Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
30-03-2024 23:58
Static task
static1
Behavioral task
behavioral1
Sample
e66bc3f14f66331f4a5026ddea4e5ec2b7659bb8dc2a297481e5601c3e3469c2.dll
Resource
win7-20240221-en
General
-
Target
e66bc3f14f66331f4a5026ddea4e5ec2b7659bb8dc2a297481e5601c3e3469c2.dll
-
Size
120KB
-
MD5
62e2fe16d0d00991068df89c75f9d3c4
-
SHA1
472b9d4a9506ddb68250b80a3cbd4bf805e012e6
-
SHA256
e66bc3f14f66331f4a5026ddea4e5ec2b7659bb8dc2a297481e5601c3e3469c2
-
SHA512
d448b41fcb8b88722ceba820fd4bc7b798e765f5dab152a4506c7c6d04b1bbc852df3a6d7050a1a8186d17ff071013e5d1fc1c5127b090e3f68be2e9a7a2c700
-
SSDEEP
1536:Yhn9R1VhXm4FD2L8ttmZP/71/xyFIeXS0eyjsqxwgWMtj6bpsRWsuKtDa/BCfLPc:YV1HWXAttml71aI2huSutsR3uKtDaZ+
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
e5734ac.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e5734ac.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e5734ac.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e5734ac.exe -
Processes:
e5734ac.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5734ac.exe -
Processes:
e5734ac.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5734ac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5734ac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5734ac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5734ac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5734ac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5734ac.exe -
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 29 IoCs
Processes:
resource yara_rule behavioral2/memory/60-6-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/60-8-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/60-9-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/60-11-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/60-17-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/60-28-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/60-29-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/60-30-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/60-31-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/60-32-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/60-33-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/60-34-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/60-35-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/60-36-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/60-37-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/60-39-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/60-48-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/60-49-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/60-51-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/60-54-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/60-63-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/60-67-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/60-70-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/60-72-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/60-74-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/60-82-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/60-84-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/60-86-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/60-93-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine -
UPX dump on OEP (original entry point) 33 IoCs
Processes:
resource yara_rule behavioral2/memory/60-6-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/60-8-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/60-9-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/60-11-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/60-17-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/60-28-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/60-29-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/392-20-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/60-30-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/60-31-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/60-32-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/60-33-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/60-34-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/60-35-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/60-36-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/60-37-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/60-39-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/60-48-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/60-49-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/60-51-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/60-54-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/60-63-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/60-67-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/60-70-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/60-72-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/60-74-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/60-82-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/60-84-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/60-86-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/60-93-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/60-107-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/392-110-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/2448-114-0x0000000000400000-0x0000000000412000-memory.dmp UPX -
Executes dropped EXE 3 IoCs
Processes:
e5734ac.exee5736cf.exee575033.exepid process 60 e5734ac.exe 392 e5736cf.exe 2448 e575033.exe -
Processes:
resource yara_rule behavioral2/memory/60-6-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/60-8-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/60-9-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/60-11-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/60-17-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/60-28-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/60-29-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/60-30-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/60-31-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/60-32-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/60-33-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/60-34-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/60-35-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/60-36-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/60-37-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/60-39-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/60-48-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/60-49-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/60-51-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/60-54-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/60-63-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/60-67-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/60-70-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/60-72-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/60-74-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/60-82-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/60-84-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/60-86-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/60-93-0x00000000007A0000-0x000000000185A000-memory.dmp upx -
Processes:
e5734ac.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5734ac.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e5734ac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5734ac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5734ac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5734ac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5734ac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5734ac.exe -
Processes:
e5734ac.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5734ac.exe -
Enumerates connected drives 3 TTPs 13 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
e5734ac.exedescription ioc process File opened (read-only) \??\Q: e5734ac.exe File opened (read-only) \??\G: e5734ac.exe File opened (read-only) \??\K: e5734ac.exe File opened (read-only) \??\M: e5734ac.exe File opened (read-only) \??\H: e5734ac.exe File opened (read-only) \??\N: e5734ac.exe File opened (read-only) \??\P: e5734ac.exe File opened (read-only) \??\E: e5734ac.exe File opened (read-only) \??\I: e5734ac.exe File opened (read-only) \??\R: e5734ac.exe File opened (read-only) \??\J: e5734ac.exe File opened (read-only) \??\L: e5734ac.exe File opened (read-only) \??\O: e5734ac.exe -
Drops file in Program Files directory 3 IoCs
Processes:
e5734ac.exedescription ioc process File opened for modification C:\Program Files\7-Zip\7z.exe e5734ac.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e5734ac.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e5734ac.exe -
Drops file in Windows directory 2 IoCs
Processes:
e5734ac.exedescription ioc process File created C:\Windows\e573577 e5734ac.exe File opened for modification C:\Windows\SYSTEM.INI e5734ac.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
e5734ac.exepid process 60 e5734ac.exe 60 e5734ac.exe 60 e5734ac.exe 60 e5734ac.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
e5734ac.exedescription pid process Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe Token: SeDebugPrivilege 60 e5734ac.exe -
Suspicious use of WriteProcessMemory 52 IoCs
Processes:
rundll32.exerundll32.exee5734ac.exedescription pid process target process PID 2524 wrote to memory of 1088 2524 rundll32.exe rundll32.exe PID 2524 wrote to memory of 1088 2524 rundll32.exe rundll32.exe PID 2524 wrote to memory of 1088 2524 rundll32.exe rundll32.exe PID 1088 wrote to memory of 60 1088 rundll32.exe e5734ac.exe PID 1088 wrote to memory of 60 1088 rundll32.exe e5734ac.exe PID 1088 wrote to memory of 60 1088 rundll32.exe e5734ac.exe PID 60 wrote to memory of 764 60 e5734ac.exe fontdrvhost.exe PID 60 wrote to memory of 768 60 e5734ac.exe fontdrvhost.exe PID 60 wrote to memory of 68 60 e5734ac.exe dwm.exe PID 60 wrote to memory of 2992 60 e5734ac.exe sihost.exe PID 60 wrote to memory of 3056 60 e5734ac.exe svchost.exe PID 60 wrote to memory of 748 60 e5734ac.exe taskhostw.exe PID 60 wrote to memory of 3444 60 e5734ac.exe Explorer.EXE PID 60 wrote to memory of 3580 60 e5734ac.exe svchost.exe PID 60 wrote to memory of 3764 60 e5734ac.exe DllHost.exe PID 60 wrote to memory of 3856 60 e5734ac.exe StartMenuExperienceHost.exe PID 60 wrote to memory of 3920 60 e5734ac.exe RuntimeBroker.exe PID 60 wrote to memory of 4016 60 e5734ac.exe SearchApp.exe PID 60 wrote to memory of 2356 60 e5734ac.exe RuntimeBroker.exe PID 60 wrote to memory of 744 60 e5734ac.exe TextInputHost.exe PID 60 wrote to memory of 2428 60 e5734ac.exe RuntimeBroker.exe PID 60 wrote to memory of 2400 60 e5734ac.exe backgroundTaskHost.exe PID 60 wrote to memory of 2524 60 e5734ac.exe rundll32.exe PID 60 wrote to memory of 1088 60 e5734ac.exe rundll32.exe PID 60 wrote to memory of 1088 60 e5734ac.exe rundll32.exe PID 1088 wrote to memory of 392 1088 rundll32.exe e5736cf.exe PID 1088 wrote to memory of 392 1088 rundll32.exe e5736cf.exe PID 1088 wrote to memory of 392 1088 rundll32.exe e5736cf.exe PID 1088 wrote to memory of 2448 1088 rundll32.exe e575033.exe PID 1088 wrote to memory of 2448 1088 rundll32.exe e575033.exe PID 1088 wrote to memory of 2448 1088 rundll32.exe e575033.exe PID 60 wrote to memory of 764 60 e5734ac.exe fontdrvhost.exe PID 60 wrote to memory of 768 60 e5734ac.exe fontdrvhost.exe PID 60 wrote to memory of 68 60 e5734ac.exe dwm.exe PID 60 wrote to memory of 2992 60 e5734ac.exe sihost.exe PID 60 wrote to memory of 3056 60 e5734ac.exe svchost.exe PID 60 wrote to memory of 748 60 e5734ac.exe taskhostw.exe PID 60 wrote to memory of 3444 60 e5734ac.exe Explorer.EXE PID 60 wrote to memory of 3580 60 e5734ac.exe svchost.exe PID 60 wrote to memory of 3764 60 e5734ac.exe DllHost.exe PID 60 wrote to memory of 3856 60 e5734ac.exe StartMenuExperienceHost.exe PID 60 wrote to memory of 3920 60 e5734ac.exe RuntimeBroker.exe PID 60 wrote to memory of 4016 60 e5734ac.exe SearchApp.exe PID 60 wrote to memory of 2356 60 e5734ac.exe RuntimeBroker.exe PID 60 wrote to memory of 744 60 e5734ac.exe TextInputHost.exe PID 60 wrote to memory of 2428 60 e5734ac.exe RuntimeBroker.exe PID 60 wrote to memory of 392 60 e5734ac.exe e5736cf.exe PID 60 wrote to memory of 392 60 e5734ac.exe e5736cf.exe PID 60 wrote to memory of 3880 60 e5734ac.exe RuntimeBroker.exe PID 60 wrote to memory of 4196 60 e5734ac.exe RuntimeBroker.exe PID 60 wrote to memory of 2448 60 e5734ac.exe e575033.exe PID 60 wrote to memory of 2448 60 e5734ac.exe e575033.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
e5734ac.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5734ac.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e66bc3f14f66331f4a5026ddea4e5ec2b7659bb8dc2a297481e5601c3e3469c2.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e66bc3f14f66331f4a5026ddea4e5ec2b7659bb8dc2a297481e5601c3e3469c2.dll,#13⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e5734ac.exeC:\Users\Admin\AppData\Local\Temp\e5734ac.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\e5736cf.exeC:\Users\Admin\AppData\Local\Temp\e5736cf.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\e575033.exeC:\Users\Admin\AppData\Local\Temp\e575033.exe4⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\e5734ac.exeFilesize
97KB
MD52b10147a33a013104055722cec0823ae
SHA1d89b6e5ef2fee44d32c4a3f0e8b65652c09e5507
SHA25615f136582dab071793468d0ff1daeb49fbb71518c09fd2ce8a3e75486422432d
SHA51268ee3e2867673d5774ca41048a09d9ced593dc5d569d06eb1ffbaaf818e7c7b349dd8c47847884c504fb8efbabd949e3d5c144078c4e46cbbb06c86ea5ec2e5f
-
memory/60-39-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/60-63-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/60-6-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/60-8-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/60-9-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/60-107-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/60-11-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/60-17-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/60-27-0x0000000001BB0000-0x0000000001BB2000-memory.dmpFilesize
8KB
-
memory/60-28-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/60-26-0x0000000001BC0000-0x0000000001BC1000-memory.dmpFilesize
4KB
-
memory/60-29-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/60-93-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/60-86-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/60-37-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/60-30-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/60-31-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/60-32-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/60-33-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/60-34-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/60-35-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/60-36-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/60-82-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/60-84-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/60-81-0x0000000001BB0000-0x0000000001BB2000-memory.dmpFilesize
8KB
-
memory/60-74-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/60-48-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/60-49-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/60-51-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/60-54-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/60-72-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/60-70-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/60-67-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/60-5-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/392-57-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/392-110-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/392-20-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/392-59-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/1088-12-0x0000000000D50000-0x0000000000D51000-memory.dmpFilesize
4KB
-
memory/1088-10-0x0000000000A80000-0x0000000000A82000-memory.dmpFilesize
8KB
-
memory/1088-45-0x0000000000A80000-0x0000000000A82000-memory.dmpFilesize
8KB
-
memory/1088-1-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/1088-13-0x0000000000A80000-0x0000000000A82000-memory.dmpFilesize
8KB
-
memory/2448-61-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/2448-62-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/2448-44-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2448-64-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/2448-114-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB