Analysis
-
max time kernel
148s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
26-03-2024 18:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2c1cbc2299e9eba9fc52bbec2e1f315751c348d50d6af75b374b37960d0a9949.dll
Resource
win7-20240221-en
windows7-x64
17 signatures
150 seconds
General
-
Target
2c1cbc2299e9eba9fc52bbec2e1f315751c348d50d6af75b374b37960d0a9949.dll
-
Size
120KB
-
MD5
60f2625393e1a4a7329843c1f1204043
-
SHA1
5a2ae65052953fbb9e455434fdb5b743d8a887b1
-
SHA256
2c1cbc2299e9eba9fc52bbec2e1f315751c348d50d6af75b374b37960d0a9949
-
SHA512
df498d6608416e932d5d1b1b40e7a42b92b8769240b168847bd99ba46ef62de57e480fb41e331620ce28fd73cacbb2714a4cb5eeb9d172197fbf493db2ee1427
-
SSDEEP
3072:A0nzNx81yRFC9b5TuBAj4iLeMDVWI7Jpo5Kei:A0nznXRobwBAj9qMvnoIp
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57664b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57664b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57664b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e578d7b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e578d7b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e578d7b.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57664b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578d7b.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57664b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e578d7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e578d7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e578d7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57664b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57664b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57664b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e578d7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e578d7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57664b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57664b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e578d7b.exe -
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 25 IoCs
resource yara_rule behavioral2/memory/3304-6-0x0000000000830000-0x00000000018EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3304-8-0x0000000000830000-0x00000000018EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3304-17-0x0000000000830000-0x00000000018EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3304-9-0x0000000000830000-0x00000000018EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3304-24-0x0000000000830000-0x00000000018EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3304-30-0x0000000000830000-0x00000000018EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3304-31-0x0000000000830000-0x00000000018EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3304-32-0x0000000000830000-0x00000000018EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3304-33-0x0000000000830000-0x00000000018EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3304-35-0x0000000000830000-0x00000000018EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3304-36-0x0000000000830000-0x00000000018EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3304-37-0x0000000000830000-0x00000000018EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3304-45-0x0000000000830000-0x00000000018EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3304-52-0x0000000000830000-0x00000000018EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3304-56-0x0000000000830000-0x00000000018EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3304-57-0x0000000000830000-0x00000000018EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3304-58-0x0000000000830000-0x00000000018EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3304-62-0x0000000000830000-0x00000000018EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3304-63-0x0000000000830000-0x00000000018EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3304-65-0x0000000000830000-0x00000000018EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4372-89-0x0000000000B30000-0x0000000001BEA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4372-91-0x0000000000B30000-0x0000000001BEA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4372-92-0x0000000000B30000-0x0000000001BEA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4372-93-0x0000000000B30000-0x0000000001BEA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4372-129-0x0000000000B30000-0x0000000001BEA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine -
UPX dump on OEP (original entry point) 29 IoCs
resource yara_rule behavioral2/memory/3304-6-0x0000000000830000-0x00000000018EA000-memory.dmp UPX behavioral2/memory/3304-8-0x0000000000830000-0x00000000018EA000-memory.dmp UPX behavioral2/memory/3304-17-0x0000000000830000-0x00000000018EA000-memory.dmp UPX behavioral2/memory/1648-21-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/3304-9-0x0000000000830000-0x00000000018EA000-memory.dmp UPX behavioral2/memory/3304-24-0x0000000000830000-0x00000000018EA000-memory.dmp UPX behavioral2/memory/3304-30-0x0000000000830000-0x00000000018EA000-memory.dmp UPX behavioral2/memory/3304-31-0x0000000000830000-0x00000000018EA000-memory.dmp UPX behavioral2/memory/3304-32-0x0000000000830000-0x00000000018EA000-memory.dmp UPX behavioral2/memory/3304-33-0x0000000000830000-0x00000000018EA000-memory.dmp UPX behavioral2/memory/3304-35-0x0000000000830000-0x00000000018EA000-memory.dmp UPX behavioral2/memory/3304-36-0x0000000000830000-0x00000000018EA000-memory.dmp UPX behavioral2/memory/3304-37-0x0000000000830000-0x00000000018EA000-memory.dmp UPX behavioral2/memory/3304-45-0x0000000000830000-0x00000000018EA000-memory.dmp UPX behavioral2/memory/3304-52-0x0000000000830000-0x00000000018EA000-memory.dmp UPX behavioral2/memory/3304-56-0x0000000000830000-0x00000000018EA000-memory.dmp UPX behavioral2/memory/3304-57-0x0000000000830000-0x00000000018EA000-memory.dmp UPX behavioral2/memory/3304-58-0x0000000000830000-0x00000000018EA000-memory.dmp UPX behavioral2/memory/3304-62-0x0000000000830000-0x00000000018EA000-memory.dmp UPX behavioral2/memory/3304-63-0x0000000000830000-0x00000000018EA000-memory.dmp UPX behavioral2/memory/3304-65-0x0000000000830000-0x00000000018EA000-memory.dmp UPX behavioral2/memory/3304-87-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/1648-86-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4372-89-0x0000000000B30000-0x0000000001BEA000-memory.dmp UPX behavioral2/memory/4372-91-0x0000000000B30000-0x0000000001BEA000-memory.dmp UPX behavioral2/memory/4372-92-0x0000000000B30000-0x0000000001BEA000-memory.dmp UPX behavioral2/memory/4372-93-0x0000000000B30000-0x0000000001BEA000-memory.dmp UPX behavioral2/memory/4372-129-0x0000000000B30000-0x0000000001BEA000-memory.dmp UPX behavioral2/memory/4372-130-0x0000000000400000-0x0000000000412000-memory.dmp UPX -
Executes dropped EXE 3 IoCs
pid Process 3304 e57664b.exe 1648 e576a33.exe 4372 e578d7b.exe -
resource yara_rule behavioral2/memory/3304-6-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/3304-8-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/3304-17-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/3304-9-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/3304-24-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/3304-30-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/3304-31-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/3304-32-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/3304-33-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/3304-35-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/3304-36-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/3304-37-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/3304-45-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/3304-52-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/3304-56-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/3304-57-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/3304-58-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/3304-62-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/3304-63-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/3304-65-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4372-89-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx behavioral2/memory/4372-91-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx behavioral2/memory/4372-92-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx behavioral2/memory/4372-93-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx behavioral2/memory/4372-129-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57664b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57664b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57664b.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57664b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e578d7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e578d7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e578d7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e578d7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e578d7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57664b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57664b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57664b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e578d7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e578d7b.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57664b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578d7b.exe -
Enumerates connected drives 3 TTPs 6 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: e57664b.exe File opened (read-only) \??\G: e57664b.exe File opened (read-only) \??\H: e57664b.exe File opened (read-only) \??\I: e57664b.exe File opened (read-only) \??\J: e57664b.exe File opened (read-only) \??\E: e578d7b.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e57c1d9 e578d7b.exe File created C:\Windows\e5767f1 e57664b.exe File opened for modification C:\Windows\SYSTEM.INI e57664b.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3304 e57664b.exe 3304 e57664b.exe 3304 e57664b.exe 3304 e57664b.exe 4372 e578d7b.exe 4372 e578d7b.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe Token: SeDebugPrivilege 3304 e57664b.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2484 wrote to memory of 3952 2484 rundll32.exe 88 PID 2484 wrote to memory of 3952 2484 rundll32.exe 88 PID 2484 wrote to memory of 3952 2484 rundll32.exe 88 PID 3952 wrote to memory of 3304 3952 rundll32.exe 89 PID 3952 wrote to memory of 3304 3952 rundll32.exe 89 PID 3952 wrote to memory of 3304 3952 rundll32.exe 89 PID 3304 wrote to memory of 788 3304 e57664b.exe 9 PID 3304 wrote to memory of 796 3304 e57664b.exe 10 PID 3304 wrote to memory of 1012 3304 e57664b.exe 13 PID 3304 wrote to memory of 2444 3304 e57664b.exe 43 PID 3304 wrote to memory of 2472 3304 e57664b.exe 44 PID 3304 wrote to memory of 2600 3304 e57664b.exe 46 PID 3304 wrote to memory of 3488 3304 e57664b.exe 57 PID 3304 wrote to memory of 3664 3304 e57664b.exe 58 PID 3304 wrote to memory of 3848 3304 e57664b.exe 59 PID 3304 wrote to memory of 3988 3304 e57664b.exe 60 PID 3304 wrote to memory of 4064 3304 e57664b.exe 61 PID 3304 wrote to memory of 1472 3304 e57664b.exe 62 PID 3304 wrote to memory of 3928 3304 e57664b.exe 63 PID 3304 wrote to memory of 1408 3304 e57664b.exe 65 PID 3304 wrote to memory of 4448 3304 e57664b.exe 75 PID 3304 wrote to memory of 2644 3304 e57664b.exe 83 PID 3304 wrote to memory of 2744 3304 e57664b.exe 84 PID 3304 wrote to memory of 1812 3304 e57664b.exe 85 PID 3304 wrote to memory of 2484 3304 e57664b.exe 87 PID 3304 wrote to memory of 3952 3304 e57664b.exe 88 PID 3304 wrote to memory of 3952 3304 e57664b.exe 88 PID 3952 wrote to memory of 1648 3952 rundll32.exe 91 PID 3952 wrote to memory of 1648 3952 rundll32.exe 91 PID 3952 wrote to memory of 1648 3952 rundll32.exe 91 PID 3304 wrote to memory of 116 3304 e57664b.exe 90 PID 3952 wrote to memory of 4372 3952 rundll32.exe 94 PID 3952 wrote to memory of 4372 3952 rundll32.exe 94 PID 3952 wrote to memory of 4372 3952 rundll32.exe 94 PID 3304 wrote to memory of 788 3304 e57664b.exe 9 PID 3304 wrote to memory of 796 3304 e57664b.exe 10 PID 3304 wrote to memory of 1012 3304 e57664b.exe 13 PID 3304 wrote to memory of 2444 3304 e57664b.exe 43 PID 3304 wrote to memory of 2472 3304 e57664b.exe 44 PID 3304 wrote to memory of 2600 3304 e57664b.exe 46 PID 3304 wrote to memory of 3488 3304 e57664b.exe 57 PID 3304 wrote to memory of 3664 3304 e57664b.exe 58 PID 3304 wrote to memory of 3848 3304 e57664b.exe 59 PID 3304 wrote to memory of 3988 3304 e57664b.exe 60 PID 3304 wrote to memory of 4064 3304 e57664b.exe 61 PID 3304 wrote to memory of 1472 3304 e57664b.exe 62 PID 3304 wrote to memory of 3928 3304 e57664b.exe 63 PID 3304 wrote to memory of 1408 3304 e57664b.exe 65 PID 3304 wrote to memory of 4448 3304 e57664b.exe 75 PID 3304 wrote to memory of 2644 3304 e57664b.exe 83 PID 3304 wrote to memory of 2744 3304 e57664b.exe 84 PID 3304 wrote to memory of 1812 3304 e57664b.exe 85 PID 3304 wrote to memory of 1648 3304 e57664b.exe 91 PID 3304 wrote to memory of 1648 3304 e57664b.exe 91 PID 3304 wrote to memory of 1668 3304 e57664b.exe 92 PID 3304 wrote to memory of 4904 3304 e57664b.exe 93 PID 3304 wrote to memory of 4372 3304 e57664b.exe 94 PID 3304 wrote to memory of 4372 3304 e57664b.exe 94 PID 4372 wrote to memory of 788 4372 e578d7b.exe 9 PID 4372 wrote to memory of 796 4372 e578d7b.exe 10 PID 4372 wrote to memory of 1012 4372 e578d7b.exe 13 PID 4372 wrote to memory of 2444 4372 e578d7b.exe 43 PID 4372 wrote to memory of 2472 4372 e578d7b.exe 44 PID 4372 wrote to memory of 2600 4372 e578d7b.exe 46 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57664b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578d7b.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:796
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1012
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2444
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2472
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2600
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3488
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2c1cbc2299e9eba9fc52bbec2e1f315751c348d50d6af75b374b37960d0a9949.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2c1cbc2299e9eba9fc52bbec2e1f315751c348d50d6af75b374b37960d0a9949.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\e57664b.exeC:\Users\Admin\AppData\Local\Temp\e57664b.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3304
-
-
C:\Users\Admin\AppData\Local\Temp\e576a33.exeC:\Users\Admin\AppData\Local\Temp\e576a33.exe4⤵
- Executes dropped EXE
PID:1648
-
-
C:\Users\Admin\AppData\Local\Temp\e578d7b.exeC:\Users\Admin\AppData\Local\Temp\e578d7b.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4372
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3664
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3848
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3988
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4064
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1472
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3928
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1408
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4448
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca1⤵PID:2644
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:2744
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:1812
-
C:\Windows\system32\BackgroundTaskHost.exe"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider1⤵PID:116
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1668
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4904
-
C:\Windows\System32\wuapihost.exeC:\Windows\System32\wuapihost.exe -Embedding1⤵PID:4508
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD57fc7c903f6bc99dd3cfae2d4f1aadfaa
SHA17e618042b3f3cc6feba8a4dac52e1d64e344421e
SHA25616899bc2b3fdbc34a099b766236d6330c5818331c16d00f0501658503fe5ce6d
SHA512e4fb36538cd0a2ee1798975320fa907cee538991a25dc73ad61e841731d8b950628995b97a8ce05b77eb815f80045de1429cebfcd63f4b30ccc421822a429fc9
-
Filesize
257B
MD53071b3c7706d1b582e5d1c35cebbb5ee
SHA1dfd8b51e9c62e67e871336aa4edb432257c444f5
SHA256d9b48eba084d90cdd999b98c9ac6b325c161acc224026ee0802051d32ede41e8
SHA512043f60405c4a052f02ae7c5cf3ee122eb4d65b618670de64716ca6d15b7c2ce4bb612627b7cd3c10b9198766b2cbc3fd3abaa40a960f4f50fd8b1b944c753dc5