Analysis
-
max time kernel
123s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-04-2024 00:23
Behavioral task
behavioral1
Sample
3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe
Resource
win7-20240221-en
General
-
Target
3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe
-
Size
1.9MB
-
MD5
0249e536946ecdee7fc96462981f9051
-
SHA1
f8d57ca34b945114ab12e9d6ab72f798ed9fe101
-
SHA256
3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2
-
SHA512
1893ea7fb7e60a507962ed7efb620478f734f230f1b1f8a6a8541f79dec575dff852b74363048661b9a7de3106593d190846e7edd42da9ba31125fc249497f5d
-
SSDEEP
49152:BM3dbEnmZgJH6iADNsNn/3JQErFu/fEHHhF/poL9WpTo5pp9P:BOdbEnMgJaB5mn/3JQf/snXpi9WpToZt
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe -
Processes:
3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe -
Processes:
3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe -
Processes:
resource yara_rule behavioral1/memory/2784-1-0x0000000000400000-0x00000000006E5000-memory.dmp upx behavioral1/memory/2784-0-0x0000000002230000-0x00000000032BE000-memory.dmp upx behavioral1/memory/2784-3-0x0000000002230000-0x00000000032BE000-memory.dmp upx behavioral1/memory/2784-4-0x0000000002230000-0x00000000032BE000-memory.dmp upx behavioral1/memory/2784-5-0x0000000002230000-0x00000000032BE000-memory.dmp upx behavioral1/memory/2784-7-0x0000000002230000-0x00000000032BE000-memory.dmp upx behavioral1/memory/2784-6-0x0000000002230000-0x00000000032BE000-memory.dmp upx behavioral1/memory/2784-8-0x0000000002230000-0x00000000032BE000-memory.dmp upx behavioral1/memory/2784-10-0x0000000002230000-0x00000000032BE000-memory.dmp upx behavioral1/memory/2784-12-0x0000000002230000-0x00000000032BE000-memory.dmp upx behavioral1/memory/2784-25-0x0000000002230000-0x00000000032BE000-memory.dmp upx behavioral1/memory/2784-26-0x0000000002230000-0x00000000032BE000-memory.dmp upx behavioral1/memory/2784-27-0x0000000002230000-0x00000000032BE000-memory.dmp upx behavioral1/memory/2784-28-0x0000000002230000-0x00000000032BE000-memory.dmp upx behavioral1/memory/2784-29-0x0000000002230000-0x00000000032BE000-memory.dmp upx behavioral1/memory/2784-31-0x0000000002230000-0x00000000032BE000-memory.dmp upx behavioral1/memory/2784-32-0x0000000002230000-0x00000000032BE000-memory.dmp upx behavioral1/memory/2784-33-0x0000000002230000-0x00000000032BE000-memory.dmp upx behavioral1/memory/2784-35-0x0000000002230000-0x00000000032BE000-memory.dmp upx behavioral1/memory/2784-37-0x0000000002230000-0x00000000032BE000-memory.dmp upx behavioral1/memory/2784-39-0x0000000002230000-0x00000000032BE000-memory.dmp upx behavioral1/memory/2784-41-0x0000000000400000-0x00000000006E5000-memory.dmp upx behavioral1/memory/2784-46-0x0000000002230000-0x00000000032BE000-memory.dmp upx behavioral1/memory/2784-48-0x0000000002230000-0x00000000032BE000-memory.dmp upx behavioral1/memory/2784-50-0x0000000002230000-0x00000000032BE000-memory.dmp upx behavioral1/memory/2784-52-0x0000000002230000-0x00000000032BE000-memory.dmp upx behavioral1/memory/2784-54-0x0000000002230000-0x00000000032BE000-memory.dmp upx behavioral1/memory/2784-56-0x0000000002230000-0x00000000032BE000-memory.dmp upx behavioral1/memory/2784-58-0x0000000002230000-0x00000000032BE000-memory.dmp upx behavioral1/memory/2784-60-0x0000000002230000-0x00000000032BE000-memory.dmp upx behavioral1/memory/2784-62-0x0000000002230000-0x00000000032BE000-memory.dmp upx -
Processes:
3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe -
Processes:
3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe -
Enumerates connected drives 3 TTPs 20 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exedescription ioc process File opened (read-only) \??\T: 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe File opened (read-only) \??\Y: 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe File opened (read-only) \??\W: 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe File opened (read-only) \??\G: 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe File opened (read-only) \??\I: 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe File opened (read-only) \??\K: 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe File opened (read-only) \??\L: 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe File opened (read-only) \??\N: 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe File opened (read-only) \??\P: 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe File opened (read-only) \??\R: 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe File opened (read-only) \??\E: 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe File opened (read-only) \??\J: 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe File opened (read-only) \??\M: 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe File opened (read-only) \??\Q: 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe File opened (read-only) \??\S: 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe File opened (read-only) \??\V: 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe File opened (read-only) \??\H: 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe File opened (read-only) \??\O: 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe File opened (read-only) \??\U: 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe File opened (read-only) \??\Z: 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exedescription ioc process File opened for modification C:\autorun.inf 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe File opened for modification F:\autorun.inf 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe -
Drops file in Program Files directory 5 IoCs
Processes:
3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exedescription ioc process File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe -
Drops file in Windows directory 1 IoCs
Processes:
3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exepid process 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe -
Suspicious use of AdjustPrivilegeToken 33 IoCs
Processes:
3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exedescription pid process Token: SeDebugPrivilege 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exepid process 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exedescription pid process target process PID 2784 wrote to memory of 1132 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe taskhost.exe PID 2784 wrote to memory of 1188 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Dwm.exe PID 2784 wrote to memory of 1216 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Explorer.EXE PID 2784 wrote to memory of 1912 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe DllHost.exe PID 2784 wrote to memory of 1132 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe taskhost.exe PID 2784 wrote to memory of 1188 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Dwm.exe PID 2784 wrote to memory of 1216 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Explorer.EXE PID 2784 wrote to memory of 1132 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe taskhost.exe PID 2784 wrote to memory of 1188 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Dwm.exe PID 2784 wrote to memory of 1216 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Explorer.EXE PID 2784 wrote to memory of 1132 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe taskhost.exe PID 2784 wrote to memory of 1188 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Dwm.exe PID 2784 wrote to memory of 1216 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Explorer.EXE PID 2784 wrote to memory of 1132 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe taskhost.exe PID 2784 wrote to memory of 1188 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Dwm.exe PID 2784 wrote to memory of 1216 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Explorer.EXE PID 2784 wrote to memory of 1132 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe taskhost.exe PID 2784 wrote to memory of 1188 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Dwm.exe PID 2784 wrote to memory of 1216 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Explorer.EXE PID 2784 wrote to memory of 1132 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe taskhost.exe PID 2784 wrote to memory of 1188 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Dwm.exe PID 2784 wrote to memory of 1216 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Explorer.EXE PID 2784 wrote to memory of 1132 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe taskhost.exe PID 2784 wrote to memory of 1188 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Dwm.exe PID 2784 wrote to memory of 1216 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Explorer.EXE PID 2784 wrote to memory of 1132 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe taskhost.exe PID 2784 wrote to memory of 1188 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Dwm.exe PID 2784 wrote to memory of 1216 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Explorer.EXE PID 2784 wrote to memory of 1132 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe taskhost.exe PID 2784 wrote to memory of 1188 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Dwm.exe PID 2784 wrote to memory of 1216 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Explorer.EXE PID 2784 wrote to memory of 1132 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe taskhost.exe PID 2784 wrote to memory of 1188 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Dwm.exe PID 2784 wrote to memory of 1216 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Explorer.EXE PID 2784 wrote to memory of 1132 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe taskhost.exe PID 2784 wrote to memory of 1188 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Dwm.exe PID 2784 wrote to memory of 1216 2784 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Explorer.EXE -
System policy modification 1 TTPs 1 IoCs
Processes:
3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe"C:\Users\Admin\AppData\Local\Temp\3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
F:\tjqiq.exeFilesize
96KB
MD57efffe6f42820e6e90a913f7c36b6c7c
SHA14661e0cff3e9ac28a5223a0c46b2da3e5c5d25d4
SHA25674358e23fc832f8fe0add1bee5e3c61b2a0c156c6566349a891d1993bd25b8b7
SHA51239af8da45554743c8b335041ab58feaabbaeef2282249dbe0a86451ce1afc0f172dee05f3c376cda90288cf0d72aef328f04aebdeace3ebd981ebb7d6efa104b
-
memory/1132-9-0x00000000000F0000-0x00000000000F2000-memory.dmpFilesize
8KB
-
memory/2784-27-0x0000000002230000-0x00000000032BE000-memory.dmpFilesize
16.6MB
-
memory/2784-73-0x0000000000790000-0x0000000000792000-memory.dmpFilesize
8KB
-
memory/2784-5-0x0000000002230000-0x00000000032BE000-memory.dmpFilesize
16.6MB
-
memory/2784-29-0x0000000002230000-0x00000000032BE000-memory.dmpFilesize
16.6MB
-
memory/2784-6-0x0000000002230000-0x00000000032BE000-memory.dmpFilesize
16.6MB
-
memory/2784-3-0x0000000002230000-0x00000000032BE000-memory.dmpFilesize
16.6MB
-
memory/2784-8-0x0000000002230000-0x00000000032BE000-memory.dmpFilesize
16.6MB
-
memory/2784-10-0x0000000002230000-0x00000000032BE000-memory.dmpFilesize
16.6MB
-
memory/2784-21-0x0000000000790000-0x0000000000792000-memory.dmpFilesize
8KB
-
memory/2784-20-0x0000000002060000-0x0000000002061000-memory.dmpFilesize
4KB
-
memory/2784-19-0x0000000000790000-0x0000000000792000-memory.dmpFilesize
8KB
-
memory/2784-12-0x0000000002230000-0x00000000032BE000-memory.dmpFilesize
16.6MB
-
memory/2784-22-0x0000000000790000-0x0000000000792000-memory.dmpFilesize
8KB
-
memory/2784-24-0x0000000002060000-0x0000000002061000-memory.dmpFilesize
4KB
-
memory/2784-25-0x0000000002230000-0x00000000032BE000-memory.dmpFilesize
16.6MB
-
memory/2784-26-0x0000000002230000-0x00000000032BE000-memory.dmpFilesize
16.6MB
-
memory/2784-1-0x0000000000400000-0x00000000006E5000-memory.dmpFilesize
2.9MB
-
memory/2784-28-0x0000000002230000-0x00000000032BE000-memory.dmpFilesize
16.6MB
-
memory/2784-7-0x0000000002230000-0x00000000032BE000-memory.dmpFilesize
16.6MB
-
memory/2784-4-0x0000000002230000-0x00000000032BE000-memory.dmpFilesize
16.6MB
-
memory/2784-33-0x0000000002230000-0x00000000032BE000-memory.dmpFilesize
16.6MB
-
memory/2784-32-0x0000000002230000-0x00000000032BE000-memory.dmpFilesize
16.6MB
-
memory/2784-35-0x0000000002230000-0x00000000032BE000-memory.dmpFilesize
16.6MB
-
memory/2784-37-0x0000000002230000-0x00000000032BE000-memory.dmpFilesize
16.6MB
-
memory/2784-39-0x0000000002230000-0x00000000032BE000-memory.dmpFilesize
16.6MB
-
memory/2784-41-0x0000000000400000-0x00000000006E5000-memory.dmpFilesize
2.9MB
-
memory/2784-46-0x0000000002230000-0x00000000032BE000-memory.dmpFilesize
16.6MB
-
memory/2784-48-0x0000000002230000-0x00000000032BE000-memory.dmpFilesize
16.6MB
-
memory/2784-50-0x0000000002230000-0x00000000032BE000-memory.dmpFilesize
16.6MB
-
memory/2784-52-0x0000000002230000-0x00000000032BE000-memory.dmpFilesize
16.6MB
-
memory/2784-54-0x0000000002230000-0x00000000032BE000-memory.dmpFilesize
16.6MB
-
memory/2784-56-0x0000000002230000-0x00000000032BE000-memory.dmpFilesize
16.6MB
-
memory/2784-58-0x0000000002230000-0x00000000032BE000-memory.dmpFilesize
16.6MB
-
memory/2784-60-0x0000000002230000-0x00000000032BE000-memory.dmpFilesize
16.6MB
-
memory/2784-62-0x0000000002230000-0x00000000032BE000-memory.dmpFilesize
16.6MB
-
memory/2784-31-0x0000000002230000-0x00000000032BE000-memory.dmpFilesize
16.6MB
-
memory/2784-0-0x0000000002230000-0x00000000032BE000-memory.dmpFilesize
16.6MB