Analysis
-
max time kernel
142s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11/05/2024, 04:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e470ffcedd6fd2903e42f8fb98fa53c4157c9ad45851d5163a1a97e1464707cd.dll
Resource
win7-20240220-en
windows7-x64
17 signatures
150 seconds
General
-
Target
e470ffcedd6fd2903e42f8fb98fa53c4157c9ad45851d5163a1a97e1464707cd.dll
-
Size
120KB
-
MD5
5579831294cc44885cfa7b9370127616
-
SHA1
64ddabfbe704bbdecc5f28c484f44468264ebd0d
-
SHA256
e470ffcedd6fd2903e42f8fb98fa53c4157c9ad45851d5163a1a97e1464707cd
-
SHA512
6ec92cd6e185886079cb8e5b731f65924b99c05262b848aa874c58a34c27e8bef51c709ed0d696bc1c66a439041a2dc4c84abc8433dc6b35de8a9a7be96e0b68
-
SSDEEP
3072:ZYrQpwAeOxxGYb1GYLeZts12AeK+hX4ceoOr:ZXcOx+Ztsp6aoO
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57fe26.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e58050c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e58050c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e58050c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57fe26.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57fe26.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57fe26.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e58050c.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57fe26.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57fe26.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e58050c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e58050c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e58050c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57fe26.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57fe26.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57fe26.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e58050c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57fe26.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e58050c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e58050c.exe -
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 32 IoCs
resource yara_rule behavioral2/memory/3656-6-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3656-10-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3656-14-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3656-13-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3656-15-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3656-16-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3656-17-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3656-11-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3656-8-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3656-9-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3656-36-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3656-37-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3656-38-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3656-39-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3656-40-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3656-50-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3656-51-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3656-52-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3656-53-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3656-55-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3656-56-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3656-59-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3656-69-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3656-71-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3656-74-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3656-77-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3656-78-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3656-79-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3656-82-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3656-83-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4456-119-0x0000000000B20000-0x0000000001BDA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4456-132-0x0000000000B20000-0x0000000001BDA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine -
UPX dump on OEP (original entry point) 36 IoCs
resource yara_rule behavioral2/memory/3656-6-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/3656-10-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/3656-14-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/3656-13-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/3656-15-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/3656-16-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/3656-17-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/4456-35-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/3656-11-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/3656-8-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/3656-9-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/3656-36-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/3656-37-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/3656-38-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/3656-39-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/3656-40-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/1480-49-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/3656-50-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/3656-51-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/3656-52-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/3656-53-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/3656-55-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/3656-56-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/3656-59-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/3656-69-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/3656-71-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/3656-74-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/3656-77-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/3656-78-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/3656-79-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/3656-82-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/3656-83-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/3656-102-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4456-119-0x0000000000B20000-0x0000000001BDA000-memory.dmp UPX behavioral2/memory/4456-133-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4456-132-0x0000000000B20000-0x0000000001BDA000-memory.dmp UPX -
Executes dropped EXE 3 IoCs
pid Process 3656 e57fe26.exe 4456 e58050c.exe 1480 e581613.exe -
resource yara_rule behavioral2/memory/3656-6-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3656-10-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3656-14-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3656-13-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3656-15-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3656-16-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3656-17-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3656-11-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3656-8-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3656-9-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3656-36-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3656-37-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3656-38-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3656-39-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3656-40-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3656-50-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3656-51-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3656-52-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3656-53-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3656-55-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3656-56-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3656-59-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3656-69-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3656-71-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3656-74-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3656-77-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3656-78-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3656-79-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3656-82-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3656-83-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/4456-119-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx behavioral2/memory/4456-132-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57fe26.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57fe26.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e58050c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57fe26.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57fe26.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57fe26.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e58050c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e58050c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e58050c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57fe26.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57fe26.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e58050c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e58050c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e58050c.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57fe26.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e58050c.exe -
Enumerates connected drives 3 TTPs 13 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: e57fe26.exe File opened (read-only) \??\E: e57fe26.exe File opened (read-only) \??\I: e57fe26.exe File opened (read-only) \??\K: e57fe26.exe File opened (read-only) \??\N: e57fe26.exe File opened (read-only) \??\Q: e57fe26.exe File opened (read-only) \??\G: e57fe26.exe File opened (read-only) \??\M: e57fe26.exe File opened (read-only) \??\O: e57fe26.exe File opened (read-only) \??\P: e57fe26.exe File opened (read-only) \??\H: e57fe26.exe File opened (read-only) \??\L: e57fe26.exe File opened (read-only) \??\R: e57fe26.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI e57fe26.exe File created C:\Windows\e585484 e58050c.exe File created C:\Windows\e5801ef e57fe26.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3656 e57fe26.exe 3656 e57fe26.exe 3656 e57fe26.exe 3656 e57fe26.exe 4456 e58050c.exe 4456 e58050c.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe Token: SeDebugPrivilege 3656 e57fe26.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1188 wrote to memory of 4660 1188 rundll32.exe 89 PID 1188 wrote to memory of 4660 1188 rundll32.exe 89 PID 1188 wrote to memory of 4660 1188 rundll32.exe 89 PID 4660 wrote to memory of 3656 4660 rundll32.exe 90 PID 4660 wrote to memory of 3656 4660 rundll32.exe 90 PID 4660 wrote to memory of 3656 4660 rundll32.exe 90 PID 3656 wrote to memory of 784 3656 e57fe26.exe 8 PID 3656 wrote to memory of 792 3656 e57fe26.exe 9 PID 3656 wrote to memory of 1020 3656 e57fe26.exe 13 PID 3656 wrote to memory of 2416 3656 e57fe26.exe 41 PID 3656 wrote to memory of 2448 3656 e57fe26.exe 42 PID 3656 wrote to memory of 2584 3656 e57fe26.exe 47 PID 3656 wrote to memory of 3332 3656 e57fe26.exe 56 PID 3656 wrote to memory of 3548 3656 e57fe26.exe 57 PID 3656 wrote to memory of 3744 3656 e57fe26.exe 58 PID 3656 wrote to memory of 3868 3656 e57fe26.exe 59 PID 3656 wrote to memory of 3936 3656 e57fe26.exe 60 PID 3656 wrote to memory of 4028 3656 e57fe26.exe 61 PID 3656 wrote to memory of 4188 3656 e57fe26.exe 62 PID 3656 wrote to memory of 3652 3656 e57fe26.exe 64 PID 3656 wrote to memory of 4576 3656 e57fe26.exe 74 PID 3656 wrote to memory of 3476 3656 e57fe26.exe 76 PID 3656 wrote to memory of 4916 3656 e57fe26.exe 77 PID 3656 wrote to memory of 4452 3656 e57fe26.exe 78 PID 3656 wrote to memory of 4260 3656 e57fe26.exe 79 PID 3656 wrote to memory of 2012 3656 e57fe26.exe 80 PID 3656 wrote to memory of 5016 3656 e57fe26.exe 82 PID 3656 wrote to memory of 4492 3656 e57fe26.exe 83 PID 3656 wrote to memory of 1188 3656 e57fe26.exe 88 PID 3656 wrote to memory of 4660 3656 e57fe26.exe 89 PID 3656 wrote to memory of 4660 3656 e57fe26.exe 89 PID 4660 wrote to memory of 4456 4660 rundll32.exe 91 PID 4660 wrote to memory of 4456 4660 rundll32.exe 91 PID 4660 wrote to memory of 4456 4660 rundll32.exe 91 PID 4660 wrote to memory of 1480 4660 rundll32.exe 92 PID 4660 wrote to memory of 1480 4660 rundll32.exe 92 PID 4660 wrote to memory of 1480 4660 rundll32.exe 92 PID 3656 wrote to memory of 784 3656 e57fe26.exe 8 PID 3656 wrote to memory of 792 3656 e57fe26.exe 9 PID 3656 wrote to memory of 1020 3656 e57fe26.exe 13 PID 3656 wrote to memory of 2416 3656 e57fe26.exe 41 PID 3656 wrote to memory of 2448 3656 e57fe26.exe 42 PID 3656 wrote to memory of 2584 3656 e57fe26.exe 47 PID 3656 wrote to memory of 3332 3656 e57fe26.exe 56 PID 3656 wrote to memory of 3548 3656 e57fe26.exe 57 PID 3656 wrote to memory of 3744 3656 e57fe26.exe 58 PID 3656 wrote to memory of 3868 3656 e57fe26.exe 59 PID 3656 wrote to memory of 3936 3656 e57fe26.exe 60 PID 3656 wrote to memory of 4028 3656 e57fe26.exe 61 PID 3656 wrote to memory of 4188 3656 e57fe26.exe 62 PID 3656 wrote to memory of 3652 3656 e57fe26.exe 64 PID 3656 wrote to memory of 4576 3656 e57fe26.exe 74 PID 3656 wrote to memory of 3476 3656 e57fe26.exe 76 PID 3656 wrote to memory of 4916 3656 e57fe26.exe 77 PID 3656 wrote to memory of 4452 3656 e57fe26.exe 78 PID 3656 wrote to memory of 4260 3656 e57fe26.exe 79 PID 3656 wrote to memory of 2012 3656 e57fe26.exe 80 PID 3656 wrote to memory of 5016 3656 e57fe26.exe 82 PID 3656 wrote to memory of 4492 3656 e57fe26.exe 83 PID 3656 wrote to memory of 4456 3656 e57fe26.exe 91 PID 3656 wrote to memory of 4456 3656 e57fe26.exe 91 PID 3656 wrote to memory of 1480 3656 e57fe26.exe 92 PID 3656 wrote to memory of 1480 3656 e57fe26.exe 92 PID 4456 wrote to memory of 784 4456 e58050c.exe 8 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57fe26.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e58050c.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:792
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1020
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2416
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2448
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2584
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3332
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e470ffcedd6fd2903e42f8fb98fa53c4157c9ad45851d5163a1a97e1464707cd.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e470ffcedd6fd2903e42f8fb98fa53c4157c9ad45851d5163a1a97e1464707cd.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\e57fe26.exeC:\Users\Admin\AppData\Local\Temp\e57fe26.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3656
-
-
C:\Users\Admin\AppData\Local\Temp\e58050c.exeC:\Users\Admin\AppData\Local\Temp\e58050c.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4456
-
-
C:\Users\Admin\AppData\Local\Temp\e581613.exeC:\Users\Admin\AppData\Local\Temp\e581613.exe4⤵
- Executes dropped EXE
PID:1480
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3548
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3744
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3868
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3936
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4028
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4188
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3652
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4576
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window1⤵PID:3476
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff89b692e98,0x7ff89b692ea4,0x7ff89b692eb02⤵PID:4916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2688 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:22⤵PID:4452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2984 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:32⤵PID:4260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2852 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:82⤵PID:2012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --mojo-platform-channel-handle=5400 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:12⤵PID:5016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=5416 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:12⤵PID:4492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4140 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:82⤵PID:1472
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD560af395e8e88aaeb7fc817914f5e4c03
SHA15f45d07f9fac4fff55f151c2aad0f2ddca259d1b
SHA256412f01a7316ab950524784691d20c834591a08693301c9c1942cbb0d02f23402
SHA51296677b3f0715039927a1f83a30bd5a958f81cb14c2a1d82a5ae472fc8fbded3179e01c36c3215a8f1265630594cc661e5ce75fe002b85ca5694a6c5f039d9a99
-
Filesize
257B
MD527c1c5d9ef45489b0c19db8ff030fa8f
SHA13677234678bc717e94a9fde017091af3d4da29ff
SHA2560036a05c5ed5b5b459d165eae0ef021cdf3facc8d254f105e24a417ed6cbe4eb
SHA5122797d718cc06228074b91f7eccb480775680f783d72320823683d9a8ff6fb725da1b5e1e63302f12982c4177acb73af070a5de614eab1698b042bbc1f3a57907