Analysis
-
max time kernel
124s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
23-04-2024 13:29
Behavioral task
behavioral1
Sample
d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe
Resource
win7-20240220-en
General
-
Target
d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe
-
Size
2.5MB
-
MD5
f0b291a13e780a78cd5270f2f976355e
-
SHA1
ff0bfead9d220b00869e32bc552b9311a5295080
-
SHA256
d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1
-
SHA512
ee9f7119ec79c757d8943fd5dfef1ae189ae7a0f51581f9723bdce172648f8dab62f5536f6e54c9f45db1e92cf10f178a6359509b074f09ef7e4573ecffb2c38
-
SSDEEP
49152:wjfT+6ngdZqU8nWw08pbGKjJJ4sZ0BxpKGHdtOlsmgUuyv9rmil:wjfT+9Hv8Ww0E34siginOicu29rxl
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe -
Processes:
d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe -
Processes:
d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe -
Loads dropped DLL 2 IoCs
Processes:
d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exepid process 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe -
Processes:
resource yara_rule behavioral1/memory/1728-1-0x0000000000400000-0x000000000119E000-memory.dmp upx behavioral1/memory/1728-0-0x0000000002D30000-0x0000000003DBE000-memory.dmp upx behavioral1/memory/1728-4-0x0000000002D30000-0x0000000003DBE000-memory.dmp upx behavioral1/memory/1728-5-0x0000000002D30000-0x0000000003DBE000-memory.dmp upx behavioral1/memory/1728-7-0x0000000002D30000-0x0000000003DBE000-memory.dmp upx behavioral1/memory/1728-10-0x0000000002D30000-0x0000000003DBE000-memory.dmp upx behavioral1/memory/1728-14-0x0000000002D30000-0x0000000003DBE000-memory.dmp upx behavioral1/memory/1728-18-0x0000000002D30000-0x0000000003DBE000-memory.dmp upx behavioral1/memory/1728-20-0x0000000002D30000-0x0000000003DBE000-memory.dmp upx behavioral1/memory/1728-24-0x0000000002D30000-0x0000000003DBE000-memory.dmp upx behavioral1/memory/1728-41-0x0000000002D30000-0x0000000003DBE000-memory.dmp upx behavioral1/memory/1728-42-0x0000000002D30000-0x0000000003DBE000-memory.dmp upx behavioral1/memory/1728-43-0x0000000002D30000-0x0000000003DBE000-memory.dmp upx behavioral1/memory/1728-44-0x0000000002D30000-0x0000000003DBE000-memory.dmp upx behavioral1/memory/1728-45-0x0000000002D30000-0x0000000003DBE000-memory.dmp upx behavioral1/memory/1728-48-0x0000000002D30000-0x0000000003DBE000-memory.dmp upx behavioral1/memory/1728-49-0x0000000002D30000-0x0000000003DBE000-memory.dmp upx behavioral1/memory/1728-50-0x0000000002D30000-0x0000000003DBE000-memory.dmp upx behavioral1/memory/1728-51-0x0000000002D30000-0x0000000003DBE000-memory.dmp upx behavioral1/memory/1728-53-0x0000000002D30000-0x0000000003DBE000-memory.dmp upx behavioral1/memory/1728-55-0x0000000000400000-0x000000000119E000-memory.dmp upx behavioral1/memory/1728-62-0x0000000002D30000-0x0000000003DBE000-memory.dmp upx behavioral1/memory/1728-64-0x0000000002D30000-0x0000000003DBE000-memory.dmp upx behavioral1/memory/1728-66-0x0000000002D30000-0x0000000003DBE000-memory.dmp upx behavioral1/memory/1728-68-0x0000000002D30000-0x0000000003DBE000-memory.dmp upx behavioral1/memory/1728-70-0x0000000002D30000-0x0000000003DBE000-memory.dmp upx behavioral1/memory/1728-72-0x0000000002D30000-0x0000000003DBE000-memory.dmp upx behavioral1/memory/1728-79-0x0000000002D30000-0x0000000003DBE000-memory.dmp upx behavioral1/memory/1728-81-0x0000000002D30000-0x0000000003DBE000-memory.dmp upx behavioral1/memory/1728-83-0x0000000002D30000-0x0000000003DBE000-memory.dmp upx -
Processes:
d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe -
Processes:
d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exedescription ioc process File opened (read-only) \??\K: d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened (read-only) \??\L: d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened (read-only) \??\M: d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened (read-only) \??\E: d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened (read-only) \??\F: d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened (read-only) \??\I: d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened (read-only) \??\J: d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened (read-only) \??\D: d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened (read-only) \??\O: d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened (read-only) \??\R: d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened (read-only) \??\W: d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened (read-only) \??\G: d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened (read-only) \??\N: d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened (read-only) \??\Q: d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened (read-only) \??\S: d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened (read-only) \??\V: d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened (read-only) \??\X: d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened (read-only) \??\Y: d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened (read-only) \??\Z: d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened (read-only) \??\H: d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened (read-only) \??\P: d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened (read-only) \??\T: d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened (read-only) \??\U: d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exedescription ioc process File opened for modification C:\autorun.inf d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened for modification F:\autorun.inf d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe -
Drops file in Program Files directory 5 IoCs
Processes:
d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe -
Drops file in Windows directory 1 IoCs
Processes:
d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exepid process 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe -
Suspicious use of AdjustPrivilegeToken 33 IoCs
Processes:
d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exedescription pid process Token: SeDebugPrivilege 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exepid process 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exedescription pid process target process PID 1728 wrote to memory of 1044 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Dwm.exe PID 1728 wrote to memory of 1072 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Explorer.EXE PID 1728 wrote to memory of 1100 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe taskhost.exe PID 1728 wrote to memory of 1796 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe DllHost.exe PID 1728 wrote to memory of 1044 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Dwm.exe PID 1728 wrote to memory of 1072 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Explorer.EXE PID 1728 wrote to memory of 1100 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe taskhost.exe PID 1728 wrote to memory of 1044 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Dwm.exe PID 1728 wrote to memory of 1072 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Explorer.EXE PID 1728 wrote to memory of 1100 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe taskhost.exe PID 1728 wrote to memory of 1044 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Dwm.exe PID 1728 wrote to memory of 1072 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Explorer.EXE PID 1728 wrote to memory of 1100 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe taskhost.exe PID 1728 wrote to memory of 1044 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Dwm.exe PID 1728 wrote to memory of 1072 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Explorer.EXE PID 1728 wrote to memory of 1100 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe taskhost.exe PID 1728 wrote to memory of 1044 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Dwm.exe PID 1728 wrote to memory of 1072 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Explorer.EXE PID 1728 wrote to memory of 1100 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe taskhost.exe PID 1728 wrote to memory of 1044 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Dwm.exe PID 1728 wrote to memory of 1072 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Explorer.EXE PID 1728 wrote to memory of 1100 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe taskhost.exe PID 1728 wrote to memory of 1044 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Dwm.exe PID 1728 wrote to memory of 1072 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Explorer.EXE PID 1728 wrote to memory of 1100 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe taskhost.exe PID 1728 wrote to memory of 1044 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Dwm.exe PID 1728 wrote to memory of 1072 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Explorer.EXE PID 1728 wrote to memory of 1100 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe taskhost.exe PID 1728 wrote to memory of 1044 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Dwm.exe PID 1728 wrote to memory of 1072 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Explorer.EXE PID 1728 wrote to memory of 1100 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe taskhost.exe PID 1728 wrote to memory of 1044 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Dwm.exe PID 1728 wrote to memory of 1072 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Explorer.EXE PID 1728 wrote to memory of 1100 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe taskhost.exe PID 1728 wrote to memory of 1044 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Dwm.exe PID 1728 wrote to memory of 1072 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Explorer.EXE PID 1728 wrote to memory of 1100 1728 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe taskhost.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe"C:\Users\Admin\AppData\Local\Temp\d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
F:\efprev.pifFilesize
100KB
MD5d6b36dcfde6c3252abd9eab1dc684f9d
SHA154e53f0f91d7c937d3fa2eceac91a07454e70663
SHA256482204f2fdc74d322dbce5d221f555e6d4cd23c18ea71d71d5523976168233af
SHA5126a0ddf588f3e9de5b291f28f2f0ad5248401c77d81fa6e1a645877c717f4de9f1adb20506ce9d886d1db1e8673979b260724493a4287482017db18ceebb6ee07
-
\Users\Admin\AppData\Local\Temp\ntdll.dllFilesize
1.2MB
MD5d124f55b9393c976963407dff51ffa79
SHA12c7bbedd79791bfb866898c85b504186db610b5d
SHA256ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef
SHA512278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06
-
memory/1044-6-0x00000000001C0000-0x00000000001C2000-memory.dmpFilesize
8KB
-
memory/1728-44-0x0000000002D30000-0x0000000003DBE000-memory.dmpFilesize
16.6MB
-
memory/1728-95-0x00000000079D0000-0x00000000079D2000-memory.dmpFilesize
8KB
-
memory/1728-7-0x0000000002D30000-0x0000000003DBE000-memory.dmpFilesize
16.6MB
-
memory/1728-45-0x0000000002D30000-0x0000000003DBE000-memory.dmpFilesize
16.6MB
-
memory/1728-10-0x0000000002D30000-0x0000000003DBE000-memory.dmpFilesize
16.6MB
-
memory/1728-14-0x0000000002D30000-0x0000000003DBE000-memory.dmpFilesize
16.6MB
-
memory/1728-18-0x0000000002D30000-0x0000000003DBE000-memory.dmpFilesize
16.6MB
-
memory/1728-21-0x00000000079D0000-0x00000000079D2000-memory.dmpFilesize
8KB
-
memory/1728-23-0x00000000079D0000-0x00000000079D2000-memory.dmpFilesize
8KB
-
memory/1728-22-0x00000000081E0000-0x00000000081E1000-memory.dmpFilesize
4KB
-
memory/1728-20-0x0000000002D30000-0x0000000003DBE000-memory.dmpFilesize
16.6MB
-
memory/1728-26-0x00000000081E0000-0x00000000081E1000-memory.dmpFilesize
4KB
-
memory/1728-24-0x0000000002D30000-0x0000000003DBE000-memory.dmpFilesize
16.6MB
-
memory/1728-4-0x0000000002D30000-0x0000000003DBE000-memory.dmpFilesize
16.6MB
-
memory/1728-41-0x0000000002D30000-0x0000000003DBE000-memory.dmpFilesize
16.6MB
-
memory/1728-42-0x0000000002D30000-0x0000000003DBE000-memory.dmpFilesize
16.6MB
-
memory/1728-43-0x0000000002D30000-0x0000000003DBE000-memory.dmpFilesize
16.6MB
-
memory/1728-1-0x0000000000400000-0x000000000119E000-memory.dmpFilesize
13.6MB
-
memory/1728-12-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/1728-5-0x0000000002D30000-0x0000000003DBE000-memory.dmpFilesize
16.6MB
-
memory/1728-50-0x0000000002D30000-0x0000000003DBE000-memory.dmpFilesize
16.6MB
-
memory/1728-49-0x0000000002D30000-0x0000000003DBE000-memory.dmpFilesize
16.6MB
-
memory/1728-51-0x0000000002D30000-0x0000000003DBE000-memory.dmpFilesize
16.6MB
-
memory/1728-53-0x0000000002D30000-0x0000000003DBE000-memory.dmpFilesize
16.6MB
-
memory/1728-55-0x0000000000400000-0x000000000119E000-memory.dmpFilesize
13.6MB
-
memory/1728-62-0x0000000002D30000-0x0000000003DBE000-memory.dmpFilesize
16.6MB
-
memory/1728-64-0x0000000002D30000-0x0000000003DBE000-memory.dmpFilesize
16.6MB
-
memory/1728-66-0x0000000002D30000-0x0000000003DBE000-memory.dmpFilesize
16.6MB
-
memory/1728-68-0x0000000002D30000-0x0000000003DBE000-memory.dmpFilesize
16.6MB
-
memory/1728-70-0x0000000002D30000-0x0000000003DBE000-memory.dmpFilesize
16.6MB
-
memory/1728-72-0x0000000002D30000-0x0000000003DBE000-memory.dmpFilesize
16.6MB
-
memory/1728-79-0x0000000002D30000-0x0000000003DBE000-memory.dmpFilesize
16.6MB
-
memory/1728-81-0x0000000002D30000-0x0000000003DBE000-memory.dmpFilesize
16.6MB
-
memory/1728-83-0x0000000002D30000-0x0000000003DBE000-memory.dmpFilesize
16.6MB
-
memory/1728-86-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/1728-48-0x0000000002D30000-0x0000000003DBE000-memory.dmpFilesize
16.6MB
-
memory/1728-0-0x0000000002D30000-0x0000000003DBE000-memory.dmpFilesize
16.6MB