Analysis
-
max time kernel
94s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29-03-2024 20:01
Static task
static1
Behavioral task
behavioral1
Sample
392e90bcb098466f72058fac3413cd559641cbb4a72b9d2dde9867d7c0d12033.dll
Resource
win7-20240215-en
General
-
Target
392e90bcb098466f72058fac3413cd559641cbb4a72b9d2dde9867d7c0d12033.dll
-
Size
120KB
-
MD5
1f36085ce2c80a804bfd3cf99b4492a3
-
SHA1
740b3e28317ab6847e76af8b904a46696097d30e
-
SHA256
392e90bcb098466f72058fac3413cd559641cbb4a72b9d2dde9867d7c0d12033
-
SHA512
c138bb562c02947701a623ffab767a681de8c9b5162442cb6e9e5888b01427ce2870050db2117614206e883ddde2743a4a10abef982c243a40b1f1e6d41a8179
-
SSDEEP
1536:wHILkvILFVLoYOFehsDQlx+j/t3msFyR2YkkxkpDVa9RSy3OUwb0OJNU7B6l3u:+xInL+FeG0lx+jpkR2xc4Q9PNwbAB6l
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
e573af6.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e573af6.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e573af6.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e573af6.exe -
Processes:
e573af6.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e573af6.exe -
Processes:
e573af6.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e573af6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e573af6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e573af6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e573af6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e573af6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e573af6.exe -
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 30 IoCs
Processes:
resource yara_rule behavioral2/memory/4928-6-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4928-8-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4928-9-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4928-11-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4928-21-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4928-29-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4928-30-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4928-31-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4928-32-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4928-33-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4928-34-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4928-35-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4928-36-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4928-37-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4928-38-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4928-40-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4928-54-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4928-55-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4928-57-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4928-60-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4928-74-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4928-76-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4928-79-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4928-81-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4928-83-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4928-85-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4928-87-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4928-89-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4928-96-0x0000000000760000-0x000000000181A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2088-128-0x0000000000B60000-0x0000000001C1A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine -
UPX dump on OEP (original entry point) 36 IoCs
Processes:
resource yara_rule behavioral2/memory/4928-6-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/4928-8-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/4928-9-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/4928-11-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/228-20-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4928-21-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/4928-29-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/4928-30-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/4928-31-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/4928-32-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/4928-33-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/4928-34-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/4928-35-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/4928-36-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/4928-37-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/4928-38-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/4928-40-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/2088-53-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4928-54-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/4928-55-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/4928-57-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/4928-60-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/4928-74-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/4928-76-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/4928-79-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/4928-81-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/4928-83-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/4928-85-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/4928-87-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/4928-89-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/4928-96-0x0000000000760000-0x000000000181A000-memory.dmp UPX behavioral2/memory/4928-117-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/228-118-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/1536-124-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/2088-129-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/2088-128-0x0000000000B60000-0x0000000001C1A000-memory.dmp UPX -
Executes dropped EXE 4 IoCs
Processes:
e573af6.exee573cda.exee57568c.exee57569c.exepid process 4928 e573af6.exe 228 e573cda.exe 1536 e57568c.exe 2088 e57569c.exe -
Processes:
resource yara_rule behavioral2/memory/4928-6-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4928-8-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4928-9-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4928-11-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4928-21-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4928-29-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4928-30-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4928-31-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4928-32-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4928-33-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4928-34-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4928-35-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4928-36-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4928-37-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4928-38-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4928-40-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4928-54-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4928-55-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4928-57-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4928-60-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4928-74-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4928-76-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4928-79-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4928-81-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4928-83-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4928-85-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4928-87-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4928-89-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4928-96-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2088-128-0x0000000000B60000-0x0000000001C1A000-memory.dmp upx -
Processes:
e573af6.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e573af6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e573af6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e573af6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e573af6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e573af6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e573af6.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e573af6.exe -
Processes:
e573af6.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e573af6.exe -
Enumerates connected drives 3 TTPs 13 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
e573af6.exedescription ioc process File opened (read-only) \??\H: e573af6.exe File opened (read-only) \??\M: e573af6.exe File opened (read-only) \??\R: e573af6.exe File opened (read-only) \??\G: e573af6.exe File opened (read-only) \??\L: e573af6.exe File opened (read-only) \??\O: e573af6.exe File opened (read-only) \??\P: e573af6.exe File opened (read-only) \??\I: e573af6.exe File opened (read-only) \??\E: e573af6.exe File opened (read-only) \??\J: e573af6.exe File opened (read-only) \??\K: e573af6.exe File opened (read-only) \??\N: e573af6.exe File opened (read-only) \??\Q: e573af6.exe -
Drops file in Program Files directory 3 IoCs
Processes:
e573af6.exedescription ioc process File opened for modification C:\Program Files\7-Zip\7z.exe e573af6.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e573af6.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e573af6.exe -
Drops file in Windows directory 2 IoCs
Processes:
e573af6.exedescription ioc process File created C:\Windows\e573ba1 e573af6.exe File opened for modification C:\Windows\SYSTEM.INI e573af6.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
e573af6.exepid process 4928 e573af6.exe 4928 e573af6.exe 4928 e573af6.exe 4928 e573af6.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
e573af6.exedescription pid process Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe Token: SeDebugPrivilege 4928 e573af6.exe -
Suspicious use of WriteProcessMemory 57 IoCs
Processes:
rundll32.exerundll32.exee573af6.exedescription pid process target process PID 1516 wrote to memory of 1160 1516 rundll32.exe rundll32.exe PID 1516 wrote to memory of 1160 1516 rundll32.exe rundll32.exe PID 1516 wrote to memory of 1160 1516 rundll32.exe rundll32.exe PID 1160 wrote to memory of 4928 1160 rundll32.exe e573af6.exe PID 1160 wrote to memory of 4928 1160 rundll32.exe e573af6.exe PID 1160 wrote to memory of 4928 1160 rundll32.exe e573af6.exe PID 4928 wrote to memory of 796 4928 e573af6.exe fontdrvhost.exe PID 4928 wrote to memory of 804 4928 e573af6.exe fontdrvhost.exe PID 4928 wrote to memory of 336 4928 e573af6.exe dwm.exe PID 4928 wrote to memory of 2760 4928 e573af6.exe sihost.exe PID 4928 wrote to memory of 2844 4928 e573af6.exe svchost.exe PID 4928 wrote to memory of 3092 4928 e573af6.exe taskhostw.exe PID 4928 wrote to memory of 3588 4928 e573af6.exe Explorer.EXE PID 4928 wrote to memory of 3688 4928 e573af6.exe svchost.exe PID 4928 wrote to memory of 3876 4928 e573af6.exe DllHost.exe PID 4928 wrote to memory of 3964 4928 e573af6.exe StartMenuExperienceHost.exe PID 4928 wrote to memory of 4048 4928 e573af6.exe RuntimeBroker.exe PID 4928 wrote to memory of 740 4928 e573af6.exe SearchApp.exe PID 4928 wrote to memory of 4124 4928 e573af6.exe RuntimeBroker.exe PID 4928 wrote to memory of 840 4928 e573af6.exe TextInputHost.exe PID 4928 wrote to memory of 1488 4928 e573af6.exe RuntimeBroker.exe PID 4928 wrote to memory of 2140 4928 e573af6.exe backgroundTaskHost.exe PID 4928 wrote to memory of 1516 4928 e573af6.exe rundll32.exe PID 4928 wrote to memory of 1160 4928 e573af6.exe rundll32.exe PID 4928 wrote to memory of 1160 4928 e573af6.exe rundll32.exe PID 1160 wrote to memory of 228 1160 rundll32.exe e573cda.exe PID 1160 wrote to memory of 228 1160 rundll32.exe e573cda.exe PID 1160 wrote to memory of 228 1160 rundll32.exe e573cda.exe PID 1160 wrote to memory of 1536 1160 rundll32.exe e57568c.exe PID 1160 wrote to memory of 1536 1160 rundll32.exe e57568c.exe PID 1160 wrote to memory of 1536 1160 rundll32.exe e57568c.exe PID 1160 wrote to memory of 2088 1160 rundll32.exe e57569c.exe PID 1160 wrote to memory of 2088 1160 rundll32.exe e57569c.exe PID 1160 wrote to memory of 2088 1160 rundll32.exe e57569c.exe PID 4928 wrote to memory of 796 4928 e573af6.exe fontdrvhost.exe PID 4928 wrote to memory of 804 4928 e573af6.exe fontdrvhost.exe PID 4928 wrote to memory of 336 4928 e573af6.exe dwm.exe PID 4928 wrote to memory of 2760 4928 e573af6.exe sihost.exe PID 4928 wrote to memory of 2844 4928 e573af6.exe svchost.exe PID 4928 wrote to memory of 3092 4928 e573af6.exe taskhostw.exe PID 4928 wrote to memory of 3588 4928 e573af6.exe Explorer.EXE PID 4928 wrote to memory of 3688 4928 e573af6.exe svchost.exe PID 4928 wrote to memory of 3876 4928 e573af6.exe DllHost.exe PID 4928 wrote to memory of 3964 4928 e573af6.exe StartMenuExperienceHost.exe PID 4928 wrote to memory of 4048 4928 e573af6.exe RuntimeBroker.exe PID 4928 wrote to memory of 740 4928 e573af6.exe SearchApp.exe PID 4928 wrote to memory of 4124 4928 e573af6.exe RuntimeBroker.exe PID 4928 wrote to memory of 840 4928 e573af6.exe TextInputHost.exe PID 4928 wrote to memory of 1488 4928 e573af6.exe RuntimeBroker.exe PID 4928 wrote to memory of 228 4928 e573af6.exe e573cda.exe PID 4928 wrote to memory of 228 4928 e573af6.exe e573cda.exe PID 4928 wrote to memory of 4816 4928 e573af6.exe RuntimeBroker.exe PID 4928 wrote to memory of 2172 4928 e573af6.exe RuntimeBroker.exe PID 4928 wrote to memory of 1536 4928 e573af6.exe e57568c.exe PID 4928 wrote to memory of 1536 4928 e573af6.exe e57568c.exe PID 4928 wrote to memory of 2088 4928 e573af6.exe e57569c.exe PID 4928 wrote to memory of 2088 4928 e573af6.exe e57569c.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
e573af6.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e573af6.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:796
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:804
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:336
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2760
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2844
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:3092
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3588
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\392e90bcb098466f72058fac3413cd559641cbb4a72b9d2dde9867d7c0d12033.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\392e90bcb098466f72058fac3413cd559641cbb4a72b9d2dde9867d7c0d12033.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\e573af6.exeC:\Users\Admin\AppData\Local\Temp\e573af6.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\e573cda.exeC:\Users\Admin\AppData\Local\Temp\e573cda.exe4⤵
- Executes dropped EXE
PID:228 -
C:\Users\Admin\AppData\Local\Temp\e57568c.exeC:\Users\Admin\AppData\Local\Temp\e57568c.exe4⤵
- Executes dropped EXE
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\e57569c.exeC:\Users\Admin\AppData\Local\Temp\e57569c.exe4⤵
- Executes dropped EXE
PID:2088
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3688
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3876
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3964
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4048
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:740
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4124
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:840
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1488
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:2140
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4816
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2172
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\e573af6.exeFilesize
97KB
MD56a1ce240e4d8cf642b1c51db59b3a900
SHA149d911b68395bf55d83f8af03d9d2e2841545dfa
SHA25685cfb56e9ec5d79b7369ebea0ae8eada99a51084b40e86412e94aeba1254e7fa
SHA5125a38ac5c17ad6a35777bc859580c5f08bfe3d161c10d455ea34caabb26b5df2c757206ba571f8c4bf0c04686546ae86abc15bc433a9f2d4d99f0ee151293ab99
-
memory/228-20-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/228-63-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/228-64-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/228-118-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1160-1-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/1160-50-0x0000000004330000-0x0000000004332000-memory.dmpFilesize
8KB
-
memory/1160-10-0x0000000004330000-0x0000000004332000-memory.dmpFilesize
8KB
-
memory/1160-14-0x0000000004330000-0x0000000004332000-memory.dmpFilesize
8KB
-
memory/1160-13-0x0000000004460000-0x0000000004461000-memory.dmpFilesize
4KB
-
memory/1536-119-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/1536-66-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/1536-68-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/1536-67-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/1536-46-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1536-124-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2088-70-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/2088-73-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/2088-71-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/2088-129-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2088-128-0x0000000000B60000-0x0000000001C1A000-memory.dmpFilesize
16.7MB
-
memory/2088-53-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4928-54-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/4928-22-0x0000000003D30000-0x0000000003D31000-memory.dmpFilesize
4KB
-
memory/4928-40-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/4928-37-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/4928-36-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/4928-35-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/4928-34-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/4928-55-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/4928-57-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/4928-60-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/4928-33-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/4928-32-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/4928-31-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/4928-30-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/4928-29-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/4928-21-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/4928-24-0x0000000003520000-0x0000000003522000-memory.dmpFilesize
8KB
-
memory/4928-38-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/4928-72-0x0000000003520000-0x0000000003522000-memory.dmpFilesize
8KB
-
memory/4928-74-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/4928-76-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/4928-79-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/4928-81-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/4928-83-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/4928-85-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/4928-87-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/4928-89-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/4928-96-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/4928-117-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4928-11-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/4928-9-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/4928-8-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/4928-6-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/4928-5-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB