Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
43s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 12:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe
Resource
win7-20240221-en
windows7-x64
16 signatures
150 seconds
General
-
Target
6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe
-
Size
1.5MB
-
MD5
6d5cc055892a6bed4dd3bf2792fd568c
-
SHA1
fb864ceb1803f707d6536555eb55d20c9e2b0b58
-
SHA256
6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b
-
SHA512
36de47cd364054a68fe02da28acc2c176dd5299e2439d6c088ed03c804ac0b954dc303c69e36d90cc554d0e1d53c8c472ad89eccb173087131add3d198dd4b1b
-
SSDEEP
24576:GLFZeV9rUW3uRIgRNMv88q9s14+6fsqetItnwn56fTbGXf9q:QFgVIRIgRNMk8qq1bSsqEw/p
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe -
resource yara_rule behavioral2/memory/3452-1-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/3452-3-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/3452-4-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/3452-8-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/3452-5-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/3452-9-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/3452-12-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/3452-13-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/3452-14-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/3452-17-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/3452-16-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/3452-18-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/3452-20-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/3452-19-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/3452-26-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/3452-27-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/3452-28-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/3452-30-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/3452-31-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/3452-33-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/3452-34-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/3452-36-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/3452-40-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/3452-42-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/3452-43-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/3452-50-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/4140-64-0x0000000002BF0000-0x0000000003C7E000-memory.dmp upx behavioral2/memory/4140-72-0x0000000002BF0000-0x0000000003C7E000-memory.dmp upx behavioral2/memory/4140-69-0x0000000002BF0000-0x0000000003C7E000-memory.dmp upx behavioral2/memory/4140-70-0x0000000002BF0000-0x0000000003C7E000-memory.dmp upx behavioral2/memory/4140-68-0x0000000002BF0000-0x0000000003C7E000-memory.dmp upx behavioral2/memory/4140-67-0x0000000002BF0000-0x0000000003C7E000-memory.dmp upx behavioral2/memory/4140-66-0x0000000002BF0000-0x0000000003C7E000-memory.dmp upx behavioral2/memory/4140-62-0x0000000002BF0000-0x0000000003C7E000-memory.dmp upx behavioral2/memory/4140-128-0x0000000002BF0000-0x0000000003C7E000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe -
Enumerates connected drives 3 TTPs 16 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe File opened (read-only) \??\K: 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe File opened (read-only) \??\M: 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe File opened (read-only) \??\E: 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe File opened (read-only) \??\G: 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe File opened (read-only) \??\N: 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe File opened (read-only) \??\O: 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe File opened (read-only) \??\H: 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe File opened (read-only) \??\I: 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe File opened (read-only) \??\J: 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe File opened (read-only) \??\E: 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe File opened (read-only) \??\I: 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe File opened (read-only) \??\G: 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe File opened (read-only) \??\H: 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe File opened (read-only) \??\L: 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe File opened (read-only) \??\K: 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 4140 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 4140 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 4140 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 4140 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Token: SeDebugPrivilege 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3452 wrote to memory of 776 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 8 PID 3452 wrote to memory of 784 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 9 PID 3452 wrote to memory of 316 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 13 PID 3452 wrote to memory of 2928 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 49 PID 3452 wrote to memory of 2972 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 50 PID 3452 wrote to memory of 2744 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 52 PID 3452 wrote to memory of 3372 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 56 PID 3452 wrote to memory of 3524 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 57 PID 3452 wrote to memory of 3744 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 58 PID 3452 wrote to memory of 3840 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 59 PID 3452 wrote to memory of 3900 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 60 PID 3452 wrote to memory of 3988 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 61 PID 3452 wrote to memory of 4092 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 62 PID 3452 wrote to memory of 3028 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 74 PID 3452 wrote to memory of 2732 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 75 PID 3452 wrote to memory of 3860 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 76 PID 3452 wrote to memory of 3944 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 80 PID 3452 wrote to memory of 1008 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 81 PID 3452 wrote to memory of 4140 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 84 PID 3452 wrote to memory of 4140 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 84 PID 3452 wrote to memory of 4140 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 84 PID 3452 wrote to memory of 776 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 8 PID 3452 wrote to memory of 784 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 9 PID 3452 wrote to memory of 316 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 13 PID 3452 wrote to memory of 2928 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 49 PID 3452 wrote to memory of 2972 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 50 PID 3452 wrote to memory of 2744 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 52 PID 3452 wrote to memory of 3372 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 56 PID 3452 wrote to memory of 3524 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 57 PID 3452 wrote to memory of 3744 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 58 PID 3452 wrote to memory of 3840 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 59 PID 3452 wrote to memory of 3900 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 60 PID 3452 wrote to memory of 3988 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 61 PID 3452 wrote to memory of 4092 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 62 PID 3452 wrote to memory of 3028 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 74 PID 3452 wrote to memory of 2732 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 75 PID 3452 wrote to memory of 3860 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 76 PID 3452 wrote to memory of 3944 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 80 PID 3452 wrote to memory of 1008 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 81 PID 3452 wrote to memory of 4140 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 84 PID 3452 wrote to memory of 4140 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 84 PID 3452 wrote to memory of 3552 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 86 PID 3452 wrote to memory of 776 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 8 PID 3452 wrote to memory of 784 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 9 PID 3452 wrote to memory of 316 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 13 PID 3452 wrote to memory of 2928 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 49 PID 3452 wrote to memory of 2972 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 50 PID 3452 wrote to memory of 2744 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 52 PID 3452 wrote to memory of 3372 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 56 PID 3452 wrote to memory of 3524 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 57 PID 3452 wrote to memory of 3744 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 58 PID 3452 wrote to memory of 3840 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 59 PID 3452 wrote to memory of 3900 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 60 PID 3452 wrote to memory of 3988 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 61 PID 3452 wrote to memory of 4092 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 62 PID 3452 wrote to memory of 3028 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 74 PID 3452 wrote to memory of 2732 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 75 PID 3452 wrote to memory of 3860 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 76 PID 3452 wrote to memory of 3944 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 80 PID 3452 wrote to memory of 3552 3452 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 86 PID 4140 wrote to memory of 776 4140 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 8 PID 4140 wrote to memory of 784 4140 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 9 PID 4140 wrote to memory of 316 4140 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 13 PID 4140 wrote to memory of 2928 4140 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe 49 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:776
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:316
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2928
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2972
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2744
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe"C:\Users\Admin\AppData\Local\Temp\6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe"C:\Users\Admin\AppData\Local\Temp\6dc5827abd1a28762d0617e30d0997048a14fad7e7c15a9c9557e1b3ba6cc55b.exe" --ws3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4140
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3524
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3744
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3840
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3900
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3988
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4092
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:3028
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2732
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3860
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:3944
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:1008
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3552
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD5586ae575b9bd3733da80995413329fdd
SHA12d45d946660cfed16c098292acfe4501bd46ad68
SHA2567680f9c8c978db0f4561c25eb0e2d06394c060d83c6886901249938cea4d2871
SHA512296d9780cb320d49cc78942aa0dfd48ecfd76ca0b63484b93dfa6f2724795bb29fb3916c84aa00d5ff984c3682e2cd4a66e1322dd97e9b8a2373d38b6970eb0f
-
Filesize
100KB
MD59e402c4618bf34d7122c3fc9fce00c5c
SHA1fd28797aff8d59e86e9f75545f63bb8801f64175
SHA25680046f825341d59ff471c3b6965e232d721e1519f65f5712f3b08ce170802129
SHA5128ab34bf62eba90ebe3970d76635c545dec3f5f2ad8229110078af3a3d472f5dff57b4ac0c6c14ddcf34e6c0bd4125e5113e25a5104955652e3cadd8867938e6d