Analysis
- max time kernel
136s - max time network
105s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
17/05/2024, 22:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6061b7413537dd71ab938e963bae0ef5f30809e8dc4026bc40fdcd4eaba1fddf.dll
Resource
win7-20240508-en
windows7-x64
17 signatures
150 seconds
General
- Target 6061b7413537dd71ab938e963bae0ef5f30809e8dc4026bc40fdcd4eaba1fddf.dll
- Size 120KB
- Sample240517-2bn9daeb71
- SHA256 6061b7413537dd71ab938e963bae0ef5f30809e8dc4026bc40fdcd4eaba1fddf
- MD5 4f634d8ea8c3dc986b8b293af2133c0a
- SHA1 66a684c5d8ee7212b0059a3f0b474da0a44b7616
- SHA512 5fa1c48205866e8a23c088fd3f0038c4b76cbac7f7d79fa1ca013fcddccd20c4159e977e6e300dbc103383fccb85a97d6396bd0d02c9df1722f1066b31992802
- SSDEEP 3072:mK3cxMsduMGkZor/1YHf1Ug7UB/Gl5RL:mKNiHerd8QYR
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 2 TTPs 9 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e573604.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57375c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e5751d9.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e5751d9.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e5751d9.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e573604.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e573604.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57375c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57375c.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e573604.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57375c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5751d9.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e573604.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e573604.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57375c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5751d9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5751d9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5751d9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e573604.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e573604.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57375c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5751d9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e573604.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57375c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57375c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5751d9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e573604.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57375c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57375c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5751d9.exe - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 34 IoCs
resource yara_rule behavioral2/memory/4336-6-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4336-14-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4336-11-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4336-9-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4336-13-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4336-30-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4336-19-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4336-20-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4336-12-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4336-10-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4336-8-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4336-36-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4336-37-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4336-38-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4336-39-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4336-40-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4336-42-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4336-43-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4336-53-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4336-55-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4336-56-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4336-66-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4336-67-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4336-71-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4336-73-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4336-75-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4336-76-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4336-79-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4336-80-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4336-82-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4336-81-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4336-87-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5024-116-0x0000000000B30000-0x0000000001BEA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5024-134-0x0000000000B30000-0x0000000001BEA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 37 IoCs
resource yara_rule behavioral2/memory/4336-6-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/4336-14-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/4336-11-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/4336-9-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/4336-13-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/4336-30-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/4336-19-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/4336-20-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/4336-12-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/4336-10-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/4336-8-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/4336-36-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/4336-37-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/4336-38-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/4336-39-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/4336-40-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/4336-42-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/4336-43-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/4336-53-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/4336-55-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/4336-56-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/4336-66-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/4336-67-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/4336-71-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/4336-73-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/4336-75-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/4336-76-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/4336-79-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/4336-80-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/4336-82-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/4336-81-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/4336-87-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/4336-104-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/5024-116-0x0000000000B30000-0x0000000001BEA000-memory.dmp UPX behavioral2/memory/5024-135-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/5024-134-0x0000000000B30000-0x0000000001BEA000-memory.dmp UPX behavioral2/memory/3680-154-0x0000000000400000-0x0000000000412000-memory.dmp UPX - Executes dropped EXE 3 IoCs
pid Process 4336 e573604.exe 5024 e57375c.exe 3680 e5751d9.exe -
resource yara_rule behavioral2/memory/4336-6-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/4336-14-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/4336-11-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/4336-9-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/4336-13-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/4336-30-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/4336-19-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/4336-20-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/4336-12-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/4336-10-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/4336-8-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/4336-36-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/4336-37-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/4336-38-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/4336-39-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/4336-40-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/4336-42-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/4336-43-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/4336-53-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/4336-55-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/4336-56-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/4336-66-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/4336-67-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/4336-71-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/4336-73-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/4336-75-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/4336-76-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/4336-79-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/4336-80-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/4336-82-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/4336-81-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/4336-87-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/5024-116-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx behavioral2/memory/5024-134-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e573604.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e573604.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e573604.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e573604.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57375c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5751d9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e573604.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57375c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57375c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5751d9.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e573604.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57375c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57375c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5751d9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5751d9.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e5751d9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e573604.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57375c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57375c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5751d9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5751d9.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57375c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5751d9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e573604.exe - Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: e573604.exe File opened (read-only) \??\H: e573604.exe File opened (read-only) \??\I: e573604.exe File opened (read-only) \??\J: e573604.exe File opened (read-only) \??\M: e573604.exe File opened (read-only) \??\N: e573604.exe File opened (read-only) \??\Q: e573604.exe File opened (read-only) \??\S: e573604.exe File opened (read-only) \??\E: e573604.exe File opened (read-only) \??\R: e573604.exe File opened (read-only) \??\K: e573604.exe File opened (read-only) \??\L: e573604.exe File opened (read-only) \??\O: e573604.exe File opened (read-only) \??\P: e573604.exe - Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe e573604.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e573604.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e573604.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe e573604.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\e573633 e573604.exe File opened for modification C:\Windows\SYSTEM.INI e573604.exe File created C:\Windows\e578695 e57375c.exe File created C:\Windows\e57a047 e5751d9.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4336 e573604.exe 4336 e573604.exe 4336 e573604.exe 4336 e573604.exe 5024 e57375c.exe 5024 e57375c.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe Token: SeDebugPrivilege 4336 e573604.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3252 wrote to memory of 1900 3252 rundll32.exe 82 PID 3252 wrote to memory of 1900 3252 rundll32.exe 82 PID 3252 wrote to memory of 1900 3252 rundll32.exe 82 PID 1900 wrote to memory of 4336 1900 rundll32.exe 83 PID 1900 wrote to memory of 4336 1900 rundll32.exe 83 PID 1900 wrote to memory of 4336 1900 rundll32.exe 83 PID 4336 wrote to memory of 776 4336 e573604.exe 8 PID 4336 wrote to memory of 784 4336 e573604.exe 9 PID 4336 wrote to memory of 64 4336 e573604.exe 13 PID 4336 wrote to memory of 2644 4336 e573604.exe 44 PID 4336 wrote to memory of 2656 4336 e573604.exe 45 PID 4336 wrote to memory of 2764 4336 e573604.exe 47 PID 4336 wrote to memory of 3544 4336 e573604.exe 56 PID 4336 wrote to memory of 3688 4336 e573604.exe 57 PID 4336 wrote to memory of 3876 4336 e573604.exe 58 PID 4336 wrote to memory of 3968 4336 e573604.exe 59 PID 4336 wrote to memory of 4028 4336 e573604.exe 60 PID 4336 wrote to memory of 332 4336 e573604.exe 61 PID 4336 wrote to memory of 4152 4336 e573604.exe 62 PID 4336 wrote to memory of 4876 4336 e573604.exe 64 PID 4336 wrote to memory of 1776 4336 e573604.exe 74 PID 4336 wrote to memory of 1528 4336 e573604.exe 79 PID 4336 wrote to memory of 5076 4336 e573604.exe 80 PID 4336 wrote to memory of 3252 4336 e573604.exe 81 PID 4336 wrote to memory of 1900 4336 e573604.exe 82 PID 4336 wrote to memory of 1900 4336 e573604.exe 82 PID 1900 wrote to memory of 5024 1900 rundll32.exe 84 PID 1900 wrote to memory of 5024 1900 rundll32.exe 84 PID 1900 wrote to memory of 5024 1900 rundll32.exe 84 PID 1900 wrote to memory of 3680 1900 rundll32.exe 97 PID 1900 wrote to memory of 3680 1900 rundll32.exe 97 PID 1900 wrote to memory of 3680 1900 rundll32.exe 97 PID 4336 wrote to memory of 776 4336 e573604.exe 8 PID 4336 wrote to memory of 784 4336 e573604.exe 9 PID 4336 wrote to memory of 64 4336 e573604.exe 13 PID 4336 wrote to memory of 2644 4336 e573604.exe 44 PID 4336 wrote to memory of 2656 4336 e573604.exe 45 PID 4336 wrote to memory of 2764 4336 e573604.exe 47 PID 4336 wrote to memory of 3544 4336 e573604.exe 56 PID 4336 wrote to memory of 3688 4336 e573604.exe 57 PID 4336 wrote to memory of 3876 4336 e573604.exe 58 PID 4336 wrote to memory of 3968 4336 e573604.exe 59 PID 4336 wrote to memory of 4028 4336 e573604.exe 60 PID 4336 wrote to memory of 332 4336 e573604.exe 61 PID 4336 wrote to memory of 4152 4336 e573604.exe 62 PID 4336 wrote to memory of 4876 4336 e573604.exe 64 PID 4336 wrote to memory of 1776 4336 e573604.exe 74 PID 4336 wrote to memory of 5076 4336 e573604.exe 80 PID 4336 wrote to memory of 5024 4336 e573604.exe 84 PID 4336 wrote to memory of 5024 4336 e573604.exe 84 PID 4336 wrote to memory of 4996 4336 e573604.exe 86 PID 4336 wrote to memory of 1168 4336 e573604.exe 88 PID 4336 wrote to memory of 3680 4336 e573604.exe 97 PID 4336 wrote to memory of 3680 4336 e573604.exe 97 PID 5024 wrote to memory of 776 5024 e57375c.exe 8 PID 5024 wrote to memory of 784 5024 e57375c.exe 9 PID 5024 wrote to memory of 64 5024 e57375c.exe 13 PID 5024 wrote to memory of 2644 5024 e57375c.exe 44 PID 5024 wrote to memory of 2656 5024 e57375c.exe 45 PID 5024 wrote to memory of 2764 5024 e57375c.exe 47 PID 5024 wrote to memory of 3544 5024 e57375c.exe 56 PID 5024 wrote to memory of 3688 5024 e57375c.exe 57 PID 5024 wrote to memory of 3876 5024 e57375c.exe 58 PID 5024 wrote to memory of 3968 5024 e57375c.exe 59 - System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e573604.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57375c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5751d9.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:776
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:64
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2644
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2656
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2764
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3544
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6061b7413537dd71ab938e963bae0ef5f30809e8dc4026bc40fdcd4eaba1fddf.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6061b7413537dd71ab938e963bae0ef5f30809e8dc4026bc40fdcd4eaba1fddf.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\e573604.exeC:\Users\Admin\AppData\Local\Temp\e573604.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4336
-
-
C:\Users\Admin\AppData\Local\Temp\e57375c.exeC:\Users\Admin\AppData\Local\Temp\e57375c.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5024
-
-
C:\Users\Admin\AppData\Local\Temp\e5751d9.exeC:\Users\Admin\AppData\Local\Temp\e5751d9.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System policy modification
PID:3680
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3688
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3876
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3968
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4028
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:332
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4152
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4876
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:1776
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:1528
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:5076
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4996
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1168
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\e573604.exe
- Size 97KB
- SHA256 cee79a924c6ec1694e382f4a1bc2372ab0bdca973a39c8f2e855bc8dc56b709d
- MD5 03965e39da19b33853081bcbde400b5b
- SHA1 5dc883a6baac089c0310df2a6c777af57d0be48b
- SHA512 ab35756acb5bc253bb90c6db2e485e84e4f03ec1d4beefedf661bb8295c4c7f6f4e18de407bce09a6c43e9e2f719e123c6fb83b1c782471743b64c6a5269f2e3
- SSDEEP 1536:01fdfJhc5it3UTE8y/TDMl7bUYx6BD8M3iQUp1DV5yy+awJhRZKn5HXPlusyIPLv:KfJhEc3N2BwiXHVAhKn53Nu+v
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SYSTEM.INI
- Size 257B
- SHA256 fc33f44372fba31193c5ad2c74162a6e02ad08b1ec7cb2395c1664b01edefe31
- MD5 1c6a56d6f7ae821172b2584ee7dc4b2e
- SHA1 00f0d4368810cf2145118c8d5bef5c9a295f377f
- SHA512 0dccfe7634d843ff44177c51d92a9e2a58ef12d2c62fa3ebe3016d48138a452b3aa99589c37dbf0363801859978576a178e341d53edcef759cacfc6582cb25d0
- MD5 SHA1 SHA512