Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17/04/2024, 20:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe
Resource
win7-20240221-en
windows7-x64
17 signatures
150 seconds
General
-
Target
febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe
-
Size
1.7MB
-
MD5
bf65aade71be76374add3c8ca7fbf63c
-
SHA1
eb01db33ef43d7f6a86d7b92ec12635d5aab9ca0
-
SHA256
febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a
-
SHA512
b004b64ef24ed934a84fa28d4228597b0a10d622630659cc570c632719d7d454943aa1bb6f51c99a2f859a42d7d1af86f18a3b17d297433ecbbd2ceb2875a719
-
SSDEEP
24576:i5bYyUNn1hZWifX2AECi9+NBtmZVtqne3Py3WsNYm6XV6aOHBkBcM2lE4ZEbL0H8:imZ23YlNY5OhplEm0kfWsev
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe -
resource yara_rule behavioral2/memory/764-1-0x0000000002550000-0x000000000360A000-memory.dmp upx behavioral2/memory/764-3-0x0000000002550000-0x000000000360A000-memory.dmp upx behavioral2/memory/764-8-0x0000000002550000-0x000000000360A000-memory.dmp upx behavioral2/memory/764-9-0x0000000002550000-0x000000000360A000-memory.dmp upx behavioral2/memory/764-14-0x0000000002550000-0x000000000360A000-memory.dmp upx behavioral2/memory/764-20-0x0000000002550000-0x000000000360A000-memory.dmp upx behavioral2/memory/764-21-0x0000000002550000-0x000000000360A000-memory.dmp upx behavioral2/memory/764-22-0x0000000002550000-0x000000000360A000-memory.dmp upx behavioral2/memory/764-23-0x0000000002550000-0x000000000360A000-memory.dmp upx behavioral2/memory/764-24-0x0000000002550000-0x000000000360A000-memory.dmp upx behavioral2/memory/764-62-0x0000000002550000-0x000000000360A000-memory.dmp upx behavioral2/memory/764-63-0x0000000002550000-0x000000000360A000-memory.dmp upx behavioral2/memory/764-64-0x0000000002550000-0x000000000360A000-memory.dmp upx behavioral2/memory/764-65-0x0000000002550000-0x000000000360A000-memory.dmp upx behavioral2/memory/764-66-0x0000000002550000-0x000000000360A000-memory.dmp upx behavioral2/memory/764-68-0x0000000002550000-0x000000000360A000-memory.dmp upx behavioral2/memory/764-69-0x0000000002550000-0x000000000360A000-memory.dmp upx behavioral2/memory/764-70-0x0000000002550000-0x000000000360A000-memory.dmp upx behavioral2/memory/764-72-0x0000000002550000-0x000000000360A000-memory.dmp upx behavioral2/memory/764-73-0x0000000002550000-0x000000000360A000-memory.dmp upx behavioral2/memory/764-75-0x0000000002550000-0x000000000360A000-memory.dmp upx behavioral2/memory/764-78-0x0000000002550000-0x000000000360A000-memory.dmp upx behavioral2/memory/764-81-0x0000000002550000-0x000000000360A000-memory.dmp upx behavioral2/memory/764-83-0x0000000002550000-0x000000000360A000-memory.dmp upx behavioral2/memory/764-85-0x0000000002550000-0x000000000360A000-memory.dmp upx behavioral2/memory/764-87-0x0000000002550000-0x000000000360A000-memory.dmp upx behavioral2/memory/764-89-0x0000000002550000-0x000000000360A000-memory.dmp upx behavioral2/memory/764-96-0x0000000002550000-0x000000000360A000-memory.dmp upx behavioral2/memory/764-98-0x0000000002550000-0x000000000360A000-memory.dmp upx behavioral2/memory/764-100-0x0000000002550000-0x000000000360A000-memory.dmp upx behavioral2/memory/764-104-0x0000000002550000-0x000000000360A000-memory.dmp upx behavioral2/memory/764-106-0x0000000002550000-0x000000000360A000-memory.dmp upx behavioral2/memory/764-108-0x0000000002550000-0x000000000360A000-memory.dmp upx behavioral2/memory/764-110-0x0000000002550000-0x000000000360A000-memory.dmp upx behavioral2/memory/764-112-0x0000000002550000-0x000000000360A000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Desktop\desktop.ini febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe -
Enumerates connected drives 3 TTPs 19 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe File opened (read-only) \??\L: febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe File opened (read-only) \??\T: febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe File opened (read-only) \??\E: febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe File opened (read-only) \??\G: febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe File opened (read-only) \??\K: febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe File opened (read-only) \??\M: febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe File opened (read-only) \??\Q: febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe File opened (read-only) \??\X: febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe File opened (read-only) \??\S: febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe File opened (read-only) \??\U: febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe File opened (read-only) \??\H: febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe File opened (read-only) \??\I: febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe File opened (read-only) \??\N: febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe File opened (read-only) \??\O: febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe File opened (read-only) \??\P: febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe File opened (read-only) \??\R: febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe File opened (read-only) \??\W: febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe File opened (read-only) \??\V: febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7zG.exe febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe File opened for modification C:\Program Files\7-Zip\7z.exe febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\e5737f8 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe File opened for modification C:\Windows\SYSTEM.INI febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe = "11000" febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe Token: SeDebugPrivilege 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe -
Suspicious use of WriteProcessMemory 58 IoCs
description pid Process procid_target PID 764 wrote to memory of 800 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 9 PID 764 wrote to memory of 804 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 10 PID 764 wrote to memory of 384 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 13 PID 764 wrote to memory of 2644 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 44 PID 764 wrote to memory of 2664 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 45 PID 764 wrote to memory of 2924 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 51 PID 764 wrote to memory of 3420 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 56 PID 764 wrote to memory of 3600 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 57 PID 764 wrote to memory of 3788 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 58 PID 764 wrote to memory of 3876 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 59 PID 764 wrote to memory of 3936 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 60 PID 764 wrote to memory of 4024 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 61 PID 764 wrote to memory of 4092 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 62 PID 764 wrote to memory of 4828 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 73 PID 764 wrote to memory of 2148 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 74 PID 764 wrote to memory of 4796 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 78 PID 764 wrote to memory of 3652 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 79 PID 764 wrote to memory of 4924 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 80 PID 764 wrote to memory of 1940 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 83 PID 764 wrote to memory of 800 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 9 PID 764 wrote to memory of 804 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 10 PID 764 wrote to memory of 384 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 13 PID 764 wrote to memory of 2644 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 44 PID 764 wrote to memory of 2664 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 45 PID 764 wrote to memory of 2924 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 51 PID 764 wrote to memory of 3420 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 56 PID 764 wrote to memory of 3600 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 57 PID 764 wrote to memory of 3788 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 58 PID 764 wrote to memory of 3876 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 59 PID 764 wrote to memory of 3936 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 60 PID 764 wrote to memory of 4024 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 61 PID 764 wrote to memory of 4092 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 62 PID 764 wrote to memory of 4828 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 73 PID 764 wrote to memory of 2148 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 74 PID 764 wrote to memory of 4796 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 78 PID 764 wrote to memory of 3652 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 79 PID 764 wrote to memory of 2520 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 84 PID 764 wrote to memory of 2872 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 85 PID 764 wrote to memory of 1640 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 89 PID 764 wrote to memory of 800 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 9 PID 764 wrote to memory of 804 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 10 PID 764 wrote to memory of 384 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 13 PID 764 wrote to memory of 2644 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 44 PID 764 wrote to memory of 2664 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 45 PID 764 wrote to memory of 2924 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 51 PID 764 wrote to memory of 3420 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 56 PID 764 wrote to memory of 3600 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 57 PID 764 wrote to memory of 3788 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 58 PID 764 wrote to memory of 3876 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 59 PID 764 wrote to memory of 3936 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 60 PID 764 wrote to memory of 4024 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 61 PID 764 wrote to memory of 4092 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 62 PID 764 wrote to memory of 4828 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 73 PID 764 wrote to memory of 2148 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 74 PID 764 wrote to memory of 4796 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 78 PID 764 wrote to memory of 3652 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 79 PID 764 wrote to memory of 2520 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 84 PID 764 wrote to memory of 2872 764 febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe 85 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:800
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:804
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:384
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2644
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2664
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2924
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe"C:\Users\Admin\AppData\Local\Temp\febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:764
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3600
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3788
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3876
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3936
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4024
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4092
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4828
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2148
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca1⤵PID:4796
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:3652
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:4924
-
C:\Windows\system32\BackgroundTaskHost.exe"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider1⤵PID:1940
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2520
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2872
-
C:\Windows\System32\wuapihost.exeC:\Windows\System32\wuapihost.exe -Embedding1⤵PID:1640
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
6Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\0E573CEA_Rar\febe48e57885ff62d598a820c7c183a569c76c9ee30bdcfe6fc454908f399f0a.exe
Filesize1.6MB
MD5e6cc90a78177c4fa0224d28a23d0addd
SHA1d0eab9483f4f1e71acd2c0ecbda53ca4a026f5c6
SHA2565bb714568be31dfb162da86fcf97ae1f2803f55a13460378706d397bc89f4e71
SHA512d06c3bb6caabdeccd2fbe44523f087591b215fa987457ca50e5f1fa790d47662b0dd0f569bdcefa6d0bea9c4e45a3951e693f5442d73a2df1104153fff56de60
-
Filesize
282B
MD59e36cc3537ee9ee1e3b10fa4e761045b
SHA17726f55012e1e26cc762c9982e7c6c54ca7bb303
SHA2564b9d687ac625690fd026ed4b236dad1cac90ef69e7ad256cc42766a065b50026
SHA5125f92493c533d3add10b4ce2a364624817ebd10e32daa45ee16593e913073602db5e339430a3f7d2c44abf250e96ca4e679f1f09f8ca807d58a47cf3d5c9c3790