4812-88-0x0000000003080000-0x000000000410E000-memory.dmp UPX behavioral2/memory/4812-90-0x0000000003080000-0x000000000410E000-memory.dmp UPX behavioral2/memory/4812-92-0x0000000003080000-0x000000000410E000-memory.dmp UPX behavioral2/memory/4812-94-0x0000000003080000-0x000000000410E000-memory.dmp UPX behavioral2/memory/4812-108-0x0000000003080000-0x000000000410E000-memory.dmp UPX - Deletes itself 1 IoCs
pid Process 4812 lsass.exe - Executes dropped EXE 1 IoCs
pid Process 4812 lsass.exe -
resource yara_rule behavioral2/memory/2100-0-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2100-2-0x00000000023C0000-0x000000000344E000-memory.dmp upx behavioral2/memory/2100-4-0x00000000023C0000-0x000000000344E000-memory.dmp upx behavioral2/memory/2100-8-0x00000000023C0000-0x000000000344E000-memory.dmp upx behavioral2/memory/2100-10-0x00000000023C0000-0x000000000344E000-memory.dmp upx behavioral2/memory/2100-14-0x00000000023C0000-0x000000000344E000-memory.dmp upx behavioral2/memory/2100-16-0x00000000023C0000-0x000000000344E000-memory.dmp upx behavioral2/memory/2100-17-0x00000000023C0000-0x000000000344E000-memory.dmp upx behavioral2/memory/2100-18-0x00000000023C0000-0x000000000344E000-memory.dmp upx behavioral2/files/0x0007000000023205-22.dat upx behavioral2/memory/4812-31-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/files/0x0007000000023206-35.dat upx behavioral2/memory/2100-33-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4812-48-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/4812-49-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4812-51-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/4812-53-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/4812-52-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/4812-55-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/4812-59-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/4812-60-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/4812-61-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/4812-62-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/4812-63-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/files/0x00080000000231ff-64.dat upx behavioral2/memory/4812-67-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/4812-68-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/4812-69-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/4812-70-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/4812-71-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/4812-73-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/4812-74-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/4812-75-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/4812-76-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4812-78-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/4812-79-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/4812-81-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/4812-83-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/4812-86-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/4812-88-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/4812-90-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/4812-92-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/4812-94-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/4812-108-0x0000000003080000-0x000000000410E000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" lsass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" lsass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" lsass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" lsass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" lsass.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc lsass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" lsass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\run32 = "C:\\Win\\lsass.exe" lsass.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" lsass.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\r: lsass.exe File opened (read-only) \??\h: e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe File opened (read-only) \??\v: e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe File opened (read-only) \??\x: e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe File opened (read-only) \??\k: lsass.exe File opened (read-only) \??\i: e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe File opened (read-only) \??\m: e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe File opened (read-only) \??\r: e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe File opened (read-only) \??\w: e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe File opened (read-only) \??\w: lsass.exe File opened (read-only) \??\p: e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe File opened (read-only) \??\b: lsass.exe File opened (read-only) \??\e: lsass.exe File opened (read-only) \??\q: lsass.exe File opened (read-only) \??\a: lsass.exe File opened (read-only) \??\t: lsass.exe File opened (read-only) \??\v: lsass.exe File opened (read-only) \??\G: lsass.exe File opened (read-only) \??\l: e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe File opened (read-only) \??\o: e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe File opened (read-only) \??\t: e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe File opened (read-only) \??\u: e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe File opened (read-only) \??\y: lsass.exe File opened (read-only) \??\z: lsass.exe File opened (read-only) \??\b: e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe File opened (read-only) \??\e: e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe File opened (read-only) \??\j: lsass.exe File opened (read-only) \??\n: lsass.exe File opened (read-only) \??\x: lsass.exe File opened (read-only) \??\E: lsass.exe File opened (read-only) \??\a: e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe File opened (read-only) \??\y: e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe File opened (read-only) \??\g: lsass.exe File opened (read-only) \??\h: lsass.exe File opened (read-only) \??\s: e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe File opened (read-only) \??\z: e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe File opened (read-only) \??\i: lsass.exe File opened (read-only) \??\m: lsass.exe File opened (read-only) \??\j: e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe File opened (read-only) \??\k: e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe File opened (read-only) \??\n: e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe File opened (read-only) \??\q: e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe File opened (read-only) \??\o: lsass.exe File opened (read-only) \??\p: lsass.exe File opened (read-only) \??\g: e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe File opened (read-only) \??\l: lsass.exe File opened (read-only) \??\s: lsass.exe File opened (read-only) \??\u: lsass.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe - Modifies registry class 38 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\NodeSlot = "1" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 50003100000000005a588989100041646d696e003c0009000400efbe5a584b7f725870062e0000007be1010000000100000000000000000000000000000047920300410064006d0069006e00000014000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 = ca003100000000007258710617004538413145377e310000b20009000400efbe72587106725871062e000000043202000000070000000000000000000000000000000a9cf9006500380061003100650037006300370034003200390035006400300033003100350031006200320034006100370030006600650066003100650032006600370066003600300031003400620034003100300066003400300039003100330062003500620039006100310031003200370031006200360065003700660038006600000018000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 56003100000000005a584b7f12004170704461746100400009000400efbe5a584b7f725870062e00000086e101000000010000000000000000000000000000006e4aa8004100700070004400610074006100000016000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 50003100000000005a58f38110004c6f63616c003c0009000400efbe5a584b7f725870062e00000099e101000000010000000000000000000000000000001ff397004c006f00630061006c00000014000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 explorer.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4e0031000000000072587106100054656d7000003a0009000400efbe5a584b7f725871062e0000009ae101000000010000000000000000000000000000000a9cf900540065006d007000000014000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 78003100000000005a584b7f1100557365727300640009000400efbe874f7748725870062e000000c70500000000010000000000000000003a0000000000f2fab80055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff explorer.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4876 explorer.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe 4812 lsass.exe 4812 lsass.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4812 lsass.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Token: SeDebugPrivilege 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4876 explorer.exe 4876 explorer.exe - Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 2100 wrote to memory of 792 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe 9 PID 2100 wrote to memory of 796 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe 10 PID 2100 wrote to memory of 60 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe 13 PID 2100 wrote to memory of 3084 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe 52 PID 2100 wrote to memory of 3096 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe 53 PID 2100 wrote to memory of 3148 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe 54 PID 2100 wrote to memory of 3392 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe 56 PID 2100 wrote to memory of 3548 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe 58 PID 2100 wrote to memory of 3756 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe 59 PID 2100 wrote to memory of 3860 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe 60 PID 2100 wrote to memory of 3932 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe 61 PID 2100 wrote to memory of 4012 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe 62 PID 2100 wrote to memory of 3416 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe 63 PID 2100 wrote to memory of 2340 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe 65 PID 2100 wrote to memory of 4416 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe 76 PID 2100 wrote to memory of 1624 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe 84 PID 2100 wrote to memory of 3536 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe 85 PID 2100 wrote to memory of 4296 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe 86 PID 2100 wrote to memory of 844 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe 88 PID 2100 wrote to memory of 844 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe 88 PID 2100 wrote to memory of 844 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe 88 PID 2100 wrote to memory of 4812 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe 90 PID 2100 wrote to memory of 4812 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe 90 PID 2100 wrote to memory of 4812 2100 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe 90 PID 4812 wrote to memory of 792 4812 lsass.exe 9 PID 4812 wrote to memory of 796 4812 lsass.exe 10 PID 4812 wrote to memory of 60 4812 lsass.exe 13 PID 4812 wrote to memory of 3084 4812 lsass.exe 52 PID 4812 wrote to memory of 3096 4812 lsass.exe 53 PID 4812 wrote to memory of 3148 4812 lsass.exe 54 PID 4812 wrote to memory of 3392 4812 lsass.exe 56 PID 4812 wrote to memory of 3548 4812 lsass.exe 58 PID 4812 wrote to memory of 3756 4812 lsass.exe 59 PID 4812 wrote to memory of 3860 4812 lsass.exe 60 PID 4812 wrote to memory of 3932 4812 lsass.exe 61 PID 4812 wrote to memory of 4012 4812 lsass.exe 62 PID 4812 wrote to memory of 3416 4812 lsass.exe 63 PID 4812 wrote to memory of 2340 4812 lsass.exe 65 PID 4812 wrote to memory of 4416 4812 lsass.exe 76 PID 4812 wrote to memory of 1624 4812 lsass.exe 84 PID 4812 wrote to memory of 3536 4812 lsass.exe 85 PID 4812 wrote to memory of 4876 4812 lsass.exe 89 PID 4812 wrote to memory of 4176 4812 lsass.exe 93 PID 4812 wrote to memory of 3856 4812 lsass.exe 94 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" lsass.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:792
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:796
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:60
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:3084
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:3096
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:3148
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe"C:\Users\Admin\AppData\Local\Temp\e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2100 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe C:\Users\Admin\AppData\Local\Temp\e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f3⤵PID:844
-
-
\??\c:\Win\lsass.exec:\Win\lsass.exe3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4812
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3548
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3756
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3860
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3932
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4012
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3416
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2340
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4416
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca1⤵PID:1624
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:3536
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:4296
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4876
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4624
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4176
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3856
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
7Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\0E5746FC_Rar\e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f.exe
- Size 538KB
- SHA256 a25dfcdd335ac02010eeddd12597fd6776f1a02c89ebf152b5dd7ddc2dbb1a3b
- MD5 8262d1de96c21aaabd9723878c2e76b7
- SHA1 071dd6277fa8dc807bcd656a465852ac1dac1e41
- SHA512 ca19d549198c92fc8aaf613c80a3bec58a0e3a21454c9a5a06b8b8699bc6101454e9eee555e94341a379de2e65daa3d7502ed88b281016f53024aac2541ec22c
- SSDEEP 12288:2M5DSN6aAH0XNp7gGpWa7U8oico9hJMBex+gQL0O:2M5D18NpEGZNVlxnFO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\0E575534_Rar\lsass.exe
- Size 406KB
- SHA256 53058d0397e825536fb8a9d0b6fadc9ead6bd5f6e32e99ec7ae5dd08e5506799
- MD5 39e5ac105c674e15fe5a32202fb37bc1
- SHA1 da2a2a09dba679e4b486a12d2ba2bca71ee707ef
- SHA512 f1b0c0b33bd380a9798d8b969a2c1e8d119ccacf5ea96741268091edb703eae5c1fefaa5c9baec633921a1cb01b31012b33e1038e0e377db6d6ff36945addfcf
- SSDEEP 12288:2M5DSN6aAH0XNp7gGpWa7U8oico9hJMBea:2M5D18NpEGZNVla
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Win\names.txt
- Size 1B
- SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
- MD5 c4ca4238a0b923820dcc509a6f75849b
- SHA1 356a192b7913b04c54574d18c28d46e6395428ab
- SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
- MD5 SHA1 SHA512
- Path C:\Windows\SYSTEM.INI
- Size 257B
- SHA256 f1ec36ebb65ce0bc33883ece75ae2e53b5aa04d7675473da6012f3ce628e8339
- MD5 afdf531097dd08cc15f74b3369548d7d
- SHA1 efca810a79f2fb2d2c75f09eb5d1527c04994c93
- SHA512 46383f4e362986bcc2d5388cbeb5ca3f2d186692d16e616000c59b301d89ba12ef8bfeaccb15b57fe52b959d3a133471952fddd013832903a12a7e316a22e9a4
- MD5 SHA1 SHA512
- Path C:\htuy.exe
- Size 100KB
- SHA256 ec7d4ebfd4db2044a3e52b6ce1aa9005634cb40c71415b50480ba7317d0d8c75
- MD5 ee70670366f906cb70c92affc801172e
- SHA1 0009ab54a36c6a9cb870c3e54492756e443368c7
- SHA512 c95758d597169af9d56f3405783c65c905415ddab2bcf0fda2f28d2c8915582bb9e4b2e54d8bd1c09eda3661027ee623eebb2d3dfa4c3a03a1f8afb1cca74ed8
- SSDEEP 1536:aob9WmPx9Q9Wca9vVuOl+rETqoWfgLjuKHmIqGna0BJ9:9pAW5vVuNIL1jGIVnfBJ9
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\Win\lsass.exe
- Size 617KB
- SHA256 e8a1e7c74295d03151b24a70fef1e2f7f6014b410f40913b5b9a11271b6e7f8f
- MD5 35d3df83482038f4ecea9d399bd06283
- SHA1 31cf28f3b4a3268af9fe531799c445838b56ebee
- SHA512 e5794424d0f8c65b9682fce8ec4960d160c0c9b61adff041c72b3ba6d085e8264e39c943b03f93e7bed56c6f6a11ca690c18ded26d3d2a135126df459003e4a7
- SSDEEP 12288:+M5DSN6aAH0XNyDemerLa7gGpWa7U8oico9hJMBex+gQL0O:+M5D18NyrEGZNVlxnFO
- MD5 SHA1 SHA512 SSDEEP