Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
01-04-2024 00:39
Static task
static1
Behavioral task
behavioral1
Sample
a605ad4d50ac8c7cfb262b62b0f464d31932c2dca3089baf8326458f3f2b3e3f.dll
Resource
win7-20240221-en
General
-
Target
a605ad4d50ac8c7cfb262b62b0f464d31932c2dca3089baf8326458f3f2b3e3f.dll
-
Size
120KB
-
MD5
98df6c87b3ef334c55f08d0c2187e82f
-
SHA1
d18c23bb747ea57dfaf2ddd5ad8c14af35511885
-
SHA256
a605ad4d50ac8c7cfb262b62b0f464d31932c2dca3089baf8326458f3f2b3e3f
-
SHA512
7dec6287a088e13f6efc205dd05bbfa3d040b941063923fd0ab1f1223356c489ec92464633566e57005bad59c5a9032718355eeef04ae2221428a01fc5e44158
-
SSDEEP
1536:7moRYwdnRAzUn3PdwzQ2xyLuBlt6h6EIJ+/v4wafgt0i9TgswN9EoZ72/B:7m8Z/n3PdvAy2lW6Ev/LaziJeeT
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
e577c73.exee576179.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e577c73.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e577c73.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e577c73.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e576179.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e576179.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e576179.exe -
Processes:
e576179.exee577c73.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e576179.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e577c73.exe -
Processes:
e576179.exee577c73.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e576179.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e576179.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e576179.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e577c73.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e577c73.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e577c73.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e576179.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e576179.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e577c73.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e577c73.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e577c73.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e576179.exe -
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 26 IoCs
Processes:
resource yara_rule behavioral2/memory/1216-6-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-8-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-9-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-11-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-21-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-30-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-31-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-32-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-33-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-35-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-36-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-37-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-38-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-39-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-49-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-50-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-51-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-60-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-64-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-66-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-68-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-71-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-73-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-75-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4860-103-0x0000000000B30000-0x0000000001BEA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4860-109-0x0000000000B30000-0x0000000001BEA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine -
UPX dump on OEP (original entry point) 32 IoCs
Processes:
resource yara_rule behavioral2/memory/1216-5-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/1216-6-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/1216-8-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/1216-9-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/1216-11-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/3548-22-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/1216-21-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/1216-30-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/1216-31-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/1216-32-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/1216-33-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/1216-35-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/1216-36-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/1216-37-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/1216-38-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/1216-39-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/4860-47-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/1216-49-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/1216-50-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/1216-51-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/1216-60-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/1216-64-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/1216-66-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/1216-68-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/1216-71-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/1216-73-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/1216-75-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/3548-98-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/1216-99-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4860-103-0x0000000000B30000-0x0000000001BEA000-memory.dmp UPX behavioral2/memory/4860-108-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4860-109-0x0000000000B30000-0x0000000001BEA000-memory.dmp UPX -
Executes dropped EXE 3 IoCs
Processes:
e576179.exee576496.exee577c73.exepid process 1216 e576179.exe 3548 e576496.exe 4860 e577c73.exe -
Processes:
resource yara_rule behavioral2/memory/1216-6-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/1216-8-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/1216-9-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/1216-11-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/1216-21-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/1216-30-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/1216-31-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/1216-32-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/1216-33-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/1216-35-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/1216-36-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/1216-37-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/1216-38-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/1216-39-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/1216-49-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/1216-50-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/1216-51-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/1216-60-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/1216-64-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/1216-66-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/1216-68-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/1216-71-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/1216-73-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/1216-75-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/4860-103-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx behavioral2/memory/4860-109-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx -
Processes:
e576179.exee577c73.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e576179.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e576179.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e576179.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e577c73.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e577c73.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e577c73.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e576179.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e576179.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e576179.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e577c73.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e577c73.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e577c73.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e576179.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e577c73.exe -
Processes:
e576179.exee577c73.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e576179.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e577c73.exe -
Enumerates connected drives 3 TTPs 9 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
e576179.exedescription ioc process File opened (read-only) \??\K: e576179.exe File opened (read-only) \??\N: e576179.exe File opened (read-only) \??\E: e576179.exe File opened (read-only) \??\G: e576179.exe File opened (read-only) \??\H: e576179.exe File opened (read-only) \??\J: e576179.exe File opened (read-only) \??\I: e576179.exe File opened (read-only) \??\L: e576179.exe File opened (read-only) \??\M: e576179.exe -
Drops file in Windows directory 3 IoCs
Processes:
e576179.exee577c73.exedescription ioc process File created C:\Windows\e5762f0 e576179.exe File opened for modification C:\Windows\SYSTEM.INI e576179.exe File created C:\Windows\e57cbdb e577c73.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
e576179.exepid process 1216 e576179.exe 1216 e576179.exe 1216 e576179.exe 1216 e576179.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
e576179.exedescription pid process Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe Token: SeDebugPrivilege 1216 e576179.exe -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
rundll32.exerundll32.exee576179.exedescription pid process target process PID 4604 wrote to memory of 1428 4604 rundll32.exe rundll32.exe PID 4604 wrote to memory of 1428 4604 rundll32.exe rundll32.exe PID 4604 wrote to memory of 1428 4604 rundll32.exe rundll32.exe PID 1428 wrote to memory of 1216 1428 rundll32.exe e576179.exe PID 1428 wrote to memory of 1216 1428 rundll32.exe e576179.exe PID 1428 wrote to memory of 1216 1428 rundll32.exe e576179.exe PID 1216 wrote to memory of 792 1216 e576179.exe fontdrvhost.exe PID 1216 wrote to memory of 800 1216 e576179.exe fontdrvhost.exe PID 1216 wrote to memory of 60 1216 e576179.exe dwm.exe PID 1216 wrote to memory of 2528 1216 e576179.exe sihost.exe PID 1216 wrote to memory of 2548 1216 e576179.exe svchost.exe PID 1216 wrote to memory of 2688 1216 e576179.exe taskhostw.exe PID 1216 wrote to memory of 3332 1216 e576179.exe Explorer.EXE PID 1216 wrote to memory of 3652 1216 e576179.exe svchost.exe PID 1216 wrote to memory of 3908 1216 e576179.exe DllHost.exe PID 1216 wrote to memory of 4044 1216 e576179.exe StartMenuExperienceHost.exe PID 1216 wrote to memory of 516 1216 e576179.exe RuntimeBroker.exe PID 1216 wrote to memory of 4108 1216 e576179.exe RuntimeBroker.exe PID 1216 wrote to memory of 4252 1216 e576179.exe RuntimeBroker.exe PID 1216 wrote to memory of 3992 1216 e576179.exe TextInputHost.exe PID 1216 wrote to memory of 1020 1216 e576179.exe backgroundTaskHost.exe PID 1216 wrote to memory of 4604 1216 e576179.exe rundll32.exe PID 1216 wrote to memory of 1428 1216 e576179.exe rundll32.exe PID 1216 wrote to memory of 1428 1216 e576179.exe rundll32.exe PID 1428 wrote to memory of 3548 1428 rundll32.exe e576496.exe PID 1428 wrote to memory of 3548 1428 rundll32.exe e576496.exe PID 1428 wrote to memory of 3548 1428 rundll32.exe e576496.exe PID 1216 wrote to memory of 4420 1216 e576179.exe BackgroundTaskHost.exe PID 1428 wrote to memory of 4860 1428 rundll32.exe e577c73.exe PID 1428 wrote to memory of 4860 1428 rundll32.exe e577c73.exe PID 1428 wrote to memory of 4860 1428 rundll32.exe e577c73.exe PID 1216 wrote to memory of 792 1216 e576179.exe fontdrvhost.exe PID 1216 wrote to memory of 800 1216 e576179.exe fontdrvhost.exe PID 1216 wrote to memory of 60 1216 e576179.exe dwm.exe PID 1216 wrote to memory of 2528 1216 e576179.exe sihost.exe PID 1216 wrote to memory of 2548 1216 e576179.exe svchost.exe PID 1216 wrote to memory of 2688 1216 e576179.exe taskhostw.exe PID 1216 wrote to memory of 3332 1216 e576179.exe Explorer.EXE PID 1216 wrote to memory of 3652 1216 e576179.exe svchost.exe PID 1216 wrote to memory of 3908 1216 e576179.exe DllHost.exe PID 1216 wrote to memory of 4044 1216 e576179.exe StartMenuExperienceHost.exe PID 1216 wrote to memory of 516 1216 e576179.exe RuntimeBroker.exe PID 1216 wrote to memory of 4108 1216 e576179.exe RuntimeBroker.exe PID 1216 wrote to memory of 4252 1216 e576179.exe RuntimeBroker.exe PID 1216 wrote to memory of 3992 1216 e576179.exe TextInputHost.exe PID 1216 wrote to memory of 3548 1216 e576179.exe e576496.exe PID 1216 wrote to memory of 3548 1216 e576179.exe e576496.exe PID 1216 wrote to memory of 2772 1216 e576179.exe RuntimeBroker.exe PID 1216 wrote to memory of 1292 1216 e576179.exe RuntimeBroker.exe PID 1216 wrote to memory of 4860 1216 e576179.exe e577c73.exe PID 1216 wrote to memory of 4860 1216 e576179.exe e577c73.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
e576179.exee577c73.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e576179.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e577c73.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:792
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:800
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:60
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2528
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2548
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2688
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3332
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a605ad4d50ac8c7cfb262b62b0f464d31932c2dca3089baf8326458f3f2b3e3f.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a605ad4d50ac8c7cfb262b62b0f464d31932c2dca3089baf8326458f3f2b3e3f.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\e576179.exeC:\Users\Admin\AppData\Local\Temp\e576179.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\e576496.exeC:\Users\Admin\AppData\Local\Temp\e576496.exe4⤵
- Executes dropped EXE
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\e577c73.exeC:\Users\Admin\AppData\Local\Temp\e577c73.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System policy modification
PID:4860
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3652
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3908
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4044
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:516
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4108
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4252
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:3992
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:1020
-
C:\Windows\system32\BackgroundTaskHost.exe"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider1⤵PID:4420
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2772
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1292
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\e576179.exeFilesize
97KB
MD56b6cf64c21aa1f13d9530dc5755441a2
SHA1addcb046b55814fd394f16cc89eb1ece54d219a3
SHA256d356096650d210cf55f35fc0cc43b6fb82144f32dcb09cfa24417967f52b2d2f
SHA5126d237766b8f0c17d4bd57fd1fc9af073f5875c81be4efe76282c12aaa55d3a7c86f3014b3eb77c664c90ff22062c94e088a89ed7f47dd4f0abb40060fc824a37
-
C:\Windows\SYSTEM.INIFilesize
257B
MD5ee89359470420332643f13c9b1657a72
SHA1cd71fa2c6dd2a2c38576ad4fe6cc9eecfa51a064
SHA25665c2f90272b97fd0a316196d37fee90cdbdd3d61e70f0cb30955949bc49d75ff
SHA512d8fae0e2e5227d664fee88790bf9d24a1225ab28e4dad98dfde1d9b7adb9906ab126d4f47a62c98a8e655c2e5548e9a013ac20a75d5791651247a3366823adc5
-
memory/1216-30-0x0000000000780000-0x000000000183A000-memory.dmpFilesize
16.7MB
-
memory/1216-11-0x0000000000780000-0x000000000183A000-memory.dmpFilesize
16.7MB
-
memory/1216-32-0x0000000000780000-0x000000000183A000-memory.dmpFilesize
16.7MB
-
memory/1216-9-0x0000000000780000-0x000000000183A000-memory.dmpFilesize
16.7MB
-
memory/1216-33-0x0000000000780000-0x000000000183A000-memory.dmpFilesize
16.7MB
-
memory/1216-99-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1216-88-0x0000000000670000-0x0000000000672000-memory.dmpFilesize
8KB
-
memory/1216-20-0x0000000001A80000-0x0000000001A81000-memory.dmpFilesize
4KB
-
memory/1216-75-0x0000000000780000-0x000000000183A000-memory.dmpFilesize
16.7MB
-
memory/1216-73-0x0000000000780000-0x000000000183A000-memory.dmpFilesize
16.7MB
-
memory/1216-29-0x0000000000670000-0x0000000000672000-memory.dmpFilesize
8KB
-
memory/1216-35-0x0000000000780000-0x000000000183A000-memory.dmpFilesize
16.7MB
-
memory/1216-60-0x0000000000780000-0x000000000183A000-memory.dmpFilesize
16.7MB
-
memory/1216-31-0x0000000000780000-0x000000000183A000-memory.dmpFilesize
16.7MB
-
memory/1216-8-0x0000000000780000-0x000000000183A000-memory.dmpFilesize
16.7MB
-
memory/1216-6-0x0000000000780000-0x000000000183A000-memory.dmpFilesize
16.7MB
-
memory/1216-21-0x0000000000780000-0x000000000183A000-memory.dmpFilesize
16.7MB
-
memory/1216-36-0x0000000000780000-0x000000000183A000-memory.dmpFilesize
16.7MB
-
memory/1216-37-0x0000000000780000-0x000000000183A000-memory.dmpFilesize
16.7MB
-
memory/1216-38-0x0000000000780000-0x000000000183A000-memory.dmpFilesize
16.7MB
-
memory/1216-5-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1216-39-0x0000000000780000-0x000000000183A000-memory.dmpFilesize
16.7MB
-
memory/1216-71-0x0000000000780000-0x000000000183A000-memory.dmpFilesize
16.7MB
-
memory/1216-49-0x0000000000780000-0x000000000183A000-memory.dmpFilesize
16.7MB
-
memory/1216-50-0x0000000000780000-0x000000000183A000-memory.dmpFilesize
16.7MB
-
memory/1216-51-0x0000000000780000-0x000000000183A000-memory.dmpFilesize
16.7MB
-
memory/1216-68-0x0000000000780000-0x000000000183A000-memory.dmpFilesize
16.7MB
-
memory/1216-66-0x0000000000780000-0x000000000183A000-memory.dmpFilesize
16.7MB
-
memory/1216-64-0x0000000000780000-0x000000000183A000-memory.dmpFilesize
16.7MB
-
memory/1428-44-0x0000000003870000-0x0000000003872000-memory.dmpFilesize
8KB
-
memory/1428-1-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/1428-12-0x0000000003D60000-0x0000000003D61000-memory.dmpFilesize
4KB
-
memory/1428-14-0x0000000003870000-0x0000000003872000-memory.dmpFilesize
8KB
-
memory/1428-10-0x0000000003870000-0x0000000003872000-memory.dmpFilesize
8KB
-
memory/3548-22-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3548-54-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/3548-98-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3548-56-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/4860-47-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4860-58-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/4860-103-0x0000000000B30000-0x0000000001BEA000-memory.dmpFilesize
16.7MB
-
memory/4860-108-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4860-109-0x0000000000B30000-0x0000000001BEA000-memory.dmpFilesize
16.7MB