Analysis
-
max time kernel
137s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10-05-2024 22:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6cd58da990c1a844a117bb0086fdf01360b1a46090f90ba82049ea35d5ced320.dll
Resource
win7-20240508-en
windows7-x64
17 signatures
150 seconds
General
-
Target
6cd58da990c1a844a117bb0086fdf01360b1a46090f90ba82049ea35d5ced320.dll
-
Size
120KB
-
MD5
92ab36523dd715b2dadc88ac91b8fe93
-
SHA1
9bef3d4f324fa18d868c4ec656f0e7a841ae38ba
-
SHA256
6cd58da990c1a844a117bb0086fdf01360b1a46090f90ba82049ea35d5ced320
-
SHA512
e6048c8dff19c9f7f3b48a453e953720240e0132eeea38e56f23925e6e808e6effa985a987ccdd0668e81ce8410ad470eb641abab74dcdaaede0fa8713106816
-
SSDEEP
3072:c14BE9TeCj6lHDOXia2DWmmJOczT/1AHkbv:caBE9TFjiqXkWNNaMv
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e5733c2.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e5733c2.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e5733c2.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5733c2.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5733c2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5733c2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5733c2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e574f78.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e574f78.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5733c2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5733c2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5733c2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e574f78.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e574f78.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e574f78.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e574f78.exe -
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 31 IoCs
resource yara_rule behavioral2/memory/1500-6-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1500-8-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1500-10-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1500-25-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1500-33-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1500-29-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1500-24-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1500-11-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1500-9-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1500-34-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1500-35-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1500-36-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1500-37-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1500-38-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1500-39-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1500-41-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1500-42-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1500-51-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1500-53-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1500-54-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1500-64-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1500-66-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1500-69-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1500-71-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1500-73-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1500-75-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1500-77-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1500-79-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1500-81-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1500-84-0x00000000007C0000-0x000000000187A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4176-110-0x0000000000B20000-0x0000000001BDA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine -
UPX dump on OEP (original entry point) 34 IoCs
resource yara_rule behavioral2/memory/1500-6-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1500-8-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1500-10-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1500-25-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1500-33-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1500-29-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1500-24-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1500-11-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1500-9-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1500-34-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1500-35-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1500-36-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1500-37-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1500-38-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1500-39-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1500-41-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1500-42-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1500-51-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1500-53-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1500-54-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1500-64-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1500-66-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1500-69-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1500-71-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1500-73-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1500-75-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1500-77-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1500-79-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1500-81-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/1500-101-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/1500-84-0x00000000007C0000-0x000000000187A000-memory.dmp UPX behavioral2/memory/4556-105-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4176-111-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4176-110-0x0000000000B20000-0x0000000001BDA000-memory.dmp UPX -
Executes dropped EXE 3 IoCs
pid Process 1500 e5733c2.exe 4556 e5734eb.exe 4176 e574f78.exe -
resource yara_rule behavioral2/memory/1500-6-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1500-8-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1500-10-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1500-25-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1500-33-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1500-29-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1500-24-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1500-11-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1500-9-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1500-34-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1500-35-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1500-36-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1500-37-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1500-38-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1500-39-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1500-41-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1500-42-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1500-51-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1500-53-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1500-54-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1500-64-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1500-66-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1500-69-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1500-71-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1500-73-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1500-75-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1500-77-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1500-79-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1500-81-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1500-84-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4176-110-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5733c2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5733c2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e574f78.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5733c2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5733c2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5733c2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5733c2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e574f78.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e574f78.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e5733c2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e574f78.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e574f78.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e574f78.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e574f78.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5733c2.exe -
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: e5733c2.exe File opened (read-only) \??\N: e5733c2.exe File opened (read-only) \??\R: e5733c2.exe File opened (read-only) \??\M: e5733c2.exe File opened (read-only) \??\O: e5733c2.exe File opened (read-only) \??\Q: e5733c2.exe File opened (read-only) \??\I: e5733c2.exe File opened (read-only) \??\J: e5733c2.exe File opened (read-only) \??\L: e5733c2.exe File opened (read-only) \??\P: e5733c2.exe File opened (read-only) \??\S: e5733c2.exe File opened (read-only) \??\E: e5733c2.exe File opened (read-only) \??\G: e5733c2.exe File opened (read-only) \??\H: e5733c2.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe e5733c2.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e5733c2.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e5733c2.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe e5733c2.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\e57347d e5733c2.exe File opened for modification C:\Windows\SYSTEM.INI e5733c2.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1500 e5733c2.exe 1500 e5733c2.exe 1500 e5733c2.exe 1500 e5733c2.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe Token: SeDebugPrivilege 1500 e5733c2.exe -
Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 916 wrote to memory of 2636 916 rundll32.exe 82 PID 916 wrote to memory of 2636 916 rundll32.exe 82 PID 916 wrote to memory of 2636 916 rundll32.exe 82 PID 2636 wrote to memory of 1500 2636 rundll32.exe 83 PID 2636 wrote to memory of 1500 2636 rundll32.exe 83 PID 2636 wrote to memory of 1500 2636 rundll32.exe 83 PID 1500 wrote to memory of 780 1500 e5733c2.exe 8 PID 1500 wrote to memory of 788 1500 e5733c2.exe 9 PID 1500 wrote to memory of 64 1500 e5733c2.exe 13 PID 1500 wrote to memory of 2672 1500 e5733c2.exe 44 PID 1500 wrote to memory of 2680 1500 e5733c2.exe 45 PID 1500 wrote to memory of 2888 1500 e5733c2.exe 51 PID 1500 wrote to memory of 3444 1500 e5733c2.exe 56 PID 1500 wrote to memory of 3580 1500 e5733c2.exe 57 PID 1500 wrote to memory of 3772 1500 e5733c2.exe 58 PID 1500 wrote to memory of 3868 1500 e5733c2.exe 59 PID 1500 wrote to memory of 3936 1500 e5733c2.exe 60 PID 1500 wrote to memory of 4028 1500 e5733c2.exe 61 PID 1500 wrote to memory of 4196 1500 e5733c2.exe 62 PID 1500 wrote to memory of 3228 1500 e5733c2.exe 73 PID 1500 wrote to memory of 692 1500 e5733c2.exe 74 PID 1500 wrote to memory of 4660 1500 e5733c2.exe 79 PID 1500 wrote to memory of 384 1500 e5733c2.exe 80 PID 1500 wrote to memory of 916 1500 e5733c2.exe 81 PID 1500 wrote to memory of 2636 1500 e5733c2.exe 82 PID 1500 wrote to memory of 2636 1500 e5733c2.exe 82 PID 2636 wrote to memory of 4556 2636 rundll32.exe 84 PID 2636 wrote to memory of 4556 2636 rundll32.exe 84 PID 2636 wrote to memory of 4556 2636 rundll32.exe 84 PID 2636 wrote to memory of 4176 2636 rundll32.exe 96 PID 2636 wrote to memory of 4176 2636 rundll32.exe 96 PID 2636 wrote to memory of 4176 2636 rundll32.exe 96 PID 1500 wrote to memory of 780 1500 e5733c2.exe 8 PID 1500 wrote to memory of 788 1500 e5733c2.exe 9 PID 1500 wrote to memory of 64 1500 e5733c2.exe 13 PID 1500 wrote to memory of 2672 1500 e5733c2.exe 44 PID 1500 wrote to memory of 2680 1500 e5733c2.exe 45 PID 1500 wrote to memory of 2888 1500 e5733c2.exe 51 PID 1500 wrote to memory of 3444 1500 e5733c2.exe 56 PID 1500 wrote to memory of 3580 1500 e5733c2.exe 57 PID 1500 wrote to memory of 3772 1500 e5733c2.exe 58 PID 1500 wrote to memory of 3868 1500 e5733c2.exe 59 PID 1500 wrote to memory of 3936 1500 e5733c2.exe 60 PID 1500 wrote to memory of 4028 1500 e5733c2.exe 61 PID 1500 wrote to memory of 4196 1500 e5733c2.exe 62 PID 1500 wrote to memory of 3228 1500 e5733c2.exe 73 PID 1500 wrote to memory of 692 1500 e5733c2.exe 74 PID 1500 wrote to memory of 4660 1500 e5733c2.exe 79 PID 1500 wrote to memory of 4556 1500 e5733c2.exe 84 PID 1500 wrote to memory of 4556 1500 e5733c2.exe 84 PID 1500 wrote to memory of 4920 1500 e5733c2.exe 86 PID 1500 wrote to memory of 4548 1500 e5733c2.exe 87 PID 1500 wrote to memory of 4176 1500 e5733c2.exe 96 PID 1500 wrote to memory of 4176 1500 e5733c2.exe 96 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5733c2.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:64
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2672
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2680
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2888
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3444
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6cd58da990c1a844a117bb0086fdf01360b1a46090f90ba82049ea35d5ced320.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6cd58da990c1a844a117bb0086fdf01360b1a46090f90ba82049ea35d5ced320.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\e5733c2.exeC:\Users\Admin\AppData\Local\Temp\e5733c2.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1500
-
-
C:\Users\Admin\AppData\Local\Temp\e5734eb.exeC:\Users\Admin\AppData\Local\Temp\e5734eb.exe4⤵
- Executes dropped EXE
PID:4556
-
-
C:\Users\Admin\AppData\Local\Temp\e574f78.exeC:\Users\Admin\AppData\Local\Temp\e574f78.exe4⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
PID:4176
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3580
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3772
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3868
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3936
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4028
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4196
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:3228
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:692
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:4660
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:384
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4920
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4548
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD57a3475188ac8512bb4667629bf74298b
SHA1c57cff47254cf69ee23f11c33a8d9ebc24a4e644
SHA2567865e4b099f332bbc0a27caf27a1657e799a5e5d5aa3e717c4968b9788983a12
SHA512bf55c1c3235fe25db155b550a03a516c895302d41bd26ea673aca9eade5ae9eadb62dfa1609c5f994035fc09779e57e16a3c40fca3d470de95403cbbaeccad9c