Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29-03-2024 04:28
Static task
static1
Behavioral task
behavioral1
Sample
e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe
Resource
win7-20240221-en
General
-
Target
e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe
-
Size
162KB
-
MD5
68d5c13d4255d338325546b94abd4965
-
SHA1
cc96d2fb4ff18a14a95bed50b61be9c6a64c007f
-
SHA256
e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd
-
SHA512
f3723170faa4802a818e1ad51bdb3e2d418bc56b7b73b34e5f1178fb11f49e8df7073900c6b26eb542884bbdb5f5d409298c8fdc6d11ab9875bdc76a4773300f
-
SSDEEP
3072:ewehu9aakInFGILeYpoj8qMnaz32GCTEEBrm:eVhuUI8k2jGvoEBS
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe -
Processes:
e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe -
Processes:
e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe -
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 37 IoCs
Processes:
resource yara_rule behavioral1/memory/2208-1-0x0000000001D80000-0x0000000002E3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2208-4-0x0000000001D80000-0x0000000002E3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2208-5-0x0000000001D80000-0x0000000002E3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2208-7-0x0000000001D80000-0x0000000002E3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2208-9-0x0000000001D80000-0x0000000002E3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2208-12-0x0000000001D80000-0x0000000002E3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2208-14-0x0000000001D80000-0x0000000002E3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2208-18-0x0000000001D80000-0x0000000002E3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2208-30-0x0000000001D80000-0x0000000002E3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2208-25-0x0000000001D80000-0x0000000002E3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2208-33-0x0000000001D80000-0x0000000002E3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2208-34-0x0000000001D80000-0x0000000002E3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2208-35-0x0000000001D80000-0x0000000002E3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2208-36-0x0000000001D80000-0x0000000002E3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2208-37-0x0000000001D80000-0x0000000002E3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2208-39-0x0000000001D80000-0x0000000002E3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2208-40-0x0000000001D80000-0x0000000002E3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2208-42-0x0000000001D80000-0x0000000002E3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2208-41-0x0000000001D80000-0x0000000002E3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2208-46-0x0000000001D80000-0x0000000002E3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2208-48-0x0000000001D80000-0x0000000002E3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2208-50-0x0000000001D80000-0x0000000002E3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2208-52-0x0000000001D80000-0x0000000002E3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2208-54-0x0000000001D80000-0x0000000002E3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2208-57-0x0000000001D80000-0x0000000002E3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2208-58-0x0000000001D80000-0x0000000002E3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2208-61-0x0000000001D80000-0x0000000002E3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2208-62-0x0000000001D80000-0x0000000002E3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2208-69-0x0000000001D80000-0x0000000002E3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2208-71-0x0000000001D80000-0x0000000002E3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2208-73-0x0000000001D80000-0x0000000002E3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2208-75-0x0000000001D80000-0x0000000002E3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2208-77-0x0000000001D80000-0x0000000002E3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2208-79-0x0000000001D80000-0x0000000002E3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2208-81-0x0000000001D80000-0x0000000002E3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2208-83-0x0000000001D80000-0x0000000002E3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2208-86-0x0000000001D80000-0x0000000002E3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine -
UPX dump on OEP (original entry point) 37 IoCs
Processes:
resource yara_rule behavioral1/memory/2208-1-0x0000000001D80000-0x0000000002E3A000-memory.dmp UPX behavioral1/memory/2208-4-0x0000000001D80000-0x0000000002E3A000-memory.dmp UPX behavioral1/memory/2208-5-0x0000000001D80000-0x0000000002E3A000-memory.dmp UPX behavioral1/memory/2208-7-0x0000000001D80000-0x0000000002E3A000-memory.dmp UPX behavioral1/memory/2208-9-0x0000000001D80000-0x0000000002E3A000-memory.dmp UPX behavioral1/memory/2208-12-0x0000000001D80000-0x0000000002E3A000-memory.dmp UPX behavioral1/memory/2208-14-0x0000000001D80000-0x0000000002E3A000-memory.dmp UPX behavioral1/memory/2208-18-0x0000000001D80000-0x0000000002E3A000-memory.dmp UPX behavioral1/memory/2208-30-0x0000000001D80000-0x0000000002E3A000-memory.dmp UPX behavioral1/memory/2208-25-0x0000000001D80000-0x0000000002E3A000-memory.dmp UPX behavioral1/memory/2208-33-0x0000000001D80000-0x0000000002E3A000-memory.dmp UPX behavioral1/memory/2208-34-0x0000000001D80000-0x0000000002E3A000-memory.dmp UPX behavioral1/memory/2208-35-0x0000000001D80000-0x0000000002E3A000-memory.dmp UPX behavioral1/memory/2208-36-0x0000000001D80000-0x0000000002E3A000-memory.dmp UPX behavioral1/memory/2208-37-0x0000000001D80000-0x0000000002E3A000-memory.dmp UPX behavioral1/memory/2208-39-0x0000000001D80000-0x0000000002E3A000-memory.dmp UPX behavioral1/memory/2208-40-0x0000000001D80000-0x0000000002E3A000-memory.dmp UPX behavioral1/memory/2208-42-0x0000000001D80000-0x0000000002E3A000-memory.dmp UPX behavioral1/memory/2208-41-0x0000000001D80000-0x0000000002E3A000-memory.dmp UPX behavioral1/memory/2208-46-0x0000000001D80000-0x0000000002E3A000-memory.dmp UPX behavioral1/memory/2208-48-0x0000000001D80000-0x0000000002E3A000-memory.dmp UPX behavioral1/memory/2208-50-0x0000000001D80000-0x0000000002E3A000-memory.dmp UPX behavioral1/memory/2208-52-0x0000000001D80000-0x0000000002E3A000-memory.dmp UPX behavioral1/memory/2208-54-0x0000000001D80000-0x0000000002E3A000-memory.dmp UPX behavioral1/memory/2208-57-0x0000000001D80000-0x0000000002E3A000-memory.dmp UPX behavioral1/memory/2208-58-0x0000000001D80000-0x0000000002E3A000-memory.dmp UPX behavioral1/memory/2208-61-0x0000000001D80000-0x0000000002E3A000-memory.dmp UPX behavioral1/memory/2208-62-0x0000000001D80000-0x0000000002E3A000-memory.dmp UPX behavioral1/memory/2208-69-0x0000000001D80000-0x0000000002E3A000-memory.dmp UPX behavioral1/memory/2208-71-0x0000000001D80000-0x0000000002E3A000-memory.dmp UPX behavioral1/memory/2208-73-0x0000000001D80000-0x0000000002E3A000-memory.dmp UPX behavioral1/memory/2208-75-0x0000000001D80000-0x0000000002E3A000-memory.dmp UPX behavioral1/memory/2208-77-0x0000000001D80000-0x0000000002E3A000-memory.dmp UPX behavioral1/memory/2208-79-0x0000000001D80000-0x0000000002E3A000-memory.dmp UPX behavioral1/memory/2208-81-0x0000000001D80000-0x0000000002E3A000-memory.dmp UPX behavioral1/memory/2208-83-0x0000000001D80000-0x0000000002E3A000-memory.dmp UPX behavioral1/memory/2208-86-0x0000000001D80000-0x0000000002E3A000-memory.dmp UPX -
Processes:
resource yara_rule behavioral1/memory/2208-1-0x0000000001D80000-0x0000000002E3A000-memory.dmp upx behavioral1/memory/2208-4-0x0000000001D80000-0x0000000002E3A000-memory.dmp upx behavioral1/memory/2208-5-0x0000000001D80000-0x0000000002E3A000-memory.dmp upx behavioral1/memory/2208-7-0x0000000001D80000-0x0000000002E3A000-memory.dmp upx behavioral1/memory/2208-9-0x0000000001D80000-0x0000000002E3A000-memory.dmp upx behavioral1/memory/2208-12-0x0000000001D80000-0x0000000002E3A000-memory.dmp upx behavioral1/memory/2208-14-0x0000000001D80000-0x0000000002E3A000-memory.dmp upx behavioral1/memory/2208-18-0x0000000001D80000-0x0000000002E3A000-memory.dmp upx behavioral1/memory/2208-30-0x0000000001D80000-0x0000000002E3A000-memory.dmp upx behavioral1/memory/2208-25-0x0000000001D80000-0x0000000002E3A000-memory.dmp upx behavioral1/memory/2208-33-0x0000000001D80000-0x0000000002E3A000-memory.dmp upx behavioral1/memory/2208-34-0x0000000001D80000-0x0000000002E3A000-memory.dmp upx behavioral1/memory/2208-35-0x0000000001D80000-0x0000000002E3A000-memory.dmp upx behavioral1/memory/2208-36-0x0000000001D80000-0x0000000002E3A000-memory.dmp upx behavioral1/memory/2208-37-0x0000000001D80000-0x0000000002E3A000-memory.dmp upx behavioral1/memory/2208-39-0x0000000001D80000-0x0000000002E3A000-memory.dmp upx behavioral1/memory/2208-40-0x0000000001D80000-0x0000000002E3A000-memory.dmp upx behavioral1/memory/2208-42-0x0000000001D80000-0x0000000002E3A000-memory.dmp upx behavioral1/memory/2208-41-0x0000000001D80000-0x0000000002E3A000-memory.dmp upx behavioral1/memory/2208-46-0x0000000001D80000-0x0000000002E3A000-memory.dmp upx behavioral1/memory/2208-48-0x0000000001D80000-0x0000000002E3A000-memory.dmp upx behavioral1/memory/2208-50-0x0000000001D80000-0x0000000002E3A000-memory.dmp upx behavioral1/memory/2208-52-0x0000000001D80000-0x0000000002E3A000-memory.dmp upx behavioral1/memory/2208-54-0x0000000001D80000-0x0000000002E3A000-memory.dmp upx behavioral1/memory/2208-57-0x0000000001D80000-0x0000000002E3A000-memory.dmp upx behavioral1/memory/2208-58-0x0000000001D80000-0x0000000002E3A000-memory.dmp upx behavioral1/memory/2208-61-0x0000000001D80000-0x0000000002E3A000-memory.dmp upx behavioral1/memory/2208-62-0x0000000001D80000-0x0000000002E3A000-memory.dmp upx behavioral1/memory/2208-69-0x0000000001D80000-0x0000000002E3A000-memory.dmp upx behavioral1/memory/2208-71-0x0000000001D80000-0x0000000002E3A000-memory.dmp upx behavioral1/memory/2208-73-0x0000000001D80000-0x0000000002E3A000-memory.dmp upx behavioral1/memory/2208-75-0x0000000001D80000-0x0000000002E3A000-memory.dmp upx behavioral1/memory/2208-77-0x0000000001D80000-0x0000000002E3A000-memory.dmp upx behavioral1/memory/2208-79-0x0000000001D80000-0x0000000002E3A000-memory.dmp upx behavioral1/memory/2208-81-0x0000000001D80000-0x0000000002E3A000-memory.dmp upx behavioral1/memory/2208-83-0x0000000001D80000-0x0000000002E3A000-memory.dmp upx behavioral1/memory/2208-86-0x0000000001D80000-0x0000000002E3A000-memory.dmp upx -
Processes:
e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe -
Processes:
e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exedescription ioc process File opened (read-only) \??\E: e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe File opened (read-only) \??\I: e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe File opened (read-only) \??\J: e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe File opened (read-only) \??\Q: e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe File opened (read-only) \??\A: e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe File opened (read-only) \??\G: e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe File opened (read-only) \??\L: e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe File opened (read-only) \??\R: e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe File opened (read-only) \??\W: e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe File opened (read-only) \??\X: e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe File opened (read-only) \??\Y: e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe File opened (read-only) \??\B: e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe File opened (read-only) \??\M: e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe File opened (read-only) \??\O: e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe File opened (read-only) \??\P: e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe File opened (read-only) \??\S: e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe File opened (read-only) \??\T: e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe File opened (read-only) \??\H: e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe File opened (read-only) \??\K: e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe File opened (read-only) \??\N: e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe File opened (read-only) \??\U: e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe File opened (read-only) \??\V: e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe File opened (read-only) \??\Z: e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exedescription ioc process File opened for modification C:\autorun.inf e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe File opened for modification F:\autorun.inf e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe -
Drops file in Program Files directory 5 IoCs
Processes:
e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exedescription ioc process File opened for modification C:\Program Files\7-Zip\Uninstall.exe e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe File opened for modification C:\Program Files\7-Zip\7z.exe e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe -
Drops file in Windows directory 2 IoCs
Processes:
e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exedescription ioc process File created C:\Windows\f7615e1 e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe File opened for modification C:\Windows\SYSTEM.INI e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe -
Modifies registry class 18 IoCs
Processes:
explorer.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 200000001a00eebbfe2300001000d09ad3fd8f23af46adb46c85480369c700000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exepid process 2208 e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe -
Suspicious use of AdjustPrivilegeToken 20 IoCs
Processes:
e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exedescription pid process Token: SeDebugPrivilege 2208 e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe Token: SeDebugPrivilege 2208 e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe Token: SeDebugPrivilege 2208 e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe Token: SeDebugPrivilege 2208 e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe Token: SeDebugPrivilege 2208 e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe Token: SeDebugPrivilege 2208 e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe Token: SeDebugPrivilege 2208 e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe Token: SeDebugPrivilege 2208 e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe Token: SeDebugPrivilege 2208 e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe Token: SeDebugPrivilege 2208 e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe Token: SeDebugPrivilege 2208 e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe Token: SeDebugPrivilege 2208 e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe Token: SeDebugPrivilege 2208 e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe Token: SeDebugPrivilege 2208 e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe Token: SeDebugPrivilege 2208 e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe Token: SeDebugPrivilege 2208 e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe Token: SeDebugPrivilege 2208 e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe Token: SeDebugPrivilege 2208 e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe Token: SeDebugPrivilege 2208 e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe Token: SeDebugPrivilege 2208 e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exedescription pid process target process PID 2208 wrote to memory of 1100 2208 e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe explorer.exe PID 2208 wrote to memory of 1100 2208 e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe explorer.exe PID 2208 wrote to memory of 1100 2208 e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe explorer.exe PID 2208 wrote to memory of 1100 2208 e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe explorer.exe PID 2208 wrote to memory of 1120 2208 e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe taskhost.exe PID 2208 wrote to memory of 1164 2208 e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe Dwm.exe PID 2208 wrote to memory of 1200 2208 e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe Explorer.EXE PID 2208 wrote to memory of 1688 2208 e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe DllHost.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe"C:\Users\Admin\AppData\Local\Temp\e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Local\Temp\e8f3acf0323e4a90ac99f6b94830c6e1c48bb40cd4555a05c75e1167fceedadd3⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
6Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\xferbv.exeFilesize
97KB
MD572ab7603f5a86f299bd59a4c902d0baf
SHA1c0712d4d1d169c0f49b477ff45728d60b54f6458
SHA256d3a8cf77294ff087430fd08988658a21905ce5efeefbc4608d51af6522161779
SHA51230df2a31b105ddaa6018d81279f354143ea8812d9190d55877e58c4be8de2cf0eb2572a3f9587f8b4e247a44d447bbea745988418ca3f0cf71362ff67009a915
-
memory/1120-6-0x00000000002D0000-0x00000000002D2000-memory.dmpFilesize
8KB
-
memory/2208-39-0x0000000001D80000-0x0000000002E3A000-memory.dmpFilesize
16.7MB
-
memory/2208-71-0x0000000001D80000-0x0000000002E3A000-memory.dmpFilesize
16.7MB
-
memory/2208-4-0x0000000001D80000-0x0000000002E3A000-memory.dmpFilesize
16.7MB
-
memory/2208-42-0x0000000001D80000-0x0000000002E3A000-memory.dmpFilesize
16.7MB
-
memory/2208-9-0x0000000001D80000-0x0000000002E3A000-memory.dmpFilesize
16.7MB
-
memory/2208-12-0x0000000001D80000-0x0000000002E3A000-memory.dmpFilesize
16.7MB
-
memory/2208-14-0x0000000001D80000-0x0000000002E3A000-memory.dmpFilesize
16.7MB
-
memory/2208-18-0x0000000001D80000-0x0000000002E3A000-memory.dmpFilesize
16.7MB
-
memory/2208-19-0x0000000000300000-0x0000000000302000-memory.dmpFilesize
8KB
-
memory/2208-28-0x0000000000300000-0x0000000000302000-memory.dmpFilesize
8KB
-
memory/2208-30-0x0000000001D80000-0x0000000002E3A000-memory.dmpFilesize
16.7MB
-
memory/2208-25-0x0000000001D80000-0x0000000002E3A000-memory.dmpFilesize
16.7MB
-
memory/2208-26-0x00000000005C0000-0x00000000005C1000-memory.dmpFilesize
4KB
-
memory/2208-1-0x0000000001D80000-0x0000000002E3A000-memory.dmpFilesize
16.7MB
-
memory/2208-41-0x0000000001D80000-0x0000000002E3A000-memory.dmpFilesize
16.7MB
-
memory/2208-33-0x0000000001D80000-0x0000000002E3A000-memory.dmpFilesize
16.7MB
-
memory/2208-34-0x0000000001D80000-0x0000000002E3A000-memory.dmpFilesize
16.7MB
-
memory/2208-46-0x0000000001D80000-0x0000000002E3A000-memory.dmpFilesize
16.7MB
-
memory/2208-36-0x0000000001D80000-0x0000000002E3A000-memory.dmpFilesize
16.7MB
-
memory/2208-37-0x0000000001D80000-0x0000000002E3A000-memory.dmpFilesize
16.7MB
-
memory/2208-0-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/2208-40-0x0000000001D80000-0x0000000002E3A000-memory.dmpFilesize
16.7MB
-
memory/2208-7-0x0000000001D80000-0x0000000002E3A000-memory.dmpFilesize
16.7MB
-
memory/2208-86-0x0000000001D80000-0x0000000002E3A000-memory.dmpFilesize
16.7MB
-
memory/2208-35-0x0000000001D80000-0x0000000002E3A000-memory.dmpFilesize
16.7MB
-
memory/2208-48-0x0000000001D80000-0x0000000002E3A000-memory.dmpFilesize
16.7MB
-
memory/2208-50-0x0000000001D80000-0x0000000002E3A000-memory.dmpFilesize
16.7MB
-
memory/2208-52-0x0000000001D80000-0x0000000002E3A000-memory.dmpFilesize
16.7MB
-
memory/2208-54-0x0000000001D80000-0x0000000002E3A000-memory.dmpFilesize
16.7MB
-
memory/2208-57-0x0000000001D80000-0x0000000002E3A000-memory.dmpFilesize
16.7MB
-
memory/2208-58-0x0000000001D80000-0x0000000002E3A000-memory.dmpFilesize
16.7MB
-
memory/2208-61-0x0000000001D80000-0x0000000002E3A000-memory.dmpFilesize
16.7MB
-
memory/2208-62-0x0000000001D80000-0x0000000002E3A000-memory.dmpFilesize
16.7MB
-
memory/2208-69-0x0000000001D80000-0x0000000002E3A000-memory.dmpFilesize
16.7MB
-
memory/2208-5-0x0000000001D80000-0x0000000002E3A000-memory.dmpFilesize
16.7MB
-
memory/2208-73-0x0000000001D80000-0x0000000002E3A000-memory.dmpFilesize
16.7MB
-
memory/2208-75-0x0000000001D80000-0x0000000002E3A000-memory.dmpFilesize
16.7MB
-
memory/2208-77-0x0000000001D80000-0x0000000002E3A000-memory.dmpFilesize
16.7MB
-
memory/2208-79-0x0000000001D80000-0x0000000002E3A000-memory.dmpFilesize
16.7MB
-
memory/2208-81-0x0000000001D80000-0x0000000002E3A000-memory.dmpFilesize
16.7MB
-
memory/2208-83-0x0000000001D80000-0x0000000002E3A000-memory.dmpFilesize
16.7MB
-
memory/2208-85-0x0000000000300000-0x0000000000302000-memory.dmpFilesize
8KB
-
memory/2884-91-0x0000000003A80000-0x0000000003A81000-memory.dmpFilesize
4KB
-
memory/2884-31-0x0000000003A80000-0x0000000003A81000-memory.dmpFilesize
4KB
-
memory/2884-32-0x0000000003D50000-0x0000000003D60000-memory.dmpFilesize
64KB