Analysis
-
max time kernel
27s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 21:28
Static task
static1
Behavioral task
behavioral1
Sample
524e94735a951a9e778b45132075f073d344c732e4c8502973060c8c32ce6115.dll
Resource
win7-20240221-en
General
-
Target
524e94735a951a9e778b45132075f073d344c732e4c8502973060c8c32ce6115.dll
-
Size
120KB
-
MD5
2289adfc0e5677631294a183d498064e
-
SHA1
1a1af5600aa0d8b7f08cf7df882f270a4f42d071
-
SHA256
524e94735a951a9e778b45132075f073d344c732e4c8502973060c8c32ce6115
-
SHA512
a390934d285544f44b132f2ccb0796a4443be0fbd0e9b1ff7b50336c4e9f9f7c06882a700f704e243c739271c89bc49ef83843fa2be4ad11492d9df64a6ce991
-
SSDEEP
3072:O8WntAQL/+GsgtUi2wAuzsSOWjQEcpAqmqS5Yit5fVHW:it56Gs5KX0f+qkB5fVHW
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
f764569.exef7629af.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f764569.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f7629af.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f7629af.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f7629af.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f764569.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f764569.exe -
Processes:
f7629af.exef764569.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7629af.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f764569.exe -
Processes:
f7629af.exef764569.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7629af.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7629af.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7629af.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f764569.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f764569.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f764569.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7629af.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7629af.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7629af.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f764569.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f764569.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f764569.exe -
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 24 IoCs
Processes:
resource yara_rule behavioral1/memory/2420-17-0x0000000000980000-0x0000000001A3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2420-18-0x0000000000980000-0x0000000001A3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2420-21-0x0000000000980000-0x0000000001A3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2420-24-0x0000000000980000-0x0000000001A3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2420-25-0x0000000000980000-0x0000000001A3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2420-23-0x0000000000980000-0x0000000001A3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2420-22-0x0000000000980000-0x0000000001A3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2420-20-0x0000000000980000-0x0000000001A3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2420-19-0x0000000000980000-0x0000000001A3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2420-15-0x0000000000980000-0x0000000001A3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2420-63-0x0000000000980000-0x0000000001A3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2420-64-0x0000000000980000-0x0000000001A3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2420-65-0x0000000000980000-0x0000000001A3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2420-66-0x0000000000980000-0x0000000001A3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2420-67-0x0000000000980000-0x0000000001A3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2420-69-0x0000000000980000-0x0000000001A3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2420-70-0x0000000000980000-0x0000000001A3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2420-84-0x0000000000980000-0x0000000001A3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2420-86-0x0000000000980000-0x0000000001A3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2420-88-0x0000000000980000-0x0000000001A3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2420-108-0x0000000000980000-0x0000000001A3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2420-149-0x0000000000980000-0x0000000001A3A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2696-170-0x0000000000900000-0x00000000019BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2696-205-0x0000000000900000-0x00000000019BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine -
UPX dump on OEP (original entry point) 28 IoCs
Processes:
resource yara_rule behavioral1/memory/2420-17-0x0000000000980000-0x0000000001A3A000-memory.dmp UPX behavioral1/memory/2420-18-0x0000000000980000-0x0000000001A3A000-memory.dmp UPX behavioral1/memory/2420-21-0x0000000000980000-0x0000000001A3A000-memory.dmp UPX behavioral1/memory/2420-24-0x0000000000980000-0x0000000001A3A000-memory.dmp UPX behavioral1/memory/2232-57-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/2420-25-0x0000000000980000-0x0000000001A3A000-memory.dmp UPX behavioral1/memory/2420-23-0x0000000000980000-0x0000000001A3A000-memory.dmp UPX behavioral1/memory/2420-22-0x0000000000980000-0x0000000001A3A000-memory.dmp UPX behavioral1/memory/2420-20-0x0000000000980000-0x0000000001A3A000-memory.dmp UPX behavioral1/memory/2420-19-0x0000000000980000-0x0000000001A3A000-memory.dmp UPX behavioral1/memory/2420-15-0x0000000000980000-0x0000000001A3A000-memory.dmp UPX behavioral1/memory/2420-63-0x0000000000980000-0x0000000001A3A000-memory.dmp UPX behavioral1/memory/2420-64-0x0000000000980000-0x0000000001A3A000-memory.dmp UPX behavioral1/memory/2420-65-0x0000000000980000-0x0000000001A3A000-memory.dmp UPX behavioral1/memory/2420-66-0x0000000000980000-0x0000000001A3A000-memory.dmp UPX behavioral1/memory/2420-67-0x0000000000980000-0x0000000001A3A000-memory.dmp UPX behavioral1/memory/2420-69-0x0000000000980000-0x0000000001A3A000-memory.dmp UPX behavioral1/memory/2420-70-0x0000000000980000-0x0000000001A3A000-memory.dmp UPX behavioral1/memory/2420-84-0x0000000000980000-0x0000000001A3A000-memory.dmp UPX behavioral1/memory/2420-86-0x0000000000980000-0x0000000001A3A000-memory.dmp UPX behavioral1/memory/2420-88-0x0000000000980000-0x0000000001A3A000-memory.dmp UPX behavioral1/memory/2420-108-0x0000000000980000-0x0000000001A3A000-memory.dmp UPX behavioral1/memory/2420-150-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/2420-149-0x0000000000980000-0x0000000001A3A000-memory.dmp UPX behavioral1/memory/2232-171-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/2696-170-0x0000000000900000-0x00000000019BA000-memory.dmp UPX behavioral1/memory/2696-205-0x0000000000900000-0x00000000019BA000-memory.dmp UPX behavioral1/memory/2696-204-0x0000000000400000-0x0000000000412000-memory.dmp UPX -
Executes dropped EXE 3 IoCs
Processes:
f7629af.exef762be1.exef764569.exepid process 2420 f7629af.exe 2232 f762be1.exe 2696 f764569.exe -
Loads dropped DLL 6 IoCs
Processes:
rundll32.exepid process 1752 rundll32.exe 1752 rundll32.exe 1752 rundll32.exe 1752 rundll32.exe 1752 rundll32.exe 1752 rundll32.exe -
Processes:
resource yara_rule behavioral1/memory/2420-17-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2420-18-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2420-21-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2420-24-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2420-25-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2420-23-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2420-22-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2420-20-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2420-19-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2420-15-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2420-63-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2420-64-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2420-65-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2420-66-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2420-67-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2420-69-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2420-70-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2420-84-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2420-86-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2420-88-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2420-108-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2420-149-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2696-170-0x0000000000900000-0x00000000019BA000-memory.dmp upx behavioral1/memory/2696-205-0x0000000000900000-0x00000000019BA000-memory.dmp upx -
Processes:
f7629af.exef764569.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7629af.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f7629af.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f764569.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7629af.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7629af.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7629af.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f764569.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7629af.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f764569.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f764569.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f764569.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7629af.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f764569.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f764569.exe -
Processes:
f7629af.exef764569.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7629af.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f764569.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
f7629af.exef764569.exedescription ioc process File opened (read-only) \??\M: f7629af.exe File opened (read-only) \??\N: f7629af.exe File opened (read-only) \??\Q: f7629af.exe File opened (read-only) \??\S: f7629af.exe File opened (read-only) \??\H: f7629af.exe File opened (read-only) \??\L: f7629af.exe File opened (read-only) \??\G: f7629af.exe File opened (read-only) \??\K: f7629af.exe File opened (read-only) \??\O: f7629af.exe File opened (read-only) \??\P: f7629af.exe File opened (read-only) \??\E: f764569.exe File opened (read-only) \??\E: f7629af.exe File opened (read-only) \??\I: f7629af.exe File opened (read-only) \??\J: f7629af.exe File opened (read-only) \??\R: f7629af.exe -
Drops file in Windows directory 3 IoCs
Processes:
f7629af.exef764569.exedescription ioc process File created C:\Windows\f762a1c f7629af.exe File opened for modification C:\Windows\SYSTEM.INI f7629af.exe File created C:\Windows\f767a10 f764569.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
f7629af.exef764569.exepid process 2420 f7629af.exe 2420 f7629af.exe 2696 f764569.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
Processes:
f7629af.exef764569.exedescription pid process Token: SeDebugPrivilege 2420 f7629af.exe Token: SeDebugPrivilege 2420 f7629af.exe Token: SeDebugPrivilege 2420 f7629af.exe Token: SeDebugPrivilege 2420 f7629af.exe Token: SeDebugPrivilege 2420 f7629af.exe Token: SeDebugPrivilege 2420 f7629af.exe Token: SeDebugPrivilege 2420 f7629af.exe Token: SeDebugPrivilege 2420 f7629af.exe Token: SeDebugPrivilege 2420 f7629af.exe Token: SeDebugPrivilege 2420 f7629af.exe Token: SeDebugPrivilege 2420 f7629af.exe Token: SeDebugPrivilege 2420 f7629af.exe Token: SeDebugPrivilege 2420 f7629af.exe Token: SeDebugPrivilege 2420 f7629af.exe Token: SeDebugPrivilege 2420 f7629af.exe Token: SeDebugPrivilege 2420 f7629af.exe Token: SeDebugPrivilege 2420 f7629af.exe Token: SeDebugPrivilege 2420 f7629af.exe Token: SeDebugPrivilege 2420 f7629af.exe Token: SeDebugPrivilege 2420 f7629af.exe Token: SeDebugPrivilege 2420 f7629af.exe Token: SeDebugPrivilege 2696 f764569.exe Token: SeDebugPrivilege 2696 f764569.exe Token: SeDebugPrivilege 2696 f764569.exe Token: SeDebugPrivilege 2696 f764569.exe Token: SeDebugPrivilege 2696 f764569.exe Token: SeDebugPrivilege 2696 f764569.exe Token: SeDebugPrivilege 2696 f764569.exe Token: SeDebugPrivilege 2696 f764569.exe Token: SeDebugPrivilege 2696 f764569.exe Token: SeDebugPrivilege 2696 f764569.exe Token: SeDebugPrivilege 2696 f764569.exe Token: SeDebugPrivilege 2696 f764569.exe Token: SeDebugPrivilege 2696 f764569.exe Token: SeDebugPrivilege 2696 f764569.exe Token: SeDebugPrivilege 2696 f764569.exe Token: SeDebugPrivilege 2696 f764569.exe Token: SeDebugPrivilege 2696 f764569.exe Token: SeDebugPrivilege 2696 f764569.exe Token: SeDebugPrivilege 2696 f764569.exe Token: SeDebugPrivilege 2696 f764569.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
rundll32.exerundll32.exef7629af.exef764569.exedescription pid process target process PID 2208 wrote to memory of 1752 2208 rundll32.exe rundll32.exe PID 2208 wrote to memory of 1752 2208 rundll32.exe rundll32.exe PID 2208 wrote to memory of 1752 2208 rundll32.exe rundll32.exe PID 2208 wrote to memory of 1752 2208 rundll32.exe rundll32.exe PID 2208 wrote to memory of 1752 2208 rundll32.exe rundll32.exe PID 2208 wrote to memory of 1752 2208 rundll32.exe rundll32.exe PID 2208 wrote to memory of 1752 2208 rundll32.exe rundll32.exe PID 1752 wrote to memory of 2420 1752 rundll32.exe f7629af.exe PID 1752 wrote to memory of 2420 1752 rundll32.exe f7629af.exe PID 1752 wrote to memory of 2420 1752 rundll32.exe f7629af.exe PID 1752 wrote to memory of 2420 1752 rundll32.exe f7629af.exe PID 2420 wrote to memory of 1112 2420 f7629af.exe taskhost.exe PID 2420 wrote to memory of 1168 2420 f7629af.exe Dwm.exe PID 2420 wrote to memory of 1208 2420 f7629af.exe Explorer.EXE PID 2420 wrote to memory of 1828 2420 f7629af.exe DllHost.exe PID 2420 wrote to memory of 2208 2420 f7629af.exe rundll32.exe PID 2420 wrote to memory of 1752 2420 f7629af.exe rundll32.exe PID 2420 wrote to memory of 1752 2420 f7629af.exe rundll32.exe PID 1752 wrote to memory of 2232 1752 rundll32.exe f762be1.exe PID 1752 wrote to memory of 2232 1752 rundll32.exe f762be1.exe PID 1752 wrote to memory of 2232 1752 rundll32.exe f762be1.exe PID 1752 wrote to memory of 2232 1752 rundll32.exe f762be1.exe PID 1752 wrote to memory of 2696 1752 rundll32.exe f764569.exe PID 1752 wrote to memory of 2696 1752 rundll32.exe f764569.exe PID 1752 wrote to memory of 2696 1752 rundll32.exe f764569.exe PID 1752 wrote to memory of 2696 1752 rundll32.exe f764569.exe PID 2420 wrote to memory of 1112 2420 f7629af.exe taskhost.exe PID 2420 wrote to memory of 1168 2420 f7629af.exe Dwm.exe PID 2420 wrote to memory of 1208 2420 f7629af.exe Explorer.EXE PID 2420 wrote to memory of 2232 2420 f7629af.exe f762be1.exe PID 2420 wrote to memory of 2232 2420 f7629af.exe f762be1.exe PID 2420 wrote to memory of 2696 2420 f7629af.exe f764569.exe PID 2420 wrote to memory of 2696 2420 f7629af.exe f764569.exe PID 2696 wrote to memory of 1112 2696 f764569.exe taskhost.exe PID 2696 wrote to memory of 1168 2696 f764569.exe Dwm.exe PID 2696 wrote to memory of 1208 2696 f764569.exe Explorer.EXE -
System policy modification 1 TTPs 2 IoCs
Processes:
f7629af.exef764569.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7629af.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f764569.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\524e94735a951a9e778b45132075f073d344c732e4c8502973060c8c32ce6115.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\524e94735a951a9e778b45132075f073d344c732e4c8502973060c8c32ce6115.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f7629af.exeC:\Users\Admin\AppData\Local\Temp\f7629af.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\f762be1.exeC:\Users\Admin\AppData\Local\Temp\f762be1.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\f764569.exeC:\Users\Admin\AppData\Local\Temp\f764569.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SYSTEM.INIFilesize
257B
MD5528cf456e7b9d6b80485f51a2bb1e707
SHA1ced162d61d17ad41f4a4faed8b87c953653cd1db
SHA256944f6c6d0e363491514117a3ec61de6705693bf345bef67844cff72322027fdd
SHA51291a918dc115bb6d32bffe3615e7ad94826e30b9ba7eeefb621fcbad6faad67b1ea8f5850dc75adc90b8f70e50f0608c25e5de1a44471b4abf017eed1e3f39b1b
-
\Users\Admin\AppData\Local\Temp\f7629af.exeFilesize
97KB
MD5aa951a8c02c8153ab05902165b878006
SHA1691dae5ec1572a70698ab3d9690fec2a03d65d81
SHA2568ddc10542a0283e0d8e121bee10db6e780585283b349ffe724676e2a28369cb8
SHA5127c300ce8bd5472681717a3c7140c5f629e768a102c4685b10210950becacad5eb03feb769d5138819ec6814c48427c8d68a89a4b50c196edc662991425f83a22
-
memory/1112-26-0x0000000001ED0000-0x0000000001ED2000-memory.dmpFilesize
8KB
-
memory/1752-56-0x0000000000160000-0x0000000000162000-memory.dmpFilesize
8KB
-
memory/1752-34-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/1752-11-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1752-10-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1752-33-0x0000000000160000-0x0000000000162000-memory.dmpFilesize
8KB
-
memory/1752-1-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/1752-43-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/1752-52-0x0000000000160000-0x0000000000162000-memory.dmpFilesize
8KB
-
memory/1752-3-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/1752-0-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/1752-81-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1752-55-0x0000000000260000-0x0000000000272000-memory.dmpFilesize
72KB
-
memory/1752-2-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/2232-57-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2232-104-0x00000000001B0000-0x00000000001B2000-memory.dmpFilesize
8KB
-
memory/2232-106-0x00000000001B0000-0x00000000001B2000-memory.dmpFilesize
8KB
-
memory/2232-97-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/2232-171-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2420-19-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2420-86-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2420-23-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2420-22-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2420-20-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2420-53-0x00000000003D0000-0x00000000003D2000-memory.dmpFilesize
8KB
-
memory/2420-15-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2420-63-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2420-64-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2420-65-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2420-66-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2420-67-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2420-69-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2420-70-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2420-14-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2420-44-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/2420-84-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2420-25-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2420-88-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2420-24-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2420-17-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2420-149-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2420-21-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2420-150-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2420-18-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2420-108-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2420-126-0x00000000003D0000-0x00000000003D2000-memory.dmpFilesize
8KB
-
memory/2696-103-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/2696-107-0x00000000003E0000-0x00000000003E2000-memory.dmpFilesize
8KB
-
memory/2696-105-0x00000000003E0000-0x00000000003E2000-memory.dmpFilesize
8KB
-
memory/2696-83-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2696-170-0x0000000000900000-0x00000000019BA000-memory.dmpFilesize
16.7MB
-
memory/2696-205-0x0000000000900000-0x00000000019BA000-memory.dmpFilesize
16.7MB
-
memory/2696-204-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB