Analysis
-
max time kernel
123s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
24-04-2024 00:17
Static task
static1
Behavioral task
behavioral1
Sample
3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe
Resource
win7-20240221-en
General
-
Target
3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe
-
Size
992KB
-
MD5
93976eebffe5a81f6a80a9685c0cbcb1
-
SHA1
22a27813be1ca0c597511450c6be0a359b0b5b7d
-
SHA256
3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d
-
SHA512
08261ae6ce6ac1925d8424c76866912f0ad2d672339a78c4dac3adb8403478b9b9071a4884fce339966df279a8d11a256b68022441742cc8baed0126aaa504fe
-
SSDEEP
12288:GoGqUMvBCH5lOAQoVGAbTjQZfRGKMyHjZuE201rG3huigNwpsO:G1MvBy7OjoVLbQZpGKzDZuErhG3xgNGf
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe -
Processes:
3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe -
Processes:
3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe -
Processes:
resource yara_rule behavioral2/memory/844-1-0x0000000002440000-0x00000000034CE000-memory.dmp upx behavioral2/memory/844-3-0x0000000002440000-0x00000000034CE000-memory.dmp upx behavioral2/memory/844-4-0x0000000002440000-0x00000000034CE000-memory.dmp upx behavioral2/memory/844-7-0x0000000002440000-0x00000000034CE000-memory.dmp upx behavioral2/memory/844-10-0x0000000002440000-0x00000000034CE000-memory.dmp upx behavioral2/memory/844-11-0x0000000002440000-0x00000000034CE000-memory.dmp upx behavioral2/memory/844-12-0x0000000002440000-0x00000000034CE000-memory.dmp upx behavioral2/memory/844-13-0x0000000002440000-0x00000000034CE000-memory.dmp upx behavioral2/memory/844-14-0x0000000002440000-0x00000000034CE000-memory.dmp upx behavioral2/memory/844-15-0x0000000002440000-0x00000000034CE000-memory.dmp upx behavioral2/memory/844-16-0x0000000002440000-0x00000000034CE000-memory.dmp upx behavioral2/memory/844-17-0x0000000002440000-0x00000000034CE000-memory.dmp upx behavioral2/memory/844-18-0x0000000002440000-0x00000000034CE000-memory.dmp upx behavioral2/memory/844-19-0x0000000002440000-0x00000000034CE000-memory.dmp upx behavioral2/memory/844-22-0x0000000002440000-0x00000000034CE000-memory.dmp upx behavioral2/memory/844-23-0x0000000002440000-0x00000000034CE000-memory.dmp upx behavioral2/memory/844-25-0x0000000002440000-0x00000000034CE000-memory.dmp upx behavioral2/memory/844-26-0x0000000002440000-0x00000000034CE000-memory.dmp upx behavioral2/memory/844-27-0x0000000002440000-0x00000000034CE000-memory.dmp upx behavioral2/memory/844-34-0x0000000002440000-0x00000000034CE000-memory.dmp upx behavioral2/memory/844-37-0x0000000002440000-0x00000000034CE000-memory.dmp upx behavioral2/memory/844-40-0x0000000002440000-0x00000000034CE000-memory.dmp upx behavioral2/memory/844-42-0x0000000002440000-0x00000000034CE000-memory.dmp upx behavioral2/memory/844-44-0x0000000002440000-0x00000000034CE000-memory.dmp upx behavioral2/memory/844-46-0x0000000002440000-0x00000000034CE000-memory.dmp upx behavioral2/memory/844-48-0x0000000002440000-0x00000000034CE000-memory.dmp upx behavioral2/memory/844-50-0x0000000002440000-0x00000000034CE000-memory.dmp upx behavioral2/memory/844-52-0x0000000002440000-0x00000000034CE000-memory.dmp upx behavioral2/memory/844-54-0x0000000002440000-0x00000000034CE000-memory.dmp upx behavioral2/memory/844-56-0x0000000002440000-0x00000000034CE000-memory.dmp upx behavioral2/memory/844-58-0x0000000002440000-0x00000000034CE000-memory.dmp upx behavioral2/memory/844-61-0x0000000002440000-0x00000000034CE000-memory.dmp upx behavioral2/memory/844-63-0x0000000002440000-0x00000000034CE000-memory.dmp upx behavioral2/memory/844-65-0x0000000002440000-0x00000000034CE000-memory.dmp upx behavioral2/memory/844-67-0x0000000002440000-0x00000000034CE000-memory.dmp upx behavioral2/memory/844-68-0x0000000002440000-0x00000000034CE000-memory.dmp upx -
Processes:
3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe -
Processes:
3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe -
Enumerates connected drives 3 TTPs 18 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exedescription ioc process File opened (read-only) \??\L: 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened (read-only) \??\N: 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened (read-only) \??\O: 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened (read-only) \??\P: 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened (read-only) \??\Y: 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened (read-only) \??\E: 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened (read-only) \??\J: 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened (read-only) \??\Q: 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened (read-only) \??\R: 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened (read-only) \??\S: 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened (read-only) \??\T: 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened (read-only) \??\X: 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened (read-only) \??\H: 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened (read-only) \??\K: 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened (read-only) \??\U: 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened (read-only) \??\W: 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened (read-only) \??\V: 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened (read-only) \??\Z: 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exedescription ioc process File opened for modification C:\autorun.inf 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened for modification F:\autorun.inf 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe -
Drops file in Program Files directory 11 IoCs
Processes:
3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exedescription ioc process File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe -
Drops file in Windows directory 1 IoCs
Processes:
3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exepid process 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exedescription pid process Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Token: SeDebugPrivilege 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exepid process 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exedescription pid process target process PID 844 wrote to memory of 776 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe fontdrvhost.exe PID 844 wrote to memory of 784 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe fontdrvhost.exe PID 844 wrote to memory of 64 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe dwm.exe PID 844 wrote to memory of 2604 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe sihost.exe PID 844 wrote to memory of 2668 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe svchost.exe PID 844 wrote to memory of 2828 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe taskhostw.exe PID 844 wrote to memory of 3444 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Explorer.EXE PID 844 wrote to memory of 3572 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe svchost.exe PID 844 wrote to memory of 3752 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe DllHost.exe PID 844 wrote to memory of 3844 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe StartMenuExperienceHost.exe PID 844 wrote to memory of 3908 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe RuntimeBroker.exe PID 844 wrote to memory of 4028 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe SearchApp.exe PID 844 wrote to memory of 4116 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe RuntimeBroker.exe PID 844 wrote to memory of 392 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe RuntimeBroker.exe PID 844 wrote to memory of 616 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe TextInputHost.exe PID 844 wrote to memory of 2720 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe backgroundTaskHost.exe PID 844 wrote to memory of 2036 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe backgroundTaskHost.exe PID 844 wrote to memory of 1936 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe backgroundTaskHost.exe PID 844 wrote to memory of 776 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe fontdrvhost.exe PID 844 wrote to memory of 784 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe fontdrvhost.exe PID 844 wrote to memory of 64 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe dwm.exe PID 844 wrote to memory of 2604 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe sihost.exe PID 844 wrote to memory of 2668 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe svchost.exe PID 844 wrote to memory of 2828 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe taskhostw.exe PID 844 wrote to memory of 3444 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Explorer.EXE PID 844 wrote to memory of 3572 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe svchost.exe PID 844 wrote to memory of 3752 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe DllHost.exe PID 844 wrote to memory of 3844 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe StartMenuExperienceHost.exe PID 844 wrote to memory of 3908 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe RuntimeBroker.exe PID 844 wrote to memory of 4028 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe SearchApp.exe PID 844 wrote to memory of 4116 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe RuntimeBroker.exe PID 844 wrote to memory of 392 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe RuntimeBroker.exe PID 844 wrote to memory of 616 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe TextInputHost.exe PID 844 wrote to memory of 2720 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe backgroundTaskHost.exe PID 844 wrote to memory of 2036 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe backgroundTaskHost.exe PID 844 wrote to memory of 1936 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe backgroundTaskHost.exe PID 844 wrote to memory of 5048 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe wuapihost.exe PID 844 wrote to memory of 1220 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe RuntimeBroker.exe PID 844 wrote to memory of 2052 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe RuntimeBroker.exe PID 844 wrote to memory of 776 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe fontdrvhost.exe PID 844 wrote to memory of 784 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe fontdrvhost.exe PID 844 wrote to memory of 64 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe dwm.exe PID 844 wrote to memory of 2604 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe sihost.exe PID 844 wrote to memory of 2668 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe svchost.exe PID 844 wrote to memory of 2828 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe taskhostw.exe PID 844 wrote to memory of 3444 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe Explorer.EXE PID 844 wrote to memory of 3572 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe svchost.exe PID 844 wrote to memory of 3752 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe DllHost.exe PID 844 wrote to memory of 3844 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe StartMenuExperienceHost.exe PID 844 wrote to memory of 3908 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe RuntimeBroker.exe PID 844 wrote to memory of 4028 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe SearchApp.exe PID 844 wrote to memory of 4116 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe RuntimeBroker.exe PID 844 wrote to memory of 392 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe RuntimeBroker.exe PID 844 wrote to memory of 616 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe TextInputHost.exe PID 844 wrote to memory of 2720 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe backgroundTaskHost.exe PID 844 wrote to memory of 2036 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe backgroundTaskHost.exe PID 844 wrote to memory of 1220 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe RuntimeBroker.exe PID 844 wrote to memory of 2052 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe RuntimeBroker.exe PID 844 wrote to memory of 776 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe fontdrvhost.exe PID 844 wrote to memory of 784 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe fontdrvhost.exe PID 844 wrote to memory of 64 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe dwm.exe PID 844 wrote to memory of 2604 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe sihost.exe PID 844 wrote to memory of 2668 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe svchost.exe PID 844 wrote to memory of 2828 844 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe taskhostw.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe"C:\Users\Admin\AppData\Local\Temp\3b5a0b425528f38b12795161266ab607c68876c05ba5e36bc05745822667915d.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\System32\wuapihost.exeC:\Windows\System32\wuapihost.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\flbmoy.exeFilesize
100KB
MD54ba638845f15a7c3575066fa1e546876
SHA10c28b5841bf4a5e38ceb8909b60285d6da1cc747
SHA256a874a3553bcfa62dfd92318aa6125485762ee302f01c23ca3163cd4bdc446559
SHA512b32503e0e3eb5fdcdb5e7b652549b0ca7cb53d8d075eec2eb8a587f357dbe8eb092a12032c25d6a1afab660ddfe274799ed0a49d1f3c7736b6dfea255f072093
-
memory/844-25-0x0000000002440000-0x00000000034CE000-memory.dmpFilesize
16.6MB
-
memory/844-10-0x0000000002440000-0x00000000034CE000-memory.dmpFilesize
16.6MB
-
memory/844-5-0x0000000004580000-0x0000000004582000-memory.dmpFilesize
8KB
-
memory/844-26-0x0000000002440000-0x00000000034CE000-memory.dmpFilesize
16.6MB
-
memory/844-4-0x0000000002440000-0x00000000034CE000-memory.dmpFilesize
16.6MB
-
memory/844-34-0x0000000002440000-0x00000000034CE000-memory.dmpFilesize
16.6MB
-
memory/844-9-0x0000000004580000-0x0000000004582000-memory.dmpFilesize
8KB
-
memory/844-27-0x0000000002440000-0x00000000034CE000-memory.dmpFilesize
16.6MB
-
memory/844-11-0x0000000002440000-0x00000000034CE000-memory.dmpFilesize
16.6MB
-
memory/844-12-0x0000000002440000-0x00000000034CE000-memory.dmpFilesize
16.6MB
-
memory/844-13-0x0000000002440000-0x00000000034CE000-memory.dmpFilesize
16.6MB
-
memory/844-14-0x0000000002440000-0x00000000034CE000-memory.dmpFilesize
16.6MB
-
memory/844-15-0x0000000002440000-0x00000000034CE000-memory.dmpFilesize
16.6MB
-
memory/844-16-0x0000000002440000-0x00000000034CE000-memory.dmpFilesize
16.6MB
-
memory/844-17-0x0000000002440000-0x00000000034CE000-memory.dmpFilesize
16.6MB
-
memory/844-18-0x0000000002440000-0x00000000034CE000-memory.dmpFilesize
16.6MB
-
memory/844-19-0x0000000002440000-0x00000000034CE000-memory.dmpFilesize
16.6MB
-
memory/844-22-0x0000000002440000-0x00000000034CE000-memory.dmpFilesize
16.6MB
-
memory/844-23-0x0000000002440000-0x00000000034CE000-memory.dmpFilesize
16.6MB
-
memory/844-0-0x0000000000400000-0x0000000000517000-memory.dmpFilesize
1.1MB
-
memory/844-6-0x0000000004910000-0x0000000004911000-memory.dmpFilesize
4KB
-
memory/844-3-0x0000000002440000-0x00000000034CE000-memory.dmpFilesize
16.6MB
-
memory/844-7-0x0000000002440000-0x00000000034CE000-memory.dmpFilesize
16.6MB
-
memory/844-37-0x0000000002440000-0x00000000034CE000-memory.dmpFilesize
16.6MB
-
memory/844-40-0x0000000002440000-0x00000000034CE000-memory.dmpFilesize
16.6MB
-
memory/844-42-0x0000000002440000-0x00000000034CE000-memory.dmpFilesize
16.6MB
-
memory/844-44-0x0000000002440000-0x00000000034CE000-memory.dmpFilesize
16.6MB
-
memory/844-46-0x0000000002440000-0x00000000034CE000-memory.dmpFilesize
16.6MB
-
memory/844-48-0x0000000002440000-0x00000000034CE000-memory.dmpFilesize
16.6MB
-
memory/844-50-0x0000000002440000-0x00000000034CE000-memory.dmpFilesize
16.6MB
-
memory/844-52-0x0000000002440000-0x00000000034CE000-memory.dmpFilesize
16.6MB
-
memory/844-54-0x0000000002440000-0x00000000034CE000-memory.dmpFilesize
16.6MB
-
memory/844-56-0x0000000002440000-0x00000000034CE000-memory.dmpFilesize
16.6MB
-
memory/844-58-0x0000000002440000-0x00000000034CE000-memory.dmpFilesize
16.6MB
-
memory/844-59-0x0000000004580000-0x0000000004582000-memory.dmpFilesize
8KB
-
memory/844-61-0x0000000002440000-0x00000000034CE000-memory.dmpFilesize
16.6MB
-
memory/844-63-0x0000000002440000-0x00000000034CE000-memory.dmpFilesize
16.6MB
-
memory/844-65-0x0000000002440000-0x00000000034CE000-memory.dmpFilesize
16.6MB
-
memory/844-67-0x0000000002440000-0x00000000034CE000-memory.dmpFilesize
16.6MB
-
memory/844-68-0x0000000002440000-0x00000000034CE000-memory.dmpFilesize
16.6MB
-
memory/844-1-0x0000000002440000-0x00000000034CE000-memory.dmpFilesize
16.6MB