Analysis
-
max time kernel
128s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
24-04-2024 00:23
Behavioral task
behavioral1
Sample
3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe
Resource
win7-20240221-en
General
-
Target
3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe
-
Size
1.9MB
-
MD5
0249e536946ecdee7fc96462981f9051
-
SHA1
f8d57ca34b945114ab12e9d6ab72f798ed9fe101
-
SHA256
3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2
-
SHA512
1893ea7fb7e60a507962ed7efb620478f734f230f1b1f8a6a8541f79dec575dff852b74363048661b9a7de3106593d190846e7edd42da9ba31125fc249497f5d
-
SSDEEP
49152:BM3dbEnmZgJH6iADNsNn/3JQErFu/fEHHhF/poL9WpTo5pp9P:BOdbEnMgJaB5mn/3JQf/snXpi9WpToZt
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe -
Processes:
3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe -
Processes:
3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe -
Processes:
resource yara_rule behavioral2/memory/5100-0-0x0000000000400000-0x00000000006E5000-memory.dmp upx behavioral2/memory/5100-1-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral2/memory/5100-3-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral2/memory/5100-4-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral2/memory/5100-9-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral2/memory/5100-10-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral2/memory/5100-11-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral2/memory/5100-12-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral2/memory/5100-13-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral2/memory/5100-14-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral2/memory/5100-15-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral2/memory/5100-16-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral2/memory/5100-17-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral2/memory/5100-18-0x0000000000400000-0x00000000006E5000-memory.dmp upx behavioral2/memory/5100-19-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral2/memory/5100-20-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral2/memory/5100-22-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral2/memory/5100-24-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral2/memory/5100-25-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral2/memory/5100-27-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral2/memory/5100-28-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral2/memory/5100-29-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral2/memory/5100-31-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral2/memory/5100-34-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral2/memory/5100-38-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral2/memory/5100-40-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral2/memory/5100-42-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral2/memory/5100-44-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral2/memory/5100-46-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral2/memory/5100-48-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral2/memory/5100-50-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral2/memory/5100-53-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral2/memory/5100-55-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral2/memory/5100-62-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral2/memory/5100-65-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral2/memory/5100-67-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral2/memory/5100-69-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral2/memory/5100-71-0x00000000025F0000-0x000000000367E000-memory.dmp upx -
Processes:
3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe -
Processes:
3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exedescription ioc process File opened (read-only) \??\H: 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe File opened (read-only) \??\I: 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe File opened (read-only) \??\O: 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe File opened (read-only) \??\S: 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe File opened (read-only) \??\T: 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe File opened (read-only) \??\Z: 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe File opened (read-only) \??\B: 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe File opened (read-only) \??\E: 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe File opened (read-only) \??\K: 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe File opened (read-only) \??\L: 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe File opened (read-only) \??\V: 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe File opened (read-only) \??\W: 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe File opened (read-only) \??\X: 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe File opened (read-only) \??\M: 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe File opened (read-only) \??\N: 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe File opened (read-only) \??\P: 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe File opened (read-only) \??\R: 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe File opened (read-only) \??\J: 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe File opened (read-only) \??\Q: 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe File opened (read-only) \??\U: 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe File opened (read-only) \??\Y: 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exedescription ioc process File opened for modification C:\autorun.inf 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe File opened for modification F:\autorun.inf 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe -
Drops file in Windows directory 1 IoCs
Processes:
3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exepid process 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exedescription pid process Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Token: SeDebugPrivilege 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exepid process 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exedescription pid process target process PID 5100 wrote to memory of 824 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe fontdrvhost.exe PID 5100 wrote to memory of 828 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe fontdrvhost.exe PID 5100 wrote to memory of 384 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe dwm.exe PID 5100 wrote to memory of 3052 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe sihost.exe PID 5100 wrote to memory of 2524 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe svchost.exe PID 5100 wrote to memory of 772 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe taskhostw.exe PID 5100 wrote to memory of 3468 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Explorer.EXE PID 5100 wrote to memory of 3572 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe svchost.exe PID 5100 wrote to memory of 3760 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe DllHost.exe PID 5100 wrote to memory of 3848 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe StartMenuExperienceHost.exe PID 5100 wrote to memory of 3912 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe RuntimeBroker.exe PID 5100 wrote to memory of 4000 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe SearchApp.exe PID 5100 wrote to memory of 3484 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe RuntimeBroker.exe PID 5100 wrote to memory of 1776 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe RuntimeBroker.exe PID 5100 wrote to memory of 4440 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe TextInputHost.exe PID 5100 wrote to memory of 3980 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe backgroundTaskHost.exe PID 5100 wrote to memory of 3984 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe backgroundTaskHost.exe PID 5100 wrote to memory of 1720 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe backgroundTaskHost.exe PID 5100 wrote to memory of 824 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe fontdrvhost.exe PID 5100 wrote to memory of 828 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe fontdrvhost.exe PID 5100 wrote to memory of 384 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe dwm.exe PID 5100 wrote to memory of 3052 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe sihost.exe PID 5100 wrote to memory of 2524 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe svchost.exe PID 5100 wrote to memory of 772 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe taskhostw.exe PID 5100 wrote to memory of 3468 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Explorer.EXE PID 5100 wrote to memory of 3572 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe svchost.exe PID 5100 wrote to memory of 3760 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe DllHost.exe PID 5100 wrote to memory of 3848 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe StartMenuExperienceHost.exe PID 5100 wrote to memory of 3912 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe RuntimeBroker.exe PID 5100 wrote to memory of 4000 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe SearchApp.exe PID 5100 wrote to memory of 3484 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe RuntimeBroker.exe PID 5100 wrote to memory of 1776 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe RuntimeBroker.exe PID 5100 wrote to memory of 4440 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe TextInputHost.exe PID 5100 wrote to memory of 3980 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe backgroundTaskHost.exe PID 5100 wrote to memory of 3984 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe backgroundTaskHost.exe PID 5100 wrote to memory of 4980 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe RuntimeBroker.exe PID 5100 wrote to memory of 1616 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe RuntimeBroker.exe PID 5100 wrote to memory of 824 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe fontdrvhost.exe PID 5100 wrote to memory of 828 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe fontdrvhost.exe PID 5100 wrote to memory of 384 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe dwm.exe PID 5100 wrote to memory of 3052 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe sihost.exe PID 5100 wrote to memory of 2524 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe svchost.exe PID 5100 wrote to memory of 772 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe taskhostw.exe PID 5100 wrote to memory of 3468 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Explorer.EXE PID 5100 wrote to memory of 3572 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe svchost.exe PID 5100 wrote to memory of 3760 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe DllHost.exe PID 5100 wrote to memory of 3848 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe StartMenuExperienceHost.exe PID 5100 wrote to memory of 3912 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe RuntimeBroker.exe PID 5100 wrote to memory of 4000 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe SearchApp.exe PID 5100 wrote to memory of 3484 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe RuntimeBroker.exe PID 5100 wrote to memory of 1776 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe RuntimeBroker.exe PID 5100 wrote to memory of 4440 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe TextInputHost.exe PID 5100 wrote to memory of 3980 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe backgroundTaskHost.exe PID 5100 wrote to memory of 3984 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe backgroundTaskHost.exe PID 5100 wrote to memory of 4980 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe RuntimeBroker.exe PID 5100 wrote to memory of 1616 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe RuntimeBroker.exe PID 5100 wrote to memory of 824 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe fontdrvhost.exe PID 5100 wrote to memory of 828 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe fontdrvhost.exe PID 5100 wrote to memory of 384 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe dwm.exe PID 5100 wrote to memory of 3052 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe sihost.exe PID 5100 wrote to memory of 2524 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe svchost.exe PID 5100 wrote to memory of 772 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe taskhostw.exe PID 5100 wrote to memory of 3468 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe Explorer.EXE PID 5100 wrote to memory of 3572 5100 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe svchost.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe"C:\Users\Admin\AppData\Local\Temp\3953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
F:\ksno.exeFilesize
96KB
MD5aa203a61469e4ae9d1498863a5da478f
SHA1776730f895b77dd00b72251ced833d0ce55b0cc5
SHA256dccf0f95f00d32a43f2ff9fdb901a7e4ad192ade5c6d584994aa8cb8a30dbc43
SHA5129de8c3ffab20debe181fdac86520a97439b415225b411f3b64403a8722158240cbf779af1a06eeb342bfa07b0e21fdf63119ca10e3194bc0449a5b5a71eedab1
-
memory/5100-24-0x00000000025F0000-0x000000000367E000-memory.dmpFilesize
16.6MB
-
memory/5100-10-0x00000000025F0000-0x000000000367E000-memory.dmpFilesize
16.6MB
-
memory/5100-28-0x00000000025F0000-0x000000000367E000-memory.dmpFilesize
16.6MB
-
memory/5100-4-0x00000000025F0000-0x000000000367E000-memory.dmpFilesize
16.6MB
-
memory/5100-6-0x0000000005EF0000-0x0000000005EF1000-memory.dmpFilesize
4KB
-
memory/5100-8-0x00000000046B0000-0x00000000046B2000-memory.dmpFilesize
8KB
-
memory/5100-9-0x00000000025F0000-0x000000000367E000-memory.dmpFilesize
16.6MB
-
memory/5100-27-0x00000000025F0000-0x000000000367E000-memory.dmpFilesize
16.6MB
-
memory/5100-11-0x00000000025F0000-0x000000000367E000-memory.dmpFilesize
16.6MB
-
memory/5100-12-0x00000000025F0000-0x000000000367E000-memory.dmpFilesize
16.6MB
-
memory/5100-13-0x00000000025F0000-0x000000000367E000-memory.dmpFilesize
16.6MB
-
memory/5100-14-0x00000000025F0000-0x000000000367E000-memory.dmpFilesize
16.6MB
-
memory/5100-25-0x00000000025F0000-0x000000000367E000-memory.dmpFilesize
16.6MB
-
memory/5100-16-0x00000000025F0000-0x000000000367E000-memory.dmpFilesize
16.6MB
-
memory/5100-17-0x00000000025F0000-0x000000000367E000-memory.dmpFilesize
16.6MB
-
memory/5100-18-0x0000000000400000-0x00000000006E5000-memory.dmpFilesize
2.9MB
-
memory/5100-19-0x00000000025F0000-0x000000000367E000-memory.dmpFilesize
16.6MB
-
memory/5100-20-0x00000000025F0000-0x000000000367E000-memory.dmpFilesize
16.6MB
-
memory/5100-22-0x00000000025F0000-0x000000000367E000-memory.dmpFilesize
16.6MB
-
memory/5100-0-0x0000000000400000-0x00000000006E5000-memory.dmpFilesize
2.9MB
-
memory/5100-15-0x00000000025F0000-0x000000000367E000-memory.dmpFilesize
16.6MB
-
memory/5100-3-0x00000000025F0000-0x000000000367E000-memory.dmpFilesize
16.6MB
-
memory/5100-5-0x00000000046B0000-0x00000000046B2000-memory.dmpFilesize
8KB
-
memory/5100-29-0x00000000025F0000-0x000000000367E000-memory.dmpFilesize
16.6MB
-
memory/5100-31-0x00000000025F0000-0x000000000367E000-memory.dmpFilesize
16.6MB
-
memory/5100-34-0x00000000025F0000-0x000000000367E000-memory.dmpFilesize
16.6MB
-
memory/5100-38-0x00000000025F0000-0x000000000367E000-memory.dmpFilesize
16.6MB
-
memory/5100-40-0x00000000025F0000-0x000000000367E000-memory.dmpFilesize
16.6MB
-
memory/5100-42-0x00000000025F0000-0x000000000367E000-memory.dmpFilesize
16.6MB
-
memory/5100-44-0x00000000025F0000-0x000000000367E000-memory.dmpFilesize
16.6MB
-
memory/5100-46-0x00000000025F0000-0x000000000367E000-memory.dmpFilesize
16.6MB
-
memory/5100-48-0x00000000025F0000-0x000000000367E000-memory.dmpFilesize
16.6MB
-
memory/5100-50-0x00000000025F0000-0x000000000367E000-memory.dmpFilesize
16.6MB
-
memory/5100-52-0x00000000046B0000-0x00000000046B2000-memory.dmpFilesize
8KB
-
memory/5100-53-0x00000000025F0000-0x000000000367E000-memory.dmpFilesize
16.6MB
-
memory/5100-55-0x00000000025F0000-0x000000000367E000-memory.dmpFilesize
16.6MB
-
memory/5100-62-0x00000000025F0000-0x000000000367E000-memory.dmpFilesize
16.6MB
-
memory/5100-65-0x00000000025F0000-0x000000000367E000-memory.dmpFilesize
16.6MB
-
memory/5100-67-0x00000000025F0000-0x000000000367E000-memory.dmpFilesize
16.6MB
-
memory/5100-69-0x00000000025F0000-0x000000000367E000-memory.dmpFilesize
16.6MB
-
memory/5100-71-0x00000000025F0000-0x000000000367E000-memory.dmpFilesize
16.6MB
-
memory/5100-1-0x00000000025F0000-0x000000000367E000-memory.dmpFilesize
16.6MB