Analysis
-
max time kernel
94s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17/04/2024, 19:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2241d5c4ccf5e4a9821f68f1ff7b2309238c4c81cd0d340f77b8af2548ed926c.dll
Resource
win7-20240220-en
windows7-x64
17 signatures
150 seconds
General
-
Target
2241d5c4ccf5e4a9821f68f1ff7b2309238c4c81cd0d340f77b8af2548ed926c.dll
-
Size
120KB
-
MD5
4f30eae6ce77a67032898937ffbb3231
-
SHA1
c2cc10b894150e7a4d293fd77e19b6fab1b5a561
-
SHA256
2241d5c4ccf5e4a9821f68f1ff7b2309238c4c81cd0d340f77b8af2548ed926c
-
SHA512
050290292ed2728909b3028598a73ebc9589e8be3709a46660b990070d254b61fa9c82f3ed33334276637cecbd699c6e00f560b0979655583d53acc1ddba7381
-
SSDEEP
3072:haDSMWv/V/LSROmO5ydE0K+PalKEkkJZkhta:hqZE/oRWHniagfuZb
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57347d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57347d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57347d.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57347d.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57347d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57347d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57347d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57347d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57347d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57347d.exe -
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 30 IoCs
resource yara_rule behavioral2/memory/4052-6-0x0000000000870000-0x000000000192A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4052-8-0x0000000000870000-0x000000000192A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4052-14-0x0000000000870000-0x000000000192A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4052-23-0x0000000000870000-0x000000000192A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4052-9-0x0000000000870000-0x000000000192A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4052-29-0x0000000000870000-0x000000000192A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4052-30-0x0000000000870000-0x000000000192A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4052-31-0x0000000000870000-0x000000000192A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4052-32-0x0000000000870000-0x000000000192A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4052-33-0x0000000000870000-0x000000000192A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4052-34-0x0000000000870000-0x000000000192A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4052-35-0x0000000000870000-0x000000000192A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4052-36-0x0000000000870000-0x000000000192A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4052-37-0x0000000000870000-0x000000000192A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4052-38-0x0000000000870000-0x000000000192A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4052-40-0x0000000000870000-0x000000000192A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4052-53-0x0000000000870000-0x000000000192A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4052-55-0x0000000000870000-0x000000000192A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4052-57-0x0000000000870000-0x000000000192A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4052-58-0x0000000000870000-0x000000000192A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4052-72-0x0000000000870000-0x000000000192A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4052-74-0x0000000000870000-0x000000000192A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4052-77-0x0000000000870000-0x000000000192A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4052-79-0x0000000000870000-0x000000000192A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4052-81-0x0000000000870000-0x000000000192A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4052-83-0x0000000000870000-0x000000000192A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4052-85-0x0000000000870000-0x000000000192A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4052-87-0x0000000000870000-0x000000000192A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4052-89-0x0000000000870000-0x000000000192A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5596-120-0x0000000000B30000-0x0000000001BEA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine -
UPX dump on OEP (original entry point) 36 IoCs
resource yara_rule behavioral2/memory/4052-6-0x0000000000870000-0x000000000192A000-memory.dmp UPX behavioral2/memory/4052-8-0x0000000000870000-0x000000000192A000-memory.dmp UPX behavioral2/memory/4052-14-0x0000000000870000-0x000000000192A000-memory.dmp UPX behavioral2/memory/1004-21-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4052-23-0x0000000000870000-0x000000000192A000-memory.dmp UPX behavioral2/memory/4052-9-0x0000000000870000-0x000000000192A000-memory.dmp UPX behavioral2/memory/4052-29-0x0000000000870000-0x000000000192A000-memory.dmp UPX behavioral2/memory/4052-30-0x0000000000870000-0x000000000192A000-memory.dmp UPX behavioral2/memory/4052-31-0x0000000000870000-0x000000000192A000-memory.dmp UPX behavioral2/memory/4052-32-0x0000000000870000-0x000000000192A000-memory.dmp UPX behavioral2/memory/4052-33-0x0000000000870000-0x000000000192A000-memory.dmp UPX behavioral2/memory/4052-34-0x0000000000870000-0x000000000192A000-memory.dmp UPX behavioral2/memory/4052-35-0x0000000000870000-0x000000000192A000-memory.dmp UPX behavioral2/memory/4052-36-0x0000000000870000-0x000000000192A000-memory.dmp UPX behavioral2/memory/4052-37-0x0000000000870000-0x000000000192A000-memory.dmp UPX behavioral2/memory/4052-38-0x0000000000870000-0x000000000192A000-memory.dmp UPX behavioral2/memory/4052-40-0x0000000000870000-0x000000000192A000-memory.dmp UPX behavioral2/memory/5708-49-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4052-53-0x0000000000870000-0x000000000192A000-memory.dmp UPX behavioral2/memory/4052-55-0x0000000000870000-0x000000000192A000-memory.dmp UPX behavioral2/memory/4052-57-0x0000000000870000-0x000000000192A000-memory.dmp UPX behavioral2/memory/4052-58-0x0000000000870000-0x000000000192A000-memory.dmp UPX behavioral2/memory/4052-72-0x0000000000870000-0x000000000192A000-memory.dmp UPX behavioral2/memory/4052-74-0x0000000000870000-0x000000000192A000-memory.dmp UPX behavioral2/memory/4052-77-0x0000000000870000-0x000000000192A000-memory.dmp UPX behavioral2/memory/4052-79-0x0000000000870000-0x000000000192A000-memory.dmp UPX behavioral2/memory/4052-81-0x0000000000870000-0x000000000192A000-memory.dmp UPX behavioral2/memory/4052-83-0x0000000000870000-0x000000000192A000-memory.dmp UPX behavioral2/memory/4052-85-0x0000000000870000-0x000000000192A000-memory.dmp UPX behavioral2/memory/4052-87-0x0000000000870000-0x000000000192A000-memory.dmp UPX behavioral2/memory/4052-89-0x0000000000870000-0x000000000192A000-memory.dmp UPX behavioral2/memory/1004-110-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4052-111-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/5708-115-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/5596-121-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/5596-120-0x0000000000B30000-0x0000000001BEA000-memory.dmp UPX -
Executes dropped EXE 4 IoCs
pid Process 4052 e57347d.exe 1004 e5736df.exe 5708 e574fb6.exe 5596 e574fd5.exe -
resource yara_rule behavioral2/memory/4052-6-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/4052-8-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/4052-14-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/4052-23-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/4052-9-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/4052-29-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/4052-30-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/4052-31-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/4052-32-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/4052-33-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/4052-34-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/4052-35-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/4052-36-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/4052-37-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/4052-38-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/4052-40-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/4052-53-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/4052-55-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/4052-57-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/4052-58-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/4052-72-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/4052-74-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/4052-77-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/4052-79-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/4052-81-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/4052-83-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/4052-85-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/4052-87-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/4052-89-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/5596-120-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57347d.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57347d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57347d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57347d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57347d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57347d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57347d.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57347d.exe -
Enumerates connected drives 3 TTPs 13 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: e57347d.exe File opened (read-only) \??\O: e57347d.exe File opened (read-only) \??\Q: e57347d.exe File opened (read-only) \??\E: e57347d.exe File opened (read-only) \??\H: e57347d.exe File opened (read-only) \??\J: e57347d.exe File opened (read-only) \??\L: e57347d.exe File opened (read-only) \??\P: e57347d.exe File opened (read-only) \??\G: e57347d.exe File opened (read-only) \??\I: e57347d.exe File opened (read-only) \??\K: e57347d.exe File opened (read-only) \??\M: e57347d.exe File opened (read-only) \??\R: e57347d.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7zG.exe e57347d.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe e57347d.exe File opened for modification C:\Program Files\7-Zip\7z.exe e57347d.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e57347d.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\e573568 e57347d.exe File opened for modification C:\Windows\SYSTEM.INI e57347d.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4052 e57347d.exe 4052 e57347d.exe 4052 e57347d.exe 4052 e57347d.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe Token: SeDebugPrivilege 4052 e57347d.exe -
Suspicious use of WriteProcessMemory 61 IoCs
description pid Process procid_target PID 4832 wrote to memory of 2880 4832 rundll32.exe 83 PID 4832 wrote to memory of 2880 4832 rundll32.exe 83 PID 4832 wrote to memory of 2880 4832 rundll32.exe 83 PID 2880 wrote to memory of 4052 2880 rundll32.exe 84 PID 2880 wrote to memory of 4052 2880 rundll32.exe 84 PID 2880 wrote to memory of 4052 2880 rundll32.exe 84 PID 4052 wrote to memory of 784 4052 e57347d.exe 8 PID 4052 wrote to memory of 788 4052 e57347d.exe 9 PID 4052 wrote to memory of 336 4052 e57347d.exe 13 PID 4052 wrote to memory of 2428 4052 e57347d.exe 42 PID 4052 wrote to memory of 2468 4052 e57347d.exe 43 PID 4052 wrote to memory of 2596 4052 e57347d.exe 46 PID 4052 wrote to memory of 3528 4052 e57347d.exe 56 PID 4052 wrote to memory of 3652 4052 e57347d.exe 57 PID 4052 wrote to memory of 3848 4052 e57347d.exe 58 PID 4052 wrote to memory of 3940 4052 e57347d.exe 59 PID 4052 wrote to memory of 4004 4052 e57347d.exe 60 PID 4052 wrote to memory of 4088 4052 e57347d.exe 61 PID 4052 wrote to memory of 4120 4052 e57347d.exe 62 PID 4052 wrote to memory of 4484 4052 e57347d.exe 64 PID 4052 wrote to memory of 4060 4052 e57347d.exe 74 PID 4052 wrote to memory of 4396 4052 e57347d.exe 78 PID 4052 wrote to memory of 4328 4052 e57347d.exe 79 PID 4052 wrote to memory of 4196 4052 e57347d.exe 80 PID 4052 wrote to memory of 4832 4052 e57347d.exe 81 PID 4052 wrote to memory of 2880 4052 e57347d.exe 83 PID 4052 wrote to memory of 2880 4052 e57347d.exe 83 PID 2880 wrote to memory of 1004 2880 rundll32.exe 85 PID 2880 wrote to memory of 1004 2880 rundll32.exe 85 PID 2880 wrote to memory of 1004 2880 rundll32.exe 85 PID 2880 wrote to memory of 5708 2880 rundll32.exe 92 PID 2880 wrote to memory of 5708 2880 rundll32.exe 92 PID 2880 wrote to memory of 5708 2880 rundll32.exe 92 PID 2880 wrote to memory of 5596 2880 rundll32.exe 93 PID 2880 wrote to memory of 5596 2880 rundll32.exe 93 PID 2880 wrote to memory of 5596 2880 rundll32.exe 93 PID 4052 wrote to memory of 784 4052 e57347d.exe 8 PID 4052 wrote to memory of 788 4052 e57347d.exe 9 PID 4052 wrote to memory of 336 4052 e57347d.exe 13 PID 4052 wrote to memory of 2428 4052 e57347d.exe 42 PID 4052 wrote to memory of 2468 4052 e57347d.exe 43 PID 4052 wrote to memory of 2596 4052 e57347d.exe 46 PID 4052 wrote to memory of 3528 4052 e57347d.exe 56 PID 4052 wrote to memory of 3652 4052 e57347d.exe 57 PID 4052 wrote to memory of 3848 4052 e57347d.exe 58 PID 4052 wrote to memory of 3940 4052 e57347d.exe 59 PID 4052 wrote to memory of 4004 4052 e57347d.exe 60 PID 4052 wrote to memory of 4088 4052 e57347d.exe 61 PID 4052 wrote to memory of 4120 4052 e57347d.exe 62 PID 4052 wrote to memory of 4484 4052 e57347d.exe 64 PID 4052 wrote to memory of 4060 4052 e57347d.exe 74 PID 4052 wrote to memory of 4396 4052 e57347d.exe 78 PID 4052 wrote to memory of 4196 4052 e57347d.exe 80 PID 4052 wrote to memory of 1004 4052 e57347d.exe 85 PID 4052 wrote to memory of 1004 4052 e57347d.exe 85 PID 4052 wrote to memory of 5592 4052 e57347d.exe 87 PID 4052 wrote to memory of 2764 4052 e57347d.exe 88 PID 4052 wrote to memory of 5708 4052 e57347d.exe 92 PID 4052 wrote to memory of 5708 4052 e57347d.exe 92 PID 4052 wrote to memory of 5596 4052 e57347d.exe 93 PID 4052 wrote to memory of 5596 4052 e57347d.exe 93 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57347d.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:336
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2428
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2468
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2596
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3528
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2241d5c4ccf5e4a9821f68f1ff7b2309238c4c81cd0d340f77b8af2548ed926c.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2241d5c4ccf5e4a9821f68f1ff7b2309238c4c81cd0d340f77b8af2548ed926c.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\e57347d.exeC:\Users\Admin\AppData\Local\Temp\e57347d.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4052
-
-
C:\Users\Admin\AppData\Local\Temp\e5736df.exeC:\Users\Admin\AppData\Local\Temp\e5736df.exe4⤵
- Executes dropped EXE
PID:1004
-
-
C:\Users\Admin\AppData\Local\Temp\e574fb6.exeC:\Users\Admin\AppData\Local\Temp\e574fb6.exe4⤵
- Executes dropped EXE
PID:5708
-
-
C:\Users\Admin\AppData\Local\Temp\e574fd5.exeC:\Users\Admin\AppData\Local\Temp\e574fd5.exe4⤵
- Executes dropped EXE
PID:5596
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3652
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3848
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3940
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4004
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4088
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4120
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4484
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4060
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca1⤵PID:4396
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:4328
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:4196
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:5592
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2764
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5754b2e75a3c34d38e410a2bfe81d14b0
SHA1e80b4606b1d2e4c5f7fe6dc952f53f94e730f0f8
SHA25602aa7357a9f9d19c8a4b9b8546a4a6e402a6ec437e11bcb2c24755f51555f0b0
SHA5125a0eb8d7d886d36f6f8ded1dc8b4aea334e787af0199a2b2061b3e9265ca622feffa9d82667dd160775e31e1d7246395ccaff8d4ba125a82ec250dc18b9b2d95