Analysis
-
max time kernel
124s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-04-2024 00:17
Static task
static1
Behavioral task
behavioral1
Sample
3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe
Resource
win7-20240221-en
General
-
Target
3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe
-
Size
992KB
-
MD5
93976eebffe5a81f6a80a9685c0cbcb1
-
SHA1
22a27813be1ca0c597511450c6be0a359b0b5b7d
-
SHA256
3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d
-
SHA512
08261ae6ce6ac1925d8424c76866912f0ad2d672339a78c4dac3adb8403478b9b9071a4884fce339966df279a8d11a256b68022441742cc8baed0126aaa504fe
-
SSDEEP
12288:GoGqUMvBCH5lOAQoVGAbTjQZfRGKMyHjZuE201rG3huigNwpsO:G1MvBy7OjoVLbQZpGKzDZuErhG3xgNGf
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe -
Processes:
3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe -
Processes:
3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe -
Processes:
resource yara_rule behavioral1/memory/2004-1-0x0000000001FD0000-0x000000000305E000-memory.dmp upx behavioral1/memory/2004-3-0x0000000001FD0000-0x000000000305E000-memory.dmp upx behavioral1/memory/2004-4-0x0000000001FD0000-0x000000000305E000-memory.dmp upx behavioral1/memory/2004-6-0x0000000001FD0000-0x000000000305E000-memory.dmp upx behavioral1/memory/2004-9-0x0000000001FD0000-0x000000000305E000-memory.dmp upx behavioral1/memory/2004-12-0x0000000001FD0000-0x000000000305E000-memory.dmp upx behavioral1/memory/2004-15-0x0000000001FD0000-0x000000000305E000-memory.dmp upx behavioral1/memory/2004-17-0x0000000001FD0000-0x000000000305E000-memory.dmp upx behavioral1/memory/2004-21-0x0000000001FD0000-0x000000000305E000-memory.dmp upx behavioral1/memory/2004-24-0x0000000001FD0000-0x000000000305E000-memory.dmp upx behavioral1/memory/2004-25-0x0000000001FD0000-0x000000000305E000-memory.dmp upx behavioral1/memory/2004-26-0x0000000001FD0000-0x000000000305E000-memory.dmp upx behavioral1/memory/2004-27-0x0000000001FD0000-0x000000000305E000-memory.dmp upx behavioral1/memory/2004-28-0x0000000001FD0000-0x000000000305E000-memory.dmp upx behavioral1/memory/2004-30-0x0000000001FD0000-0x000000000305E000-memory.dmp upx behavioral1/memory/2004-31-0x0000000001FD0000-0x000000000305E000-memory.dmp upx behavioral1/memory/2004-32-0x0000000001FD0000-0x000000000305E000-memory.dmp upx behavioral1/memory/2004-34-0x0000000001FD0000-0x000000000305E000-memory.dmp upx behavioral1/memory/2004-36-0x0000000001FD0000-0x000000000305E000-memory.dmp upx behavioral1/memory/2004-38-0x0000000001FD0000-0x000000000305E000-memory.dmp upx behavioral1/memory/2004-44-0x0000000001FD0000-0x000000000305E000-memory.dmp upx behavioral1/memory/2004-46-0x0000000001FD0000-0x000000000305E000-memory.dmp upx behavioral1/memory/2004-48-0x0000000001FD0000-0x000000000305E000-memory.dmp upx behavioral1/memory/2004-50-0x0000000001FD0000-0x000000000305E000-memory.dmp upx behavioral1/memory/2004-52-0x0000000001FD0000-0x000000000305E000-memory.dmp upx behavioral1/memory/2004-54-0x0000000001FD0000-0x000000000305E000-memory.dmp upx behavioral1/memory/2004-56-0x0000000001FD0000-0x000000000305E000-memory.dmp upx behavioral1/memory/2004-58-0x0000000001FD0000-0x000000000305E000-memory.dmp upx behavioral1/memory/2004-60-0x0000000001FD0000-0x000000000305E000-memory.dmp upx -
Processes:
3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe -
Processes:
3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe -
Enumerates connected drives 3 TTPs 18 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exedescription ioc process File opened (read-only) \??\Y: 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened (read-only) \??\P: 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened (read-only) \??\T: 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened (read-only) \??\W: 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened (read-only) \??\E: 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened (read-only) \??\G: 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened (read-only) \??\J: 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened (read-only) \??\K: 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened (read-only) \??\L: 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened (read-only) \??\X: 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened (read-only) \??\I: 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened (read-only) \??\O: 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened (read-only) \??\Z: 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened (read-only) \??\M: 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened (read-only) \??\N: 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened (read-only) \??\R: 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened (read-only) \??\S: 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened (read-only) \??\V: 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exedescription ioc process File opened for modification C:\autorun.inf 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened for modification F:\autorun.inf 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe -
Drops file in Program Files directory 5 IoCs
Processes:
3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe -
Drops file in Windows directory 1 IoCs
Processes:
3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exepid process 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe -
Suspicious use of AdjustPrivilegeToken 32 IoCs
Processes:
3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exedescription pid process Token: SeDebugPrivilege 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exepid process 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exedescription pid process target process PID 2004 wrote to memory of 1044 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Dwm.exe PID 2004 wrote to memory of 1084 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Explorer.EXE PID 2004 wrote to memory of 1096 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe taskhost.exe PID 2004 wrote to memory of 1016 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe DllHost.exe PID 2004 wrote to memory of 1044 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Dwm.exe PID 2004 wrote to memory of 1084 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Explorer.EXE PID 2004 wrote to memory of 1096 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe taskhost.exe PID 2004 wrote to memory of 1044 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Dwm.exe PID 2004 wrote to memory of 1084 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Explorer.EXE PID 2004 wrote to memory of 1096 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe taskhost.exe PID 2004 wrote to memory of 1044 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Dwm.exe PID 2004 wrote to memory of 1084 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Explorer.EXE PID 2004 wrote to memory of 1096 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe taskhost.exe PID 2004 wrote to memory of 1044 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Dwm.exe PID 2004 wrote to memory of 1084 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Explorer.EXE PID 2004 wrote to memory of 1096 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe taskhost.exe PID 2004 wrote to memory of 1044 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Dwm.exe PID 2004 wrote to memory of 1084 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Explorer.EXE PID 2004 wrote to memory of 1096 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe taskhost.exe PID 2004 wrote to memory of 1044 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Dwm.exe PID 2004 wrote to memory of 1084 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Explorer.EXE PID 2004 wrote to memory of 1096 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe taskhost.exe PID 2004 wrote to memory of 1044 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Dwm.exe PID 2004 wrote to memory of 1084 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Explorer.EXE PID 2004 wrote to memory of 1096 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe taskhost.exe PID 2004 wrote to memory of 1044 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Dwm.exe PID 2004 wrote to memory of 1084 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Explorer.EXE PID 2004 wrote to memory of 1096 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe taskhost.exe PID 2004 wrote to memory of 1044 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Dwm.exe PID 2004 wrote to memory of 1084 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Explorer.EXE PID 2004 wrote to memory of 1096 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe taskhost.exe PID 2004 wrote to memory of 1044 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Dwm.exe PID 2004 wrote to memory of 1084 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Explorer.EXE PID 2004 wrote to memory of 1096 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe taskhost.exe PID 2004 wrote to memory of 1044 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Dwm.exe PID 2004 wrote to memory of 1084 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Explorer.EXE PID 2004 wrote to memory of 1096 2004 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe taskhost.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe"C:\Users\Admin\AppData\Local\Temp\3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
F:\djnx.pifFilesize
100KB
MD5793756a139e63efeb1916fa7d044e310
SHA1ce1b8d18732ed20b3fc9a1b089f8d0ea374e2acc
SHA256ebc9b9d911af560042055c76d98ffe3f624154c791ca04d6db365162b2b2d9f8
SHA512bae67205908af8dd28d140bb93ac2f8efa8a8116b3d1463ceba07bc1c60c0cb44bc4126782fe6065532c577d029a0577e21f96e4b304548c991baa7ecc2888bf
-
memory/1044-5-0x00000000002B0000-0x00000000002B2000-memory.dmpFilesize
8KB
-
memory/2004-27-0x0000000001FD0000-0x000000000305E000-memory.dmpFilesize
16.6MB
-
memory/2004-6-0x0000000001FD0000-0x000000000305E000-memory.dmpFilesize
16.6MB
-
memory/2004-4-0x0000000001FD0000-0x000000000305E000-memory.dmpFilesize
16.6MB
-
memory/2004-28-0x0000000001FD0000-0x000000000305E000-memory.dmpFilesize
16.6MB
-
memory/2004-9-0x0000000001FD0000-0x000000000305E000-memory.dmpFilesize
16.6MB
-
memory/2004-30-0x0000000001FD0000-0x000000000305E000-memory.dmpFilesize
16.6MB
-
memory/2004-15-0x0000000001FD0000-0x000000000305E000-memory.dmpFilesize
16.6MB
-
memory/2004-18-0x0000000000310000-0x0000000000312000-memory.dmpFilesize
8KB
-
memory/2004-20-0x0000000000310000-0x0000000000312000-memory.dmpFilesize
8KB
-
memory/2004-19-0x00000000006F0000-0x00000000006F1000-memory.dmpFilesize
4KB
-
memory/2004-17-0x0000000001FD0000-0x000000000305E000-memory.dmpFilesize
16.6MB
-
memory/2004-23-0x00000000006F0000-0x00000000006F1000-memory.dmpFilesize
4KB
-
memory/2004-21-0x0000000001FD0000-0x000000000305E000-memory.dmpFilesize
16.6MB
-
memory/2004-24-0x0000000001FD0000-0x000000000305E000-memory.dmpFilesize
16.6MB
-
memory/2004-25-0x0000000001FD0000-0x000000000305E000-memory.dmpFilesize
16.6MB
-
memory/2004-26-0x0000000001FD0000-0x000000000305E000-memory.dmpFilesize
16.6MB
-
memory/2004-76-0x0000000000310000-0x0000000000312000-memory.dmpFilesize
8KB
-
memory/2004-3-0x0000000001FD0000-0x000000000305E000-memory.dmpFilesize
16.6MB
-
memory/2004-12-0x0000000001FD0000-0x000000000305E000-memory.dmpFilesize
16.6MB
-
memory/2004-31-0x0000000001FD0000-0x000000000305E000-memory.dmpFilesize
16.6MB
-
memory/2004-32-0x0000000001FD0000-0x000000000305E000-memory.dmpFilesize
16.6MB
-
memory/2004-34-0x0000000001FD0000-0x000000000305E000-memory.dmpFilesize
16.6MB
-
memory/2004-36-0x0000000001FD0000-0x000000000305E000-memory.dmpFilesize
16.6MB
-
memory/2004-38-0x0000000001FD0000-0x000000000305E000-memory.dmpFilesize
16.6MB
-
memory/2004-44-0x0000000001FD0000-0x000000000305E000-memory.dmpFilesize
16.6MB
-
memory/2004-46-0x0000000001FD0000-0x000000000305E000-memory.dmpFilesize
16.6MB
-
memory/2004-48-0x0000000001FD0000-0x000000000305E000-memory.dmpFilesize
16.6MB
-
memory/2004-50-0x0000000001FD0000-0x000000000305E000-memory.dmpFilesize
16.6MB
-
memory/2004-52-0x0000000001FD0000-0x000000000305E000-memory.dmpFilesize
16.6MB
-
memory/2004-54-0x0000000001FD0000-0x000000000305E000-memory.dmpFilesize
16.6MB
-
memory/2004-56-0x0000000001FD0000-0x000000000305E000-memory.dmpFilesize
16.6MB
-
memory/2004-58-0x0000000001FD0000-0x000000000305E000-memory.dmpFilesize
16.6MB
-
memory/2004-60-0x0000000001FD0000-0x000000000305E000-memory.dmpFilesize
16.6MB
-
memory/2004-0-0x0000000000400000-0x0000000000517000-memory.dmpFilesize
1.1MB
-
memory/2004-1-0x0000000001FD0000-0x000000000305E000-memory.dmpFilesize
16.6MB