Analysis
- max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
18/03/2024, 00:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ed47a7259f70784e00ff48126913d63927e7963898813e20009dcc3ce1355c8b.dll
Resource
win7-20240221-en
windows7-x64
17 signatures
150 seconds
General
- Target ed47a7259f70784e00ff48126913d63927e7963898813e20009dcc3ce1355c8b.dll
- Size 120KB
- Sample240318-bb5m9acd35
- SHA256 ed47a7259f70784e00ff48126913d63927e7963898813e20009dcc3ce1355c8b
- MD5 1edf0f4742a0f17548bbd063869382b2
- SHA1 009b8ccafb8785106de7761a63aac2139e4d8476
- SHA512 60f4bb74ca48f690542f2417c8403876c9cf2869612c00ca7c3b824345c5a2920bc642103bb2a986e9223085ce6f4f087fa210d488eafbdb89e0ac4870e54093
- SSDEEP 3072:jtj2iFfcQphCulyS1ymWdsZwyt9cHuxkOTfJ9d:jvf1pdTS9a9cOGOTR9
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e5734eb.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e5734eb.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e5734eb.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e575023.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e575023.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e575023.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5734eb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e575023.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e575023.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e575023.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5734eb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5734eb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5734eb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e575023.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e575023.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e575023.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5734eb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5734eb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5734eb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e575023.exe - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 32 IoCs
resource yara_rule behavioral2/memory/3152-6-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3152-8-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3152-9-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3152-10-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3152-11-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3152-17-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3152-26-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3152-31-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3152-18-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3152-34-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3152-35-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3152-36-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3152-37-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3152-38-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3152-39-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3152-41-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3152-50-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3152-51-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3152-53-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3152-56-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3152-64-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3152-65-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3152-69-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3152-72-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3152-74-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3152-76-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3152-84-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3152-86-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3152-88-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3152-90-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/428-112-0x0000000000B30000-0x0000000001BEA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/428-151-0x0000000000B30000-0x0000000001BEA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 37 IoCs
resource yara_rule behavioral2/memory/3152-5-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/3152-6-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3152-8-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3152-9-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3152-10-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3152-11-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3152-17-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3152-26-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/4872-29-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/3152-31-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3152-18-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3152-34-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3152-35-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3152-36-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3152-37-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3152-38-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3152-39-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3152-41-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3152-50-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3152-51-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3152-53-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3152-56-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3152-64-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3152-65-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3152-69-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3152-72-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3152-74-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3152-76-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3152-84-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3152-86-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3152-88-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3152-90-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3152-106-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4872-110-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/428-112-0x0000000000B30000-0x0000000001BEA000-memory.dmp UPX behavioral2/memory/428-150-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/428-151-0x0000000000B30000-0x0000000001BEA000-memory.dmp UPX - Executes dropped EXE 3 IoCs
pid Process 3152 e5734eb.exe 4872 e5738b3.exe 428 e575023.exe -
resource yara_rule behavioral2/memory/3152-6-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3152-8-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3152-9-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3152-10-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3152-11-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3152-17-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3152-26-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3152-31-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3152-18-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3152-34-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3152-35-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3152-36-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3152-37-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3152-38-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3152-39-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3152-41-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3152-50-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3152-51-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3152-53-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3152-56-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3152-64-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3152-65-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3152-69-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3152-72-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3152-74-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3152-76-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3152-84-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3152-86-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3152-88-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3152-90-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/428-112-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx behavioral2/memory/428-151-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e575023.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e575023.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e575023.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e575023.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e575023.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5734eb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5734eb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e5734eb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e575023.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5734eb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e575023.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5734eb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5734eb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5734eb.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5734eb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e575023.exe - Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: e5734eb.exe File opened (read-only) \??\N: e5734eb.exe File opened (read-only) \??\P: e5734eb.exe File opened (read-only) \??\G: e5734eb.exe File opened (read-only) \??\R: e5734eb.exe File opened (read-only) \??\E: e575023.exe File opened (read-only) \??\K: e5734eb.exe File opened (read-only) \??\Q: e5734eb.exe File opened (read-only) \??\E: e5734eb.exe File opened (read-only) \??\H: e5734eb.exe File opened (read-only) \??\I: e5734eb.exe File opened (read-only) \??\J: e5734eb.exe File opened (read-only) \??\M: e5734eb.exe File opened (read-only) \??\O: e5734eb.exe - Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe e5734eb.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e5734eb.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e5734eb.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e578983 e575023.exe File created C:\Windows\e5735d5 e5734eb.exe File opened for modification C:\Windows\SYSTEM.INI e5734eb.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3152 e5734eb.exe 3152 e5734eb.exe 3152 e5734eb.exe 3152 e5734eb.exe 428 e575023.exe 428 e575023.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe Token: SeDebugPrivilege 3152 e5734eb.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1760 wrote to memory of 4640 1760 rundll32.exe 87 PID 1760 wrote to memory of 4640 1760 rundll32.exe 87 PID 1760 wrote to memory of 4640 1760 rundll32.exe 87 PID 4640 wrote to memory of 3152 4640 rundll32.exe 88 PID 4640 wrote to memory of 3152 4640 rundll32.exe 88 PID 4640 wrote to memory of 3152 4640 rundll32.exe 88 PID 3152 wrote to memory of 784 3152 e5734eb.exe 8 PID 3152 wrote to memory of 792 3152 e5734eb.exe 9 PID 3152 wrote to memory of 380 3152 e5734eb.exe 13 PID 3152 wrote to memory of 2880 3152 e5734eb.exe 50 PID 3152 wrote to memory of 3024 3152 e5734eb.exe 52 PID 3152 wrote to memory of 1028 3152 e5734eb.exe 53 PID 3152 wrote to memory of 3428 3152 e5734eb.exe 56 PID 3152 wrote to memory of 3560 3152 e5734eb.exe 57 PID 3152 wrote to memory of 3740 3152 e5734eb.exe 58 PID 3152 wrote to memory of 3828 3152 e5734eb.exe 59 PID 3152 wrote to memory of 3892 3152 e5734eb.exe 60 PID 3152 wrote to memory of 3980 3152 e5734eb.exe 61 PID 3152 wrote to memory of 4084 3152 e5734eb.exe 62 PID 3152 wrote to memory of 3416 3152 e5734eb.exe 74 PID 3152 wrote to memory of 2356 3152 e5734eb.exe 75 PID 3152 wrote to memory of 2684 3152 e5734eb.exe 82 PID 3152 wrote to memory of 3476 3152 e5734eb.exe 83 PID 3152 wrote to memory of 2320 3152 e5734eb.exe 84 PID 3152 wrote to memory of 1760 3152 e5734eb.exe 85 PID 3152 wrote to memory of 4640 3152 e5734eb.exe 87 PID 3152 wrote to memory of 4640 3152 e5734eb.exe 87 PID 4640 wrote to memory of 4872 4640 rundll32.exe 89 PID 4640 wrote to memory of 4872 4640 rundll32.exe 89 PID 4640 wrote to memory of 4872 4640 rundll32.exe 89 PID 4640 wrote to memory of 428 4640 rundll32.exe 98 PID 4640 wrote to memory of 428 4640 rundll32.exe 98 PID 4640 wrote to memory of 428 4640 rundll32.exe 98 PID 3152 wrote to memory of 784 3152 e5734eb.exe 8 PID 3152 wrote to memory of 792 3152 e5734eb.exe 9 PID 3152 wrote to memory of 380 3152 e5734eb.exe 13 PID 3152 wrote to memory of 2880 3152 e5734eb.exe 50 PID 3152 wrote to memory of 3024 3152 e5734eb.exe 52 PID 3152 wrote to memory of 1028 3152 e5734eb.exe 53 PID 3152 wrote to memory of 3428 3152 e5734eb.exe 56 PID 3152 wrote to memory of 3560 3152 e5734eb.exe 57 PID 3152 wrote to memory of 3740 3152 e5734eb.exe 58 PID 3152 wrote to memory of 3828 3152 e5734eb.exe 59 PID 3152 wrote to memory of 3892 3152 e5734eb.exe 60 PID 3152 wrote to memory of 3980 3152 e5734eb.exe 61 PID 3152 wrote to memory of 4084 3152 e5734eb.exe 62 PID 3152 wrote to memory of 3416 3152 e5734eb.exe 74 PID 3152 wrote to memory of 2356 3152 e5734eb.exe 75 PID 3152 wrote to memory of 2684 3152 e5734eb.exe 82 PID 3152 wrote to memory of 3476 3152 e5734eb.exe 83 PID 3152 wrote to memory of 4872 3152 e5734eb.exe 89 PID 3152 wrote to memory of 4872 3152 e5734eb.exe 89 PID 3152 wrote to memory of 1044 3152 e5734eb.exe 91 PID 3152 wrote to memory of 2640 3152 e5734eb.exe 92 PID 3152 wrote to memory of 428 3152 e5734eb.exe 98 PID 3152 wrote to memory of 428 3152 e5734eb.exe 98 PID 428 wrote to memory of 784 428 e575023.exe 8 PID 428 wrote to memory of 792 428 e575023.exe 9 PID 428 wrote to memory of 380 428 e575023.exe 13 PID 428 wrote to memory of 2880 428 e575023.exe 50 PID 428 wrote to memory of 3024 428 e575023.exe 52 PID 428 wrote to memory of 1028 428 e575023.exe 53 PID 428 wrote to memory of 3428 428 e575023.exe 56 PID 428 wrote to memory of 3560 428 e575023.exe 57 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5734eb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e575023.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:792
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:380
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2880
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:3024
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:1028
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3428
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ed47a7259f70784e00ff48126913d63927e7963898813e20009dcc3ce1355c8b.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ed47a7259f70784e00ff48126913d63927e7963898813e20009dcc3ce1355c8b.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\e5734eb.exeC:\Users\Admin\AppData\Local\Temp\e5734eb.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3152
-
-
C:\Users\Admin\AppData\Local\Temp\e5738b3.exeC:\Users\Admin\AppData\Local\Temp\e5738b3.exe4⤵
- Executes dropped EXE
PID:4872
-
-
C:\Users\Admin\AppData\Local\Temp\e575023.exeC:\Users\Admin\AppData\Local\Temp\e575023.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:428
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3560
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3740
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3828
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3892
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3980
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4084
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:3416
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2356
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca1⤵PID:2684
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:3476
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:2320
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1044
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2640
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\e5734eb.exe
- Size 97KB
- SHA256 a811dc32008f60fe50d589d0a02c17176a5e09deae634b5799174588037fca75
- MD5 4226d170feb9a9bee78a091944736ee7
- SHA1 31f0f6c8df0c7a2f28ff702d937243d1f436a975
- SHA512 f10087acc95ccf8db63756dedec8acd5d96cd68a7b0d45cce4658013507d581264751a466bd98be995fa8b6884488407c02a4e6e0a4607c5ea130817e9cd80b7
- SSDEEP 1536:kylJq5+bVSFnj2qZGdTl+wBMzxMRDeZEuf6Nql:k0q5+bVSAqgJ+wKzCRDeuX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SYSTEM.INI
- Size 257B
- SHA256 e3a264f08221ef86f291a192b813a9c2f32412edbb824a255cb42c8c514a8f03
- MD5 cde622691dec08180cf7e18fa30cbeac
- SHA1 876d837cc538265ad0bbc797bd508ef6222a2d4a
- SHA512 76bbe8ef9cbdfc51b8304bbdce196d60fc8f96f7f03bd8abf5e3ba1a0377a028b4cf1b56c1954532815b7bb29912c720f9ad287270cc973a78abf1def447f068
- MD5 SHA1 SHA512