Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
17-05-2024 02:24
Static task
static1
Behavioral task
behavioral1
Sample
a675c514af206517ffb2e3943cc7289d14c3df0d100977b01f5a3be591f9ffd1.dll
Resource
win7-20240221-en
General
-
Target
a675c514af206517ffb2e3943cc7289d14c3df0d100977b01f5a3be591f9ffd1.dll
-
Size
120KB
-
MD5
d84401ad8e341d8e75a86cc80cdfaa7d
-
SHA1
c3a24e62dd5e72d4ea8ad657df74a145abe8cc91
-
SHA256
a675c514af206517ffb2e3943cc7289d14c3df0d100977b01f5a3be591f9ffd1
-
SHA512
fc3776231392a43156b0cf84a4dd4798786feb328b9ef4fc8069214c56e9608a77ba22431ea22c94a2c0eb664de19396fe3553d497c8f0ca5ee69bcc80ca45e9
-
SSDEEP
3072:uKTu747mBscgnf8DaufSsD0NA/R4kUaRWz/FW:hWEl3AaWwNRks/o
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
e576428.exee57854d.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e576428.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57854d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57854d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57854d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e576428.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e576428.exe -
Processes:
e576428.exee57854d.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e576428.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57854d.exe -
Processes:
e57854d.exee576428.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57854d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57854d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e576428.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e576428.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e576428.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e576428.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57854d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57854d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e576428.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e576428.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57854d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57854d.exe -
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 26 IoCs
Processes:
resource yara_rule behavioral2/memory/1324-10-0x00000000007D0000-0x000000000188A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1324-17-0x00000000007D0000-0x000000000188A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1324-6-0x00000000007D0000-0x000000000188A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1324-11-0x00000000007D0000-0x000000000188A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1324-26-0x00000000007D0000-0x000000000188A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1324-33-0x00000000007D0000-0x000000000188A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1324-34-0x00000000007D0000-0x000000000188A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1324-27-0x00000000007D0000-0x000000000188A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1324-12-0x00000000007D0000-0x000000000188A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1324-9-0x00000000007D0000-0x000000000188A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1324-36-0x00000000007D0000-0x000000000188A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1324-37-0x00000000007D0000-0x000000000188A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1324-38-0x00000000007D0000-0x000000000188A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1324-47-0x00000000007D0000-0x000000000188A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1324-48-0x00000000007D0000-0x000000000188A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1324-58-0x00000000007D0000-0x000000000188A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1324-59-0x00000000007D0000-0x000000000188A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1324-61-0x00000000007D0000-0x000000000188A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1324-62-0x00000000007D0000-0x000000000188A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1324-64-0x00000000007D0000-0x000000000188A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1324-65-0x00000000007D0000-0x000000000188A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1324-66-0x00000000007D0000-0x000000000188A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1324-68-0x00000000007D0000-0x000000000188A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1324-70-0x00000000007D0000-0x000000000188A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4916-105-0x0000000000B30000-0x0000000001BEA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4916-139-0x0000000000B30000-0x0000000001BEA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine -
UPX dump on OEP (original entry point) 30 IoCs
Processes:
resource yara_rule behavioral2/memory/1324-5-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/1324-10-0x00000000007D0000-0x000000000188A000-memory.dmp UPX behavioral2/memory/1324-17-0x00000000007D0000-0x000000000188A000-memory.dmp UPX behavioral2/memory/1324-6-0x00000000007D0000-0x000000000188A000-memory.dmp UPX behavioral2/memory/1324-11-0x00000000007D0000-0x000000000188A000-memory.dmp UPX behavioral2/memory/1324-26-0x00000000007D0000-0x000000000188A000-memory.dmp UPX behavioral2/memory/1324-33-0x00000000007D0000-0x000000000188A000-memory.dmp UPX behavioral2/memory/1324-34-0x00000000007D0000-0x000000000188A000-memory.dmp UPX behavioral2/memory/1324-27-0x00000000007D0000-0x000000000188A000-memory.dmp UPX behavioral2/memory/1324-12-0x00000000007D0000-0x000000000188A000-memory.dmp UPX behavioral2/memory/1324-9-0x00000000007D0000-0x000000000188A000-memory.dmp UPX behavioral2/memory/1324-36-0x00000000007D0000-0x000000000188A000-memory.dmp UPX behavioral2/memory/1324-37-0x00000000007D0000-0x000000000188A000-memory.dmp UPX behavioral2/memory/1324-38-0x00000000007D0000-0x000000000188A000-memory.dmp UPX behavioral2/memory/1324-47-0x00000000007D0000-0x000000000188A000-memory.dmp UPX behavioral2/memory/1324-48-0x00000000007D0000-0x000000000188A000-memory.dmp UPX behavioral2/memory/1324-58-0x00000000007D0000-0x000000000188A000-memory.dmp UPX behavioral2/memory/1324-59-0x00000000007D0000-0x000000000188A000-memory.dmp UPX behavioral2/memory/1324-61-0x00000000007D0000-0x000000000188A000-memory.dmp UPX behavioral2/memory/1324-62-0x00000000007D0000-0x000000000188A000-memory.dmp UPX behavioral2/memory/1324-64-0x00000000007D0000-0x000000000188A000-memory.dmp UPX behavioral2/memory/1324-65-0x00000000007D0000-0x000000000188A000-memory.dmp UPX behavioral2/memory/1324-66-0x00000000007D0000-0x000000000188A000-memory.dmp UPX behavioral2/memory/1324-68-0x00000000007D0000-0x000000000188A000-memory.dmp UPX behavioral2/memory/1324-70-0x00000000007D0000-0x000000000188A000-memory.dmp UPX behavioral2/memory/1324-89-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/2840-93-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4916-105-0x0000000000B30000-0x0000000001BEA000-memory.dmp UPX behavioral2/memory/4916-140-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4916-139-0x0000000000B30000-0x0000000001BEA000-memory.dmp UPX -
Executes dropped EXE 3 IoCs
Processes:
e576428.exee576542.exee57854d.exepid process 1324 e576428.exe 2840 e576542.exe 4916 e57854d.exe -
Processes:
resource yara_rule behavioral2/memory/1324-10-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1324-17-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1324-6-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1324-11-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1324-26-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1324-33-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1324-34-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1324-27-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1324-12-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1324-9-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1324-36-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1324-37-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1324-38-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1324-47-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1324-48-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1324-58-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1324-59-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1324-61-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1324-62-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1324-64-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1324-65-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1324-66-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1324-68-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1324-70-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4916-105-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx behavioral2/memory/4916-139-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx -
Processes:
e57854d.exee576428.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57854d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57854d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57854d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57854d.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57854d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e576428.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e576428.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e576428.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e576428.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e576428.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e576428.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e576428.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57854d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57854d.exe -
Processes:
e576428.exee57854d.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e576428.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57854d.exe -
Enumerates connected drives 3 TTPs 11 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
e576428.exee57854d.exedescription ioc process File opened (read-only) \??\E: e576428.exe File opened (read-only) \??\M: e576428.exe File opened (read-only) \??\H: e57854d.exe File opened (read-only) \??\E: e57854d.exe File opened (read-only) \??\G: e57854d.exe File opened (read-only) \??\G: e576428.exe File opened (read-only) \??\H: e576428.exe File opened (read-only) \??\I: e576428.exe File opened (read-only) \??\J: e576428.exe File opened (read-only) \??\K: e576428.exe File opened (read-only) \??\L: e576428.exe -
Drops file in Windows directory 3 IoCs
Processes:
e576428.exee57854d.exedescription ioc process File created C:\Windows\e576467 e576428.exe File opened for modification C:\Windows\SYSTEM.INI e576428.exe File created C:\Windows\e57b5a4 e57854d.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
e576428.exee57854d.exepid process 1324 e576428.exe 1324 e576428.exe 1324 e576428.exe 1324 e576428.exe 4916 e57854d.exe 4916 e57854d.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
e576428.exedescription pid process Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe Token: SeDebugPrivilege 1324 e576428.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
rundll32.exerundll32.exee576428.exee57854d.exedescription pid process target process PID 1624 wrote to memory of 3036 1624 rundll32.exe rundll32.exe PID 1624 wrote to memory of 3036 1624 rundll32.exe rundll32.exe PID 1624 wrote to memory of 3036 1624 rundll32.exe rundll32.exe PID 3036 wrote to memory of 1324 3036 rundll32.exe e576428.exe PID 3036 wrote to memory of 1324 3036 rundll32.exe e576428.exe PID 3036 wrote to memory of 1324 3036 rundll32.exe e576428.exe PID 1324 wrote to memory of 792 1324 e576428.exe fontdrvhost.exe PID 1324 wrote to memory of 800 1324 e576428.exe fontdrvhost.exe PID 1324 wrote to memory of 380 1324 e576428.exe dwm.exe PID 1324 wrote to memory of 2720 1324 e576428.exe sihost.exe PID 1324 wrote to memory of 2728 1324 e576428.exe svchost.exe PID 1324 wrote to memory of 2960 1324 e576428.exe taskhostw.exe PID 1324 wrote to memory of 3520 1324 e576428.exe Explorer.EXE PID 1324 wrote to memory of 3644 1324 e576428.exe svchost.exe PID 1324 wrote to memory of 3840 1324 e576428.exe DllHost.exe PID 1324 wrote to memory of 4012 1324 e576428.exe StartMenuExperienceHost.exe PID 1324 wrote to memory of 4072 1324 e576428.exe RuntimeBroker.exe PID 1324 wrote to memory of 3872 1324 e576428.exe SearchApp.exe PID 1324 wrote to memory of 4124 1324 e576428.exe RuntimeBroker.exe PID 1324 wrote to memory of 392 1324 e576428.exe RuntimeBroker.exe PID 1324 wrote to memory of 2292 1324 e576428.exe TextInputHost.exe PID 1324 wrote to memory of 4020 1324 e576428.exe backgroundTaskHost.exe PID 1324 wrote to memory of 3512 1324 e576428.exe backgroundTaskHost.exe PID 1324 wrote to memory of 1624 1324 e576428.exe rundll32.exe PID 1324 wrote to memory of 3036 1324 e576428.exe rundll32.exe PID 1324 wrote to memory of 3036 1324 e576428.exe rundll32.exe PID 3036 wrote to memory of 2840 3036 rundll32.exe e576542.exe PID 3036 wrote to memory of 2840 3036 rundll32.exe e576542.exe PID 3036 wrote to memory of 2840 3036 rundll32.exe e576542.exe PID 3036 wrote to memory of 4916 3036 rundll32.exe e57854d.exe PID 3036 wrote to memory of 4916 3036 rundll32.exe e57854d.exe PID 3036 wrote to memory of 4916 3036 rundll32.exe e57854d.exe PID 1324 wrote to memory of 792 1324 e576428.exe fontdrvhost.exe PID 1324 wrote to memory of 800 1324 e576428.exe fontdrvhost.exe PID 1324 wrote to memory of 380 1324 e576428.exe dwm.exe PID 1324 wrote to memory of 2720 1324 e576428.exe sihost.exe PID 1324 wrote to memory of 2728 1324 e576428.exe svchost.exe PID 1324 wrote to memory of 2960 1324 e576428.exe taskhostw.exe PID 1324 wrote to memory of 3520 1324 e576428.exe Explorer.EXE PID 1324 wrote to memory of 3644 1324 e576428.exe svchost.exe PID 1324 wrote to memory of 3840 1324 e576428.exe DllHost.exe PID 1324 wrote to memory of 4012 1324 e576428.exe StartMenuExperienceHost.exe PID 1324 wrote to memory of 4072 1324 e576428.exe RuntimeBroker.exe PID 1324 wrote to memory of 3872 1324 e576428.exe SearchApp.exe PID 1324 wrote to memory of 4124 1324 e576428.exe RuntimeBroker.exe PID 1324 wrote to memory of 392 1324 e576428.exe RuntimeBroker.exe PID 1324 wrote to memory of 2292 1324 e576428.exe TextInputHost.exe PID 1324 wrote to memory of 4020 1324 e576428.exe backgroundTaskHost.exe PID 1324 wrote to memory of 3512 1324 e576428.exe backgroundTaskHost.exe PID 1324 wrote to memory of 2840 1324 e576428.exe e576542.exe PID 1324 wrote to memory of 2840 1324 e576428.exe e576542.exe PID 1324 wrote to memory of 4916 1324 e576428.exe e57854d.exe PID 1324 wrote to memory of 4916 1324 e576428.exe e57854d.exe PID 1324 wrote to memory of 2252 1324 e576428.exe RuntimeBroker.exe PID 1324 wrote to memory of 3624 1324 e576428.exe RuntimeBroker.exe PID 4916 wrote to memory of 792 4916 e57854d.exe fontdrvhost.exe PID 4916 wrote to memory of 800 4916 e57854d.exe fontdrvhost.exe PID 4916 wrote to memory of 380 4916 e57854d.exe dwm.exe PID 4916 wrote to memory of 2720 4916 e57854d.exe sihost.exe PID 4916 wrote to memory of 2728 4916 e57854d.exe svchost.exe PID 4916 wrote to memory of 2960 4916 e57854d.exe taskhostw.exe PID 4916 wrote to memory of 3520 4916 e57854d.exe Explorer.EXE PID 4916 wrote to memory of 3644 4916 e57854d.exe svchost.exe PID 4916 wrote to memory of 3840 4916 e57854d.exe DllHost.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
e576428.exee57854d.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e576428.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57854d.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a675c514af206517ffb2e3943cc7289d14c3df0d100977b01f5a3be591f9ffd1.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a675c514af206517ffb2e3943cc7289d14c3df0d100977b01f5a3be591f9ffd1.dll,#13⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e576428.exeC:\Users\Admin\AppData\Local\Temp\e576428.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\e576542.exeC:\Users\Admin\AppData\Local\Temp\e576542.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\e57854d.exeC:\Users\Admin\AppData\Local\Temp\e57854d.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\e576428.exeFilesize
97KB
MD5c85cfa92ea41071b2f55b413d605908e
SHA17cbe59f262ae4d906177fa2465d64937f74da43c
SHA256bde8fefb2c6c4f10c330406beae04eab6588e38b7b904998862fc5921295d871
SHA5120d7c34b304ab3028b173c6d6eb0201549960cf2a228b3f524dbbc32e66050040c929f120dfcdfbda713acd5f25608e1883804c155628fab5c17f24d68fe80d43
-
C:\Windows\SYSTEM.INIFilesize
257B
MD5b116b8d53bb1ac0ffde6492f65a35981
SHA17d7cee18cfd25885d5e8cc267d53bc67f618be76
SHA256e5aa54a69e99a2cb999f5b576df81ddb62d669cfd053ab14ac0e0b0e9ddf15bf
SHA512b2a390c169d1f696ef9e074d91664a2de09a036761d8021609b8dcd02f5c86eb3387b18fd45420528fe5c32f5a065d89834e0187c930a9edd9c3b68634820078
-
memory/1324-12-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1324-5-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1324-9-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1324-17-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1324-16-0x00000000005C0000-0x00000000005C1000-memory.dmpFilesize
4KB
-
memory/1324-89-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1324-79-0x00000000005B0000-0x00000000005B2000-memory.dmpFilesize
8KB
-
memory/1324-6-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1324-11-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1324-26-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1324-70-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1324-33-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1324-34-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1324-27-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1324-59-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1324-10-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1324-30-0x00000000005B0000-0x00000000005B2000-memory.dmpFilesize
8KB
-
memory/1324-68-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1324-28-0x00000000005B0000-0x00000000005B2000-memory.dmpFilesize
8KB
-
memory/1324-36-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1324-37-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1324-38-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1324-66-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1324-47-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1324-48-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1324-65-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1324-64-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1324-62-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1324-61-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1324-58-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/2840-32-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2840-93-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2840-56-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/2840-51-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/2840-54-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/3036-23-0x00000000006F0000-0x00000000006F2000-memory.dmpFilesize
8KB
-
memory/3036-29-0x00000000006F0000-0x00000000006F2000-memory.dmpFilesize
8KB
-
memory/3036-0-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/3036-13-0x00000000006F0000-0x00000000006F2000-memory.dmpFilesize
8KB
-
memory/3036-14-0x0000000000700000-0x0000000000701000-memory.dmpFilesize
4KB
-
memory/4916-53-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/4916-43-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4916-55-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/4916-57-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/4916-105-0x0000000000B30000-0x0000000001BEA000-memory.dmpFilesize
16.7MB
-
memory/4916-140-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4916-139-0x0000000000B30000-0x0000000001BEA000-memory.dmpFilesize
16.7MB