Analysis
- max time kernel
113s - max time network
133s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
17/05/2024, 21:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
562b40b296f7dc287ca0b03a6975af5b3286fad0e7c6f0600dbf86a4e7b67d86.dll
Resource
win7-20240508-en
windows7-x64
17 signatures
150 seconds
General
- Target 562b40b296f7dc287ca0b03a6975af5b3286fad0e7c6f0600dbf86a4e7b67d86.dll
- Size 120KB
- Sample240517-1tpgesda91
- SHA256 562b40b296f7dc287ca0b03a6975af5b3286fad0e7c6f0600dbf86a4e7b67d86
- MD5 cee99912451d17d5b1fd3ce40ba200dd
- SHA1 b19d9bc483fa756cd991f36295599303562c8995
- SHA512 4cae61889e9ac0bb8ac0a58871f39885b33bf12b100029960d6b9f7a4258f14854255c17db25186edffb55fc65140bb55683e609c2ae84adc8e6e65f015b64a7
- SSDEEP 3072:IugIkyVqbfcerI33p5Aicgt6j1lXfDsgehwQjH:Iug3yWniZGicgtklX4gehVH
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e573cbb.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e576ad0.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e576ad0.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e576ad0.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e573cbb.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e573cbb.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e573cbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e576ad0.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e576ad0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e576ad0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e576ad0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e576ad0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e573cbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e573cbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e573cbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e573cbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e576ad0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e576ad0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e573cbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e573cbb.exe - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 28 IoCs
resource yara_rule behavioral2/memory/4644-10-0x0000000000800000-0x00000000018BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4644-11-0x0000000000800000-0x00000000018BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4644-9-0x0000000000800000-0x00000000018BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4644-8-0x0000000000800000-0x00000000018BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4644-6-0x0000000000800000-0x00000000018BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4644-12-0x0000000000800000-0x00000000018BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4644-18-0x0000000000800000-0x00000000018BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4644-19-0x0000000000800000-0x00000000018BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4644-24-0x0000000000800000-0x00000000018BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4644-33-0x0000000000800000-0x00000000018BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4644-35-0x0000000000800000-0x00000000018BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4644-37-0x0000000000800000-0x00000000018BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4644-36-0x0000000000800000-0x00000000018BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4644-38-0x0000000000800000-0x00000000018BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4644-39-0x0000000000800000-0x00000000018BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4644-40-0x0000000000800000-0x00000000018BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4644-54-0x0000000000800000-0x00000000018BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4644-55-0x0000000000800000-0x00000000018BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4644-56-0x0000000000800000-0x00000000018BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4644-58-0x0000000000800000-0x00000000018BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4644-60-0x0000000000800000-0x00000000018BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4644-61-0x0000000000800000-0x00000000018BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4644-62-0x0000000000800000-0x00000000018BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4644-65-0x0000000000800000-0x00000000018BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4644-67-0x0000000000800000-0x00000000018BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5044-95-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5044-104-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5044-142-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 33 IoCs
resource yara_rule behavioral2/memory/4644-5-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4644-10-0x0000000000800000-0x00000000018BA000-memory.dmp UPX behavioral2/memory/4644-11-0x0000000000800000-0x00000000018BA000-memory.dmp UPX behavioral2/memory/4644-9-0x0000000000800000-0x00000000018BA000-memory.dmp UPX behavioral2/memory/4644-8-0x0000000000800000-0x00000000018BA000-memory.dmp UPX behavioral2/memory/4644-6-0x0000000000800000-0x00000000018BA000-memory.dmp UPX behavioral2/memory/4644-12-0x0000000000800000-0x00000000018BA000-memory.dmp UPX behavioral2/memory/4644-18-0x0000000000800000-0x00000000018BA000-memory.dmp UPX behavioral2/memory/4644-19-0x0000000000800000-0x00000000018BA000-memory.dmp UPX behavioral2/memory/2640-34-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4644-24-0x0000000000800000-0x00000000018BA000-memory.dmp UPX behavioral2/memory/4644-33-0x0000000000800000-0x00000000018BA000-memory.dmp UPX behavioral2/memory/4644-35-0x0000000000800000-0x00000000018BA000-memory.dmp UPX behavioral2/memory/4644-37-0x0000000000800000-0x00000000018BA000-memory.dmp UPX behavioral2/memory/4644-36-0x0000000000800000-0x00000000018BA000-memory.dmp UPX behavioral2/memory/4644-38-0x0000000000800000-0x00000000018BA000-memory.dmp UPX behavioral2/memory/4644-39-0x0000000000800000-0x00000000018BA000-memory.dmp UPX behavioral2/memory/4644-40-0x0000000000800000-0x00000000018BA000-memory.dmp UPX behavioral2/memory/4644-54-0x0000000000800000-0x00000000018BA000-memory.dmp UPX behavioral2/memory/4644-55-0x0000000000800000-0x00000000018BA000-memory.dmp UPX behavioral2/memory/4644-56-0x0000000000800000-0x00000000018BA000-memory.dmp UPX behavioral2/memory/4644-58-0x0000000000800000-0x00000000018BA000-memory.dmp UPX behavioral2/memory/4644-60-0x0000000000800000-0x00000000018BA000-memory.dmp UPX behavioral2/memory/4644-61-0x0000000000800000-0x00000000018BA000-memory.dmp UPX behavioral2/memory/4644-62-0x0000000000800000-0x00000000018BA000-memory.dmp UPX behavioral2/memory/4644-65-0x0000000000800000-0x00000000018BA000-memory.dmp UPX behavioral2/memory/4644-67-0x0000000000800000-0x00000000018BA000-memory.dmp UPX behavioral2/memory/4644-86-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/2640-90-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/5044-95-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/5044-104-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/5044-142-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/5044-143-0x0000000000400000-0x0000000000412000-memory.dmp UPX - Executes dropped EXE 3 IoCs
pid Process 4644 e573cbb.exe 2640 e573e70.exe 5044 e576ad0.exe -
resource yara_rule behavioral2/memory/4644-10-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/4644-11-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/4644-9-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/4644-8-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/4644-6-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/4644-12-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/4644-18-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/4644-19-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/4644-24-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/4644-33-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/4644-35-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/4644-37-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/4644-36-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/4644-38-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/4644-39-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/4644-40-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/4644-54-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/4644-55-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/4644-56-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/4644-58-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/4644-60-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/4644-61-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/4644-62-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/4644-65-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/4644-67-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/5044-95-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/5044-104-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/5044-142-0x0000000000790000-0x000000000184A000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e576ad0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e576ad0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e573cbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e573cbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e576ad0.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e576ad0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e573cbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e573cbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e576ad0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e576ad0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e573cbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e573cbb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e573cbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e576ad0.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e573cbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e576ad0.exe - Enumerates connected drives 3 TTPs 12 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: e573cbb.exe File opened (read-only) \??\I: e573cbb.exe File opened (read-only) \??\J: e573cbb.exe File opened (read-only) \??\L: e573cbb.exe File opened (read-only) \??\E: e576ad0.exe File opened (read-only) \??\G: e576ad0.exe File opened (read-only) \??\I: e576ad0.exe File opened (read-only) \??\G: e573cbb.exe File opened (read-only) \??\H: e573cbb.exe File opened (read-only) \??\K: e573cbb.exe File opened (read-only) \??\M: e573cbb.exe File opened (read-only) \??\H: e576ad0.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e573cf9 e573cbb.exe File opened for modification C:\Windows\SYSTEM.INI e573cbb.exe File created C:\Windows\e57921e e576ad0.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4644 e573cbb.exe 4644 e573cbb.exe 4644 e573cbb.exe 4644 e573cbb.exe 5044 e576ad0.exe 5044 e576ad0.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe Token: SeDebugPrivilege 4644 e573cbb.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 536 wrote to memory of 3516 536 rundll32.exe 82 PID 536 wrote to memory of 3516 536 rundll32.exe 82 PID 536 wrote to memory of 3516 536 rundll32.exe 82 PID 3516 wrote to memory of 4644 3516 rundll32.exe 83 PID 3516 wrote to memory of 4644 3516 rundll32.exe 83 PID 3516 wrote to memory of 4644 3516 rundll32.exe 83 PID 4644 wrote to memory of 776 4644 e573cbb.exe 8 PID 4644 wrote to memory of 772 4644 e573cbb.exe 9 PID 4644 wrote to memory of 1016 4644 e573cbb.exe 13 PID 4644 wrote to memory of 2576 4644 e573cbb.exe 44 PID 4644 wrote to memory of 2624 4644 e573cbb.exe 45 PID 4644 wrote to memory of 2760 4644 e573cbb.exe 47 PID 4644 wrote to memory of 3564 4644 e573cbb.exe 56 PID 4644 wrote to memory of 3716 4644 e573cbb.exe 57 PID 4644 wrote to memory of 3912 4644 e573cbb.exe 58 PID 4644 wrote to memory of 4004 4644 e573cbb.exe 59 PID 4644 wrote to memory of 4072 4644 e573cbb.exe 60 PID 4644 wrote to memory of 1400 4644 e573cbb.exe 61 PID 4644 wrote to memory of 4136 4644 e573cbb.exe 62 PID 4644 wrote to memory of 4532 4644 e573cbb.exe 64 PID 4644 wrote to memory of 4840 4644 e573cbb.exe 74 PID 4644 wrote to memory of 3000 4644 e573cbb.exe 79 PID 4644 wrote to memory of 2868 4644 e573cbb.exe 80 PID 4644 wrote to memory of 536 4644 e573cbb.exe 81 PID 4644 wrote to memory of 3516 4644 e573cbb.exe 82 PID 4644 wrote to memory of 3516 4644 e573cbb.exe 82 PID 3516 wrote to memory of 2640 3516 rundll32.exe 84 PID 3516 wrote to memory of 2640 3516 rundll32.exe 84 PID 3516 wrote to memory of 2640 3516 rundll32.exe 84 PID 4644 wrote to memory of 776 4644 e573cbb.exe 8 PID 4644 wrote to memory of 772 4644 e573cbb.exe 9 PID 4644 wrote to memory of 1016 4644 e573cbb.exe 13 PID 4644 wrote to memory of 2576 4644 e573cbb.exe 44 PID 4644 wrote to memory of 2624 4644 e573cbb.exe 45 PID 4644 wrote to memory of 2760 4644 e573cbb.exe 47 PID 4644 wrote to memory of 3564 4644 e573cbb.exe 56 PID 4644 wrote to memory of 3716 4644 e573cbb.exe 57 PID 4644 wrote to memory of 3912 4644 e573cbb.exe 58 PID 4644 wrote to memory of 4004 4644 e573cbb.exe 59 PID 4644 wrote to memory of 4072 4644 e573cbb.exe 60 PID 4644 wrote to memory of 1400 4644 e573cbb.exe 61 PID 4644 wrote to memory of 4136 4644 e573cbb.exe 62 PID 4644 wrote to memory of 4532 4644 e573cbb.exe 64 PID 4644 wrote to memory of 4840 4644 e573cbb.exe 74 PID 4644 wrote to memory of 3000 4644 e573cbb.exe 79 PID 4644 wrote to memory of 2868 4644 e573cbb.exe 80 PID 4644 wrote to memory of 536 4644 e573cbb.exe 81 PID 4644 wrote to memory of 2640 4644 e573cbb.exe 84 PID 4644 wrote to memory of 2640 4644 e573cbb.exe 84 PID 4644 wrote to memory of 4956 4644 e573cbb.exe 86 PID 4644 wrote to memory of 208 4644 e573cbb.exe 87 PID 3516 wrote to memory of 5044 3516 rundll32.exe 90 PID 3516 wrote to memory of 5044 3516 rundll32.exe 90 PID 3516 wrote to memory of 5044 3516 rundll32.exe 90 PID 5044 wrote to memory of 776 5044 e576ad0.exe 8 PID 5044 wrote to memory of 772 5044 e576ad0.exe 9 PID 5044 wrote to memory of 1016 5044 e576ad0.exe 13 PID 5044 wrote to memory of 2576 5044 e576ad0.exe 44 PID 5044 wrote to memory of 2624 5044 e576ad0.exe 45 PID 5044 wrote to memory of 2760 5044 e576ad0.exe 47 PID 5044 wrote to memory of 3564 5044 e576ad0.exe 56 PID 5044 wrote to memory of 3716 5044 e576ad0.exe 57 PID 5044 wrote to memory of 3912 5044 e576ad0.exe 58 PID 5044 wrote to memory of 4004 5044 e576ad0.exe 59 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e573cbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e576ad0.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:776
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:772
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1016
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2576
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2624
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2760
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3564
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\562b40b296f7dc287ca0b03a6975af5b3286fad0e7c6f0600dbf86a4e7b67d86.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\562b40b296f7dc287ca0b03a6975af5b3286fad0e7c6f0600dbf86a4e7b67d86.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\e573cbb.exeC:\Users\Admin\AppData\Local\Temp\e573cbb.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4644
-
-
C:\Users\Admin\AppData\Local\Temp\e573e70.exeC:\Users\Admin\AppData\Local\Temp\e573e70.exe4⤵
- Executes dropped EXE
PID:2640
-
-
C:\Users\Admin\AppData\Local\Temp\e576ad0.exeC:\Users\Admin\AppData\Local\Temp\e576ad0.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5044
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3716
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3912
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4004
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4072
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1400
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4136
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4532
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4840
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:3000
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:2868
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4956
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:208
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\e573cbb.exe
- Size 97KB
- SHA256 83321cbc694e60a1920e9098ec2babef973506940334521f0ac5264066b0b0e9
- MD5 a536b00745c3dffd67daf2e21247dcf1
- SHA1 ab99517629a80afda5739bc77606e0efc6eec195
- SHA512 a255663c451680ecc9f663a322a5f56d61eb83bc1555342b5ab1f8db86f87bacdd6dada0ae663589db74569937f186d4c8794bf35df358a26047f97532af7290
- SSDEEP 1536:0H3swz+zfFGXiieTraheoLvspPkk8iu1A5OxCk8dyi0nzAvH6vUaRVzQaw:g+jF8K6hRzykkru1yF0nz2H6VzQX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SYSTEM.INI
- Size 257B
- SHA256 3c3c6ea28ed7c550c8ca7674cca7c1438089a3e558d1bfda03c576bc35508330
- MD5 61f5946844abbd2823fa540268ced610
- SHA1 7be7f6935d6772961e7df02d72e1fd56a4bc13f9
- SHA512 f18ad48cee007356aa9acacef79fab231ff0c623a8b747d28fcb3d52e5bcafc790723d990c2f84bd5d240e260b4a8b888d6049259472486f983065abc59c604c
- MD5 SHA1 SHA512