Analysis
-
max time kernel
92s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29-03-2024 23:01
Static task
static1
Behavioral task
behavioral1
Sample
880e5a11c5dc597bef079d42bb3d7ee054ee236c213cdb996306f561bae455bc.dll
Resource
win7-20240221-en
General
-
Target
880e5a11c5dc597bef079d42bb3d7ee054ee236c213cdb996306f561bae455bc.dll
-
Size
120KB
-
MD5
8d6eb02480c0ba49c2b32b6d0c05ffd1
-
SHA1
1b4bcb418e9703e17f79d6eae12825c07c3fc47b
-
SHA256
880e5a11c5dc597bef079d42bb3d7ee054ee236c213cdb996306f561bae455bc
-
SHA512
30d7f68161374e070d58c6d139ba92f00a9b260da9bc443029c8d0c7a1439f8652f857787a29fe69cf11f85147ed9d63980e9461d1bcf85b52cee349b57b4697
-
SSDEEP
3072:92InALuPiyh0gx8Wopx11lBz87OTreeT39:znALuPirzy7Onh
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
e574304.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e574304.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e574304.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e574304.exe -
Processes:
e574304.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e574304.exe -
Processes:
e574304.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e574304.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e574304.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e574304.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e574304.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e574304.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e574304.exe -
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 29 IoCs
Processes:
resource yara_rule behavioral2/memory/1616-7-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-9-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-10-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-15-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-24-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-31-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-32-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-33-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-34-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-35-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-36-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-37-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-38-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-39-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-40-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-42-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-51-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-52-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-54-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-57-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-66-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-70-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-73-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-75-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-77-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-79-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-81-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-83-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-86-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine -
UPX dump on OEP (original entry point) 35 IoCs
Processes:
resource yara_rule behavioral2/memory/1616-5-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/1616-7-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1616-9-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1616-10-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/4952-23-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/1616-15-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1616-24-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1616-31-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1616-32-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1616-33-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1616-34-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1616-35-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1616-36-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1616-37-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1616-38-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1616-39-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1616-40-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1616-42-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/3428-50-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/1616-51-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1616-52-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1616-54-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1616-57-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1616-66-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1616-70-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1616-73-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1616-75-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1616-77-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1616-79-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1616-81-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1616-83-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1616-86-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1616-104-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4952-107-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/3428-111-0x0000000000400000-0x0000000000412000-memory.dmp UPX -
Executes dropped EXE 3 IoCs
Processes:
e574304.exee574508.exee575e7b.exepid process 1616 e574304.exe 4952 e574508.exe 3428 e575e7b.exe -
Processes:
resource yara_rule behavioral2/memory/1616-7-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1616-9-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1616-10-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1616-15-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1616-24-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1616-31-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1616-32-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1616-33-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1616-34-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1616-35-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1616-36-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1616-37-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1616-38-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1616-39-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1616-40-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1616-42-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1616-51-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1616-52-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1616-54-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1616-57-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1616-66-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1616-70-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1616-73-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1616-75-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1616-77-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1616-79-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1616-81-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1616-83-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1616-86-0x00000000007C0000-0x000000000187A000-memory.dmp upx -
Processes:
e574304.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e574304.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e574304.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e574304.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e574304.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e574304.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e574304.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e574304.exe -
Processes:
e574304.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e574304.exe -
Enumerates connected drives 3 TTPs 13 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
e574304.exedescription ioc process File opened (read-only) \??\E: e574304.exe File opened (read-only) \??\M: e574304.exe File opened (read-only) \??\L: e574304.exe File opened (read-only) \??\P: e574304.exe File opened (read-only) \??\R: e574304.exe File opened (read-only) \??\G: e574304.exe File opened (read-only) \??\H: e574304.exe File opened (read-only) \??\J: e574304.exe File opened (read-only) \??\K: e574304.exe File opened (read-only) \??\O: e574304.exe File opened (read-only) \??\I: e574304.exe File opened (read-only) \??\N: e574304.exe File opened (read-only) \??\Q: e574304.exe -
Drops file in Program Files directory 3 IoCs
Processes:
e574304.exedescription ioc process File opened for modification C:\Program Files\7-Zip\7z.exe e574304.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e574304.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e574304.exe -
Drops file in Windows directory 2 IoCs
Processes:
e574304.exedescription ioc process File created C:\Windows\e5743df e574304.exe File opened for modification C:\Windows\SYSTEM.INI e574304.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
e574304.exepid process 1616 e574304.exe 1616 e574304.exe 1616 e574304.exe 1616 e574304.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
e574304.exedescription pid process Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe Token: SeDebugPrivilege 1616 e574304.exe -
Suspicious use of WriteProcessMemory 49 IoCs
Processes:
rundll32.exerundll32.exee574304.exedescription pid process target process PID 2816 wrote to memory of 3928 2816 rundll32.exe rundll32.exe PID 2816 wrote to memory of 3928 2816 rundll32.exe rundll32.exe PID 2816 wrote to memory of 3928 2816 rundll32.exe rundll32.exe PID 3928 wrote to memory of 1616 3928 rundll32.exe e574304.exe PID 3928 wrote to memory of 1616 3928 rundll32.exe e574304.exe PID 3928 wrote to memory of 1616 3928 rundll32.exe e574304.exe PID 1616 wrote to memory of 760 1616 e574304.exe fontdrvhost.exe PID 1616 wrote to memory of 768 1616 e574304.exe fontdrvhost.exe PID 1616 wrote to memory of 332 1616 e574304.exe dwm.exe PID 1616 wrote to memory of 2808 1616 e574304.exe sihost.exe PID 1616 wrote to memory of 2856 1616 e574304.exe svchost.exe PID 1616 wrote to memory of 3024 1616 e574304.exe taskhostw.exe PID 1616 wrote to memory of 3492 1616 e574304.exe Explorer.EXE PID 1616 wrote to memory of 3608 1616 e574304.exe svchost.exe PID 1616 wrote to memory of 3800 1616 e574304.exe DllHost.exe PID 1616 wrote to memory of 3892 1616 e574304.exe StartMenuExperienceHost.exe PID 1616 wrote to memory of 3960 1616 e574304.exe RuntimeBroker.exe PID 1616 wrote to memory of 4040 1616 e574304.exe SearchApp.exe PID 1616 wrote to memory of 4172 1616 e574304.exe RuntimeBroker.exe PID 1616 wrote to memory of 1612 1616 e574304.exe TextInputHost.exe PID 1616 wrote to memory of 2292 1616 e574304.exe RuntimeBroker.exe PID 1616 wrote to memory of 2816 1616 e574304.exe rundll32.exe PID 1616 wrote to memory of 3928 1616 e574304.exe rundll32.exe PID 1616 wrote to memory of 3928 1616 e574304.exe rundll32.exe PID 3928 wrote to memory of 4952 3928 rundll32.exe e574508.exe PID 3928 wrote to memory of 4952 3928 rundll32.exe e574508.exe PID 3928 wrote to memory of 4952 3928 rundll32.exe e574508.exe PID 3928 wrote to memory of 3428 3928 rundll32.exe e575e7b.exe PID 3928 wrote to memory of 3428 3928 rundll32.exe e575e7b.exe PID 3928 wrote to memory of 3428 3928 rundll32.exe e575e7b.exe PID 1616 wrote to memory of 760 1616 e574304.exe fontdrvhost.exe PID 1616 wrote to memory of 768 1616 e574304.exe fontdrvhost.exe PID 1616 wrote to memory of 332 1616 e574304.exe dwm.exe PID 1616 wrote to memory of 2808 1616 e574304.exe sihost.exe PID 1616 wrote to memory of 2856 1616 e574304.exe svchost.exe PID 1616 wrote to memory of 3024 1616 e574304.exe taskhostw.exe PID 1616 wrote to memory of 3492 1616 e574304.exe Explorer.EXE PID 1616 wrote to memory of 3608 1616 e574304.exe svchost.exe PID 1616 wrote to memory of 3800 1616 e574304.exe DllHost.exe PID 1616 wrote to memory of 3892 1616 e574304.exe StartMenuExperienceHost.exe PID 1616 wrote to memory of 3960 1616 e574304.exe RuntimeBroker.exe PID 1616 wrote to memory of 4040 1616 e574304.exe SearchApp.exe PID 1616 wrote to memory of 4172 1616 e574304.exe RuntimeBroker.exe PID 1616 wrote to memory of 1612 1616 e574304.exe TextInputHost.exe PID 1616 wrote to memory of 2292 1616 e574304.exe RuntimeBroker.exe PID 1616 wrote to memory of 4952 1616 e574304.exe e574508.exe PID 1616 wrote to memory of 4952 1616 e574304.exe e574508.exe PID 1616 wrote to memory of 3428 1616 e574304.exe e575e7b.exe PID 1616 wrote to memory of 3428 1616 e574304.exe e575e7b.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
e574304.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e574304.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:760
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:768
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:332
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2808
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2856
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:3024
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3492
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\880e5a11c5dc597bef079d42bb3d7ee054ee236c213cdb996306f561bae455bc.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\880e5a11c5dc597bef079d42bb3d7ee054ee236c213cdb996306f561bae455bc.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\e574304.exeC:\Users\Admin\AppData\Local\Temp\e574304.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\e574508.exeC:\Users\Admin\AppData\Local\Temp\e574508.exe4⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\e575e7b.exeC:\Users\Admin\AppData\Local\Temp\e575e7b.exe4⤵
- Executes dropped EXE
PID:3428
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3608
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3800
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3892
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3960
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4040
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4172
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:1612
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2292
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\e574304.exeFilesize
97KB
MD55ec91a8e0dbba87def9603f1bfa29ebb
SHA1aa77f7a1026cd73c845096ec2fe3e83f2e7c9149
SHA25654cbfb69918ceb312857e4bcc2a63d0fdc8d0d4cb654702a15d052fed766e8e0
SHA512cc89e922fb43f0aca665a27cc2655dc626fa6d20b6da2e55bc055c7b5ba0a054e6e0f7521f7bf452bad100f92f722ce667630fbedcc225c759ce6220f1aed6b5
-
memory/1616-40-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/1616-36-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/1616-7-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/1616-9-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/1616-10-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/1616-70-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/1616-104-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1616-86-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/1616-83-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/1616-20-0x0000000001AC0000-0x0000000001AC1000-memory.dmpFilesize
4KB
-
memory/1616-22-0x00000000005B0000-0x00000000005B2000-memory.dmpFilesize
8KB
-
memory/1616-75-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/1616-24-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/1616-25-0x00000000005B0000-0x00000000005B2000-memory.dmpFilesize
8KB
-
memory/1616-31-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/1616-32-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/1616-33-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/1616-34-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/1616-35-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/1616-73-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/1616-42-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/1616-38-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/1616-39-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/1616-81-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/1616-37-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/1616-5-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1616-15-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/1616-51-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/1616-52-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/1616-54-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/1616-57-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/1616-79-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/1616-77-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/1616-67-0x00000000005B0000-0x00000000005B2000-memory.dmpFilesize
8KB
-
memory/1616-66-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/3428-65-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/3428-64-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/3428-50-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3428-111-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3928-11-0x00000000008B0000-0x00000000008B2000-memory.dmpFilesize
8KB
-
memory/3928-0-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/3928-12-0x0000000000AF0000-0x0000000000AF1000-memory.dmpFilesize
4KB
-
memory/3928-47-0x00000000008B0000-0x00000000008B2000-memory.dmpFilesize
8KB
-
memory/3928-14-0x00000000008B0000-0x00000000008B2000-memory.dmpFilesize
8KB
-
memory/4952-63-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/4952-60-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/4952-61-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/4952-23-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4952-107-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB