Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2024 19:01
Static task
static1
Behavioral task
behavioral1
Sample
07de2e74ad0d4f979e5d40276151d19a11db4a463435650ba85056647037dc34.dll
Resource
win7-20240221-en
General
-
Target
07de2e74ad0d4f979e5d40276151d19a11db4a463435650ba85056647037dc34.dll
-
Size
120KB
-
MD5
5fccba2c81a1ce9e514d6349171c0419
-
SHA1
2c039af667d1766109af6188685a032f579d9dd1
-
SHA256
07de2e74ad0d4f979e5d40276151d19a11db4a463435650ba85056647037dc34
-
SHA512
95625852823c6b503c707dd459e31ea1411299bd6edadf03a665d4aa0ad5c1c2224e2d1b0852cb8e5081ba79dae5655f5859e39a630d58e8c498910f6e386e3b
-
SSDEEP
1536:UKyms0Sp1N71k2O6QVJ+UwcTGzfyc7bQ/+yUwMJ1ofU0GXycSVzJvQ5PLI3:UKMd1N7F8Jtwzc/bHM/ofmXyTVzJwk3
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
e5734ac.exee575033.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e5734ac.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e5734ac.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e5734ac.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e575033.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e575033.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e575033.exe -
Processes:
e575033.exee5734ac.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e575033.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5734ac.exe -
Processes:
e575033.exee5734ac.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e575033.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e575033.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e575033.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5734ac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5734ac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e575033.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5734ac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e575033.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e575033.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5734ac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5734ac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5734ac.exe -
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 32 IoCs
Processes:
resource yara_rule behavioral2/memory/3632-7-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3632-9-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3632-10-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3632-22-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3632-30-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3632-12-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3632-31-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3632-32-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3632-33-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3632-34-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3632-35-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3632-36-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3632-37-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3632-38-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3632-39-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3632-41-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3632-54-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3632-55-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3632-57-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3632-60-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3632-69-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3632-75-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3632-77-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3632-80-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3632-82-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3632-84-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3632-92-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3632-94-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3632-96-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3632-99-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2812-125-0x0000000000B40000-0x0000000001BFA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2812-166-0x0000000000B40000-0x0000000001BFA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine -
UPX dump on OEP (original entry point) 37 IoCs
Processes:
resource yara_rule behavioral2/memory/3632-7-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3632-9-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3632-10-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3632-22-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/1168-21-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/3632-30-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3632-12-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3632-31-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3632-32-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3632-33-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3632-34-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3632-35-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3632-36-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3632-37-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3632-38-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3632-39-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3632-41-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3632-54-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3632-55-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3632-57-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3632-60-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3632-69-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3632-75-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3632-77-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3632-80-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3632-82-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3632-84-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3632-92-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3632-94-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3632-96-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3632-99-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3632-117-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/1168-120-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/2812-125-0x0000000000B40000-0x0000000001BFA000-memory.dmp UPX behavioral2/memory/3360-151-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/2812-166-0x0000000000B40000-0x0000000001BFA000-memory.dmp UPX behavioral2/memory/2812-167-0x0000000000400000-0x0000000000412000-memory.dmp UPX -
Executes dropped EXE 4 IoCs
Processes:
e5734ac.exee5736df.exee575023.exee575033.exepid process 3632 e5734ac.exe 1168 e5736df.exe 3360 e575023.exe 2812 e575033.exe -
Processes:
resource yara_rule behavioral2/memory/3632-7-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3632-9-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3632-10-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3632-22-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3632-30-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3632-12-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3632-31-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3632-32-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3632-33-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3632-34-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3632-35-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3632-36-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3632-37-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3632-38-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3632-39-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3632-41-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3632-54-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3632-55-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3632-57-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3632-60-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3632-69-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3632-75-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3632-77-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3632-80-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3632-82-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3632-84-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3632-92-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3632-94-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3632-96-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3632-99-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/2812-125-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx behavioral2/memory/2812-166-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx -
Processes:
e5734ac.exee575033.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5734ac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e575033.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e575033.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5734ac.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e5734ac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e575033.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5734ac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5734ac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5734ac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e575033.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5734ac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e575033.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e575033.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e575033.exe -
Processes:
e5734ac.exee575033.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5734ac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e575033.exe -
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
e5734ac.exee575033.exedescription ioc process File opened (read-only) \??\E: e5734ac.exe File opened (read-only) \??\H: e5734ac.exe File opened (read-only) \??\Q: e5734ac.exe File opened (read-only) \??\I: e5734ac.exe File opened (read-only) \??\J: e5734ac.exe File opened (read-only) \??\N: e5734ac.exe File opened (read-only) \??\P: e5734ac.exe File opened (read-only) \??\R: e5734ac.exe File opened (read-only) \??\E: e575033.exe File opened (read-only) \??\G: e5734ac.exe File opened (read-only) \??\K: e5734ac.exe File opened (read-only) \??\L: e5734ac.exe File opened (read-only) \??\M: e5734ac.exe File opened (read-only) \??\O: e5734ac.exe -
Drops file in Program Files directory 3 IoCs
Processes:
e5734ac.exedescription ioc process File opened for modification C:\Program Files\7-Zip\7z.exe e5734ac.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e5734ac.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e5734ac.exe -
Drops file in Windows directory 3 IoCs
Processes:
e5734ac.exee575033.exedescription ioc process File created C:\Windows\e573577 e5734ac.exe File opened for modification C:\Windows\SYSTEM.INI e5734ac.exe File created C:\Windows\e57886a e575033.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
e5734ac.exee575033.exepid process 3632 e5734ac.exe 3632 e5734ac.exe 3632 e5734ac.exe 3632 e5734ac.exe 2812 e575033.exe 2812 e575033.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
e5734ac.exedescription pid process Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe Token: SeDebugPrivilege 3632 e5734ac.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
rundll32.exerundll32.exee5734ac.exee575033.exedescription pid process target process PID 1772 wrote to memory of 4716 1772 rundll32.exe rundll32.exe PID 1772 wrote to memory of 4716 1772 rundll32.exe rundll32.exe PID 1772 wrote to memory of 4716 1772 rundll32.exe rundll32.exe PID 4716 wrote to memory of 3632 4716 rundll32.exe e5734ac.exe PID 4716 wrote to memory of 3632 4716 rundll32.exe e5734ac.exe PID 4716 wrote to memory of 3632 4716 rundll32.exe e5734ac.exe PID 3632 wrote to memory of 772 3632 e5734ac.exe fontdrvhost.exe PID 3632 wrote to memory of 776 3632 e5734ac.exe fontdrvhost.exe PID 3632 wrote to memory of 380 3632 e5734ac.exe dwm.exe PID 3632 wrote to memory of 2636 3632 e5734ac.exe sihost.exe PID 3632 wrote to memory of 2700 3632 e5734ac.exe svchost.exe PID 3632 wrote to memory of 2840 3632 e5734ac.exe taskhostw.exe PID 3632 wrote to memory of 3408 3632 e5734ac.exe Explorer.EXE PID 3632 wrote to memory of 3540 3632 e5734ac.exe svchost.exe PID 3632 wrote to memory of 3728 3632 e5734ac.exe DllHost.exe PID 3632 wrote to memory of 3816 3632 e5734ac.exe StartMenuExperienceHost.exe PID 3632 wrote to memory of 3880 3632 e5734ac.exe RuntimeBroker.exe PID 3632 wrote to memory of 3976 3632 e5734ac.exe SearchApp.exe PID 3632 wrote to memory of 428 3632 e5734ac.exe RuntimeBroker.exe PID 3632 wrote to memory of 4720 3632 e5734ac.exe TextInputHost.exe PID 3632 wrote to memory of 3016 3632 e5734ac.exe RuntimeBroker.exe PID 3632 wrote to memory of 4880 3632 e5734ac.exe backgroundTaskHost.exe PID 3632 wrote to memory of 1772 3632 e5734ac.exe rundll32.exe PID 3632 wrote to memory of 4716 3632 e5734ac.exe rundll32.exe PID 3632 wrote to memory of 4716 3632 e5734ac.exe rundll32.exe PID 4716 wrote to memory of 1168 4716 rundll32.exe e5736df.exe PID 4716 wrote to memory of 1168 4716 rundll32.exe e5736df.exe PID 4716 wrote to memory of 1168 4716 rundll32.exe e5736df.exe PID 4716 wrote to memory of 3360 4716 rundll32.exe e575023.exe PID 4716 wrote to memory of 3360 4716 rundll32.exe e575023.exe PID 4716 wrote to memory of 3360 4716 rundll32.exe e575023.exe PID 4716 wrote to memory of 2812 4716 rundll32.exe e575033.exe PID 4716 wrote to memory of 2812 4716 rundll32.exe e575033.exe PID 4716 wrote to memory of 2812 4716 rundll32.exe e575033.exe PID 3632 wrote to memory of 772 3632 e5734ac.exe fontdrvhost.exe PID 3632 wrote to memory of 776 3632 e5734ac.exe fontdrvhost.exe PID 3632 wrote to memory of 380 3632 e5734ac.exe dwm.exe PID 3632 wrote to memory of 2636 3632 e5734ac.exe sihost.exe PID 3632 wrote to memory of 2700 3632 e5734ac.exe svchost.exe PID 3632 wrote to memory of 2840 3632 e5734ac.exe taskhostw.exe PID 3632 wrote to memory of 3408 3632 e5734ac.exe Explorer.EXE PID 3632 wrote to memory of 3540 3632 e5734ac.exe svchost.exe PID 3632 wrote to memory of 3728 3632 e5734ac.exe DllHost.exe PID 3632 wrote to memory of 3816 3632 e5734ac.exe StartMenuExperienceHost.exe PID 3632 wrote to memory of 3880 3632 e5734ac.exe RuntimeBroker.exe PID 3632 wrote to memory of 3976 3632 e5734ac.exe SearchApp.exe PID 3632 wrote to memory of 428 3632 e5734ac.exe RuntimeBroker.exe PID 3632 wrote to memory of 4720 3632 e5734ac.exe TextInputHost.exe PID 3632 wrote to memory of 3016 3632 e5734ac.exe RuntimeBroker.exe PID 3632 wrote to memory of 1168 3632 e5734ac.exe e5736df.exe PID 3632 wrote to memory of 1168 3632 e5734ac.exe e5736df.exe PID 3632 wrote to memory of 2004 3632 e5734ac.exe RuntimeBroker.exe PID 3632 wrote to memory of 2596 3632 e5734ac.exe RuntimeBroker.exe PID 3632 wrote to memory of 3360 3632 e5734ac.exe e575023.exe PID 3632 wrote to memory of 3360 3632 e5734ac.exe e575023.exe PID 3632 wrote to memory of 2812 3632 e5734ac.exe e575033.exe PID 3632 wrote to memory of 2812 3632 e5734ac.exe e575033.exe PID 2812 wrote to memory of 772 2812 e575033.exe fontdrvhost.exe PID 2812 wrote to memory of 776 2812 e575033.exe fontdrvhost.exe PID 2812 wrote to memory of 380 2812 e575033.exe dwm.exe PID 2812 wrote to memory of 2636 2812 e575033.exe sihost.exe PID 2812 wrote to memory of 2700 2812 e575033.exe svchost.exe PID 2812 wrote to memory of 2840 2812 e575033.exe taskhostw.exe PID 2812 wrote to memory of 3408 2812 e575033.exe Explorer.EXE -
System policy modification 1 TTPs 2 IoCs
Processes:
e5734ac.exee575033.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5734ac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e575033.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\07de2e74ad0d4f979e5d40276151d19a11db4a463435650ba85056647037dc34.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\07de2e74ad0d4f979e5d40276151d19a11db4a463435650ba85056647037dc34.dll,#13⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e5734ac.exeC:\Users\Admin\AppData\Local\Temp\e5734ac.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\e5736df.exeC:\Users\Admin\AppData\Local\Temp\e5736df.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\e575023.exeC:\Users\Admin\AppData\Local\Temp\e575023.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\e575033.exeC:\Users\Admin\AppData\Local\Temp\e575033.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\e5734ac.exeFilesize
97KB
MD5e007fed18a7a5215290761cbec220a50
SHA133a39d38863e2b8d1dace6291296c7633e946162
SHA2563555ed1005129c9596056617162df43448612cb4898f997b7f807a7f991387a4
SHA512ccf6a99d0c4f3a2fe7da3d296bbd9008f9eacac1ea661f1c6770d759c30d88adc220566b1d346c7104b49403660d9b21c02c21aaed34e1363e994b84eed845b3
-
C:\Windows\SYSTEM.INIFilesize
257B
MD51198cb2ba83ece3029567581d275b44f
SHA1a8b1fd5fee292484c1ef0a97adddd2dacb318aca
SHA256d5f06f3f37b594ffc02b0684b52da9070930497a5badb19e0240f0ec639699db
SHA51281827218d077be49a3fcb46483aac79a50ee6974c4bf31d7c7b00cddda71a320f15db4cfbc0486a17cffad2500ed1a9b6022c5c381d17b245b4db753b21b16d3
-
memory/1168-63-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/1168-64-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/1168-21-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1168-120-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1168-70-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/2812-72-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/2812-166-0x0000000000B40000-0x0000000001BFA000-memory.dmpFilesize
16.7MB
-
memory/2812-167-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2812-125-0x0000000000B40000-0x0000000001BFA000-memory.dmpFilesize
16.7MB
-
memory/2812-74-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/2812-71-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/3360-151-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3360-73-0x00000000001F0000-0x00000000001F2000-memory.dmpFilesize
8KB
-
memory/3360-67-0x00000000001F0000-0x00000000001F2000-memory.dmpFilesize
8KB
-
memory/3360-48-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3360-66-0x0000000000570000-0x0000000000571000-memory.dmpFilesize
4KB
-
memory/3632-35-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3632-99-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3632-39-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3632-41-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3632-37-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3632-54-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3632-55-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3632-57-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3632-60-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3632-36-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3632-4-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3632-7-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3632-34-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3632-69-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3632-33-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3632-32-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3632-31-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3632-12-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3632-30-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3632-75-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3632-77-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3632-80-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3632-82-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3632-84-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3632-91-0x0000000003520000-0x0000000003522000-memory.dmpFilesize
8KB
-
memory/3632-92-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3632-94-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3632-96-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3632-38-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3632-117-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3632-9-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3632-29-0x0000000003520000-0x0000000003522000-memory.dmpFilesize
8KB
-
memory/3632-22-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3632-23-0x0000000003D30000-0x0000000003D31000-memory.dmpFilesize
4KB
-
memory/3632-10-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/4716-1-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/4716-14-0x0000000004990000-0x0000000004991000-memory.dmpFilesize
4KB
-
memory/4716-13-0x0000000004860000-0x0000000004862000-memory.dmpFilesize
8KB
-
memory/4716-11-0x0000000004860000-0x0000000004862000-memory.dmpFilesize
8KB
-
memory/4716-17-0x0000000004860000-0x0000000004862000-memory.dmpFilesize
8KB