Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 21:28
Static task
static1
Behavioral task
behavioral1
Sample
524e94735a951a9e778b45132075f073d344c732e4c8502973060c8c32ce6115.dll
Resource
win7-20240221-en
General
-
Target
524e94735a951a9e778b45132075f073d344c732e4c8502973060c8c32ce6115.dll
-
Size
120KB
-
MD5
2289adfc0e5677631294a183d498064e
-
SHA1
1a1af5600aa0d8b7f08cf7df882f270a4f42d071
-
SHA256
524e94735a951a9e778b45132075f073d344c732e4c8502973060c8c32ce6115
-
SHA512
a390934d285544f44b132f2ccb0796a4443be0fbd0e9b1ff7b50336c4e9f9f7c06882a700f704e243c739271c89bc49ef83843fa2be4ad11492d9df64a6ce991
-
SSDEEP
3072:O8WntAQL/+GsgtUi2wAuzsSOWjQEcpAqmqS5Yit5fVHW:it56Gs5KX0f+qkB5fVHW
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
e578472.exee574f58.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e578472.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e578472.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e574f58.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e574f58.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e574f58.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e578472.exe -
Processes:
e574f58.exee578472.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e574f58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578472.exe -
Processes:
e578472.exee574f58.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e578472.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e578472.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e574f58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e574f58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e578472.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e578472.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e578472.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e578472.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e574f58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e574f58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e574f58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e574f58.exe -
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 28 IoCs
Processes:
resource yara_rule behavioral2/memory/4332-6-0x00000000007D0000-0x000000000188A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4332-9-0x00000000007D0000-0x000000000188A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4332-17-0x00000000007D0000-0x000000000188A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4332-11-0x00000000007D0000-0x000000000188A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4332-10-0x00000000007D0000-0x000000000188A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4332-8-0x00000000007D0000-0x000000000188A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4332-27-0x00000000007D0000-0x000000000188A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4332-31-0x00000000007D0000-0x000000000188A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4332-32-0x00000000007D0000-0x000000000188A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4332-33-0x00000000007D0000-0x000000000188A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4332-35-0x00000000007D0000-0x000000000188A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4332-34-0x00000000007D0000-0x000000000188A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4332-36-0x00000000007D0000-0x000000000188A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4332-37-0x00000000007D0000-0x000000000188A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4332-38-0x00000000007D0000-0x000000000188A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4332-45-0x00000000007D0000-0x000000000188A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4332-53-0x00000000007D0000-0x000000000188A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4332-54-0x00000000007D0000-0x000000000188A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4332-56-0x00000000007D0000-0x000000000188A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4332-57-0x00000000007D0000-0x000000000188A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4332-59-0x00000000007D0000-0x000000000188A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4332-60-0x00000000007D0000-0x000000000188A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4332-63-0x00000000007D0000-0x000000000188A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1472-87-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1472-89-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1472-100-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1472-90-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1472-140-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine -
UPX dump on OEP (original entry point) 32 IoCs
Processes:
resource yara_rule behavioral2/memory/4332-6-0x00000000007D0000-0x000000000188A000-memory.dmp UPX behavioral2/memory/4332-9-0x00000000007D0000-0x000000000188A000-memory.dmp UPX behavioral2/memory/4332-17-0x00000000007D0000-0x000000000188A000-memory.dmp UPX behavioral2/memory/4332-11-0x00000000007D0000-0x000000000188A000-memory.dmp UPX behavioral2/memory/4332-10-0x00000000007D0000-0x000000000188A000-memory.dmp UPX behavioral2/memory/4332-8-0x00000000007D0000-0x000000000188A000-memory.dmp UPX behavioral2/memory/4332-27-0x00000000007D0000-0x000000000188A000-memory.dmp UPX behavioral2/memory/4332-31-0x00000000007D0000-0x000000000188A000-memory.dmp UPX behavioral2/memory/4332-32-0x00000000007D0000-0x000000000188A000-memory.dmp UPX behavioral2/memory/4332-33-0x00000000007D0000-0x000000000188A000-memory.dmp UPX behavioral2/memory/4332-35-0x00000000007D0000-0x000000000188A000-memory.dmp UPX behavioral2/memory/4332-34-0x00000000007D0000-0x000000000188A000-memory.dmp UPX behavioral2/memory/4332-36-0x00000000007D0000-0x000000000188A000-memory.dmp UPX behavioral2/memory/4332-37-0x00000000007D0000-0x000000000188A000-memory.dmp UPX behavioral2/memory/4332-38-0x00000000007D0000-0x000000000188A000-memory.dmp UPX behavioral2/memory/1472-52-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4332-45-0x00000000007D0000-0x000000000188A000-memory.dmp UPX behavioral2/memory/4332-53-0x00000000007D0000-0x000000000188A000-memory.dmp UPX behavioral2/memory/4332-54-0x00000000007D0000-0x000000000188A000-memory.dmp UPX behavioral2/memory/4332-56-0x00000000007D0000-0x000000000188A000-memory.dmp UPX behavioral2/memory/4332-57-0x00000000007D0000-0x000000000188A000-memory.dmp UPX behavioral2/memory/4332-59-0x00000000007D0000-0x000000000188A000-memory.dmp UPX behavioral2/memory/4332-60-0x00000000007D0000-0x000000000188A000-memory.dmp UPX behavioral2/memory/4332-63-0x00000000007D0000-0x000000000188A000-memory.dmp UPX behavioral2/memory/4332-82-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/3568-86-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/1472-87-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/1472-89-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/1472-100-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/1472-90-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/1472-140-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/1472-139-0x0000000000400000-0x0000000000412000-memory.dmp UPX -
Executes dropped EXE 3 IoCs
Processes:
e574f58.exee57516c.exee578472.exepid process 4332 e574f58.exe 3568 e57516c.exe 1472 e578472.exe -
Processes:
resource yara_rule behavioral2/memory/4332-6-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4332-9-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4332-17-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4332-11-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4332-10-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4332-8-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4332-27-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4332-31-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4332-32-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4332-33-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4332-35-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4332-34-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4332-36-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4332-37-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4332-38-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4332-45-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4332-53-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4332-54-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4332-56-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4332-57-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4332-59-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4332-60-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4332-63-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1472-87-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/1472-89-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/1472-100-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/1472-90-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/1472-140-0x0000000000740000-0x00000000017FA000-memory.dmp upx -
Processes:
e578472.exee574f58.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e578472.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e578472.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e574f58.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e574f58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e574f58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e578472.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e574f58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e574f58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e574f58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e578472.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e578472.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e578472.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e574f58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e578472.exe -
Processes:
e574f58.exee578472.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e574f58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578472.exe -
Enumerates connected drives 3 TTPs 11 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
e574f58.exee578472.exedescription ioc process File opened (read-only) \??\I: e574f58.exe File opened (read-only) \??\J: e574f58.exe File opened (read-only) \??\G: e578472.exe File opened (read-only) \??\G: e574f58.exe File opened (read-only) \??\H: e574f58.exe File opened (read-only) \??\K: e574f58.exe File opened (read-only) \??\L: e574f58.exe File opened (read-only) \??\E: e578472.exe File opened (read-only) \??\H: e578472.exe File opened (read-only) \??\I: e578472.exe File opened (read-only) \??\E: e574f58.exe -
Drops file in Windows directory 3 IoCs
Processes:
e574f58.exee578472.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI e574f58.exe File created C:\Windows\e57abff e578472.exe File created C:\Windows\e575004 e574f58.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
e574f58.exee578472.exepid process 4332 e574f58.exe 4332 e574f58.exe 4332 e574f58.exe 4332 e574f58.exe 1472 e578472.exe 1472 e578472.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
e574f58.exedescription pid process Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe Token: SeDebugPrivilege 4332 e574f58.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
rundll32.exerundll32.exee574f58.exee578472.exedescription pid process target process PID 2888 wrote to memory of 3332 2888 rundll32.exe rundll32.exe PID 2888 wrote to memory of 3332 2888 rundll32.exe rundll32.exe PID 2888 wrote to memory of 3332 2888 rundll32.exe rundll32.exe PID 3332 wrote to memory of 4332 3332 rundll32.exe e574f58.exe PID 3332 wrote to memory of 4332 3332 rundll32.exe e574f58.exe PID 3332 wrote to memory of 4332 3332 rundll32.exe e574f58.exe PID 4332 wrote to memory of 784 4332 e574f58.exe fontdrvhost.exe PID 4332 wrote to memory of 792 4332 e574f58.exe fontdrvhost.exe PID 4332 wrote to memory of 60 4332 e574f58.exe dwm.exe PID 4332 wrote to memory of 2628 4332 e574f58.exe sihost.exe PID 4332 wrote to memory of 2680 4332 e574f58.exe svchost.exe PID 4332 wrote to memory of 2756 4332 e574f58.exe taskhostw.exe PID 4332 wrote to memory of 3396 4332 e574f58.exe Explorer.EXE PID 4332 wrote to memory of 3544 4332 e574f58.exe svchost.exe PID 4332 wrote to memory of 3740 4332 e574f58.exe DllHost.exe PID 4332 wrote to memory of 3836 4332 e574f58.exe StartMenuExperienceHost.exe PID 4332 wrote to memory of 3896 4332 e574f58.exe RuntimeBroker.exe PID 4332 wrote to memory of 4000 4332 e574f58.exe SearchApp.exe PID 4332 wrote to memory of 2124 4332 e574f58.exe RuntimeBroker.exe PID 4332 wrote to memory of 404 4332 e574f58.exe RuntimeBroker.exe PID 4332 wrote to memory of 3640 4332 e574f58.exe TextInputHost.exe PID 4332 wrote to memory of 4896 4332 e574f58.exe backgroundTaskHost.exe PID 4332 wrote to memory of 1856 4332 e574f58.exe backgroundTaskHost.exe PID 4332 wrote to memory of 2888 4332 e574f58.exe rundll32.exe PID 4332 wrote to memory of 3332 4332 e574f58.exe rundll32.exe PID 4332 wrote to memory of 3332 4332 e574f58.exe rundll32.exe PID 3332 wrote to memory of 3568 3332 rundll32.exe e57516c.exe PID 3332 wrote to memory of 3568 3332 rundll32.exe e57516c.exe PID 3332 wrote to memory of 3568 3332 rundll32.exe e57516c.exe PID 4332 wrote to memory of 784 4332 e574f58.exe fontdrvhost.exe PID 4332 wrote to memory of 792 4332 e574f58.exe fontdrvhost.exe PID 4332 wrote to memory of 60 4332 e574f58.exe dwm.exe PID 4332 wrote to memory of 2628 4332 e574f58.exe sihost.exe PID 4332 wrote to memory of 2680 4332 e574f58.exe svchost.exe PID 4332 wrote to memory of 2756 4332 e574f58.exe taskhostw.exe PID 4332 wrote to memory of 3396 4332 e574f58.exe Explorer.EXE PID 4332 wrote to memory of 3544 4332 e574f58.exe svchost.exe PID 4332 wrote to memory of 3740 4332 e574f58.exe DllHost.exe PID 4332 wrote to memory of 3836 4332 e574f58.exe StartMenuExperienceHost.exe PID 4332 wrote to memory of 3896 4332 e574f58.exe RuntimeBroker.exe PID 4332 wrote to memory of 4000 4332 e574f58.exe SearchApp.exe PID 4332 wrote to memory of 2124 4332 e574f58.exe RuntimeBroker.exe PID 4332 wrote to memory of 404 4332 e574f58.exe RuntimeBroker.exe PID 4332 wrote to memory of 3640 4332 e574f58.exe TextInputHost.exe PID 4332 wrote to memory of 4896 4332 e574f58.exe backgroundTaskHost.exe PID 4332 wrote to memory of 1856 4332 e574f58.exe backgroundTaskHost.exe PID 4332 wrote to memory of 2888 4332 e574f58.exe rundll32.exe PID 4332 wrote to memory of 3568 4332 e574f58.exe e57516c.exe PID 4332 wrote to memory of 3568 4332 e574f58.exe e57516c.exe PID 4332 wrote to memory of 1696 4332 e574f58.exe BackgroundTaskHost.exe PID 3332 wrote to memory of 1472 3332 rundll32.exe e578472.exe PID 3332 wrote to memory of 1472 3332 rundll32.exe e578472.exe PID 3332 wrote to memory of 1472 3332 rundll32.exe e578472.exe PID 1472 wrote to memory of 784 1472 e578472.exe fontdrvhost.exe PID 1472 wrote to memory of 792 1472 e578472.exe fontdrvhost.exe PID 1472 wrote to memory of 60 1472 e578472.exe dwm.exe PID 1472 wrote to memory of 2628 1472 e578472.exe sihost.exe PID 1472 wrote to memory of 2680 1472 e578472.exe svchost.exe PID 1472 wrote to memory of 2756 1472 e578472.exe taskhostw.exe PID 1472 wrote to memory of 3396 1472 e578472.exe Explorer.EXE PID 1472 wrote to memory of 3544 1472 e578472.exe svchost.exe PID 1472 wrote to memory of 3740 1472 e578472.exe DllHost.exe PID 1472 wrote to memory of 3836 1472 e578472.exe StartMenuExperienceHost.exe PID 1472 wrote to memory of 3896 1472 e578472.exe RuntimeBroker.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
e574f58.exee578472.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e574f58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578472.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\524e94735a951a9e778b45132075f073d344c732e4c8502973060c8c32ce6115.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\524e94735a951a9e778b45132075f073d344c732e4c8502973060c8c32ce6115.dll,#13⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e574f58.exeC:\Users\Admin\AppData\Local\Temp\e574f58.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\e57516c.exeC:\Users\Admin\AppData\Local\Temp\e57516c.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\e578472.exeC:\Users\Admin\AppData\Local\Temp\e578472.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\system32\BackgroundTaskHost.exe"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\e574f58.exeFilesize
97KB
MD5aa951a8c02c8153ab05902165b878006
SHA1691dae5ec1572a70698ab3d9690fec2a03d65d81
SHA2568ddc10542a0283e0d8e121bee10db6e780585283b349ffe724676e2a28369cb8
SHA5127c300ce8bd5472681717a3c7140c5f629e768a102c4685b10210950becacad5eb03feb769d5138819ec6814c48427c8d68a89a4b50c196edc662991425f83a22
-
C:\Windows\SYSTEM.INIFilesize
257B
MD5529d20c87e88b6d4258fdc572c723293
SHA1c1f3d79e06d0996089901149aef77488aa8c452c
SHA256b3933c296d9ed28d1687a08376159bc1268afb824b37c02ead5f121506787ffe
SHA512582731b3218d02dbf387f29cb64ebce73f3feda8378c2b90ddf2b4d281ec712823287721be482e2fceb7e3c9e21808289e91105da622c7af5eaaa5e5f8769fae
-
memory/1472-87-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/1472-139-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1472-140-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/1472-90-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/1472-52-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1472-107-0x0000000001AF0000-0x0000000001AF2000-memory.dmpFilesize
8KB
-
memory/1472-108-0x0000000001B00000-0x0000000001B01000-memory.dmpFilesize
4KB
-
memory/1472-100-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/1472-89-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/3332-19-0x0000000003F80000-0x0000000003F81000-memory.dmpFilesize
4KB
-
memory/3332-24-0x0000000003EF0000-0x0000000003EF2000-memory.dmpFilesize
8KB
-
memory/3332-22-0x0000000003EF0000-0x0000000003EF2000-memory.dmpFilesize
8KB
-
memory/3332-1-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/3332-18-0x0000000003EF0000-0x0000000003EF2000-memory.dmpFilesize
8KB
-
memory/3332-47-0x0000000003EF0000-0x0000000003EF2000-memory.dmpFilesize
8KB
-
memory/3568-86-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3568-43-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/3568-42-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/3568-41-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/4332-37-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/4332-60-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/4332-34-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/4332-38-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/4332-35-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/4332-33-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/4332-32-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/4332-31-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/4332-27-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/4332-45-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/4332-53-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/4332-54-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/4332-56-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/4332-57-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/4332-59-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/4332-36-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/4332-63-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/4332-74-0x0000000003660000-0x0000000003662000-memory.dmpFilesize
8KB
-
memory/4332-82-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4332-8-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/4332-21-0x0000000003E70000-0x0000000003E71000-memory.dmpFilesize
4KB
-
memory/4332-10-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/4332-26-0x0000000003660000-0x0000000003662000-memory.dmpFilesize
8KB
-
memory/4332-11-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/4332-17-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/4332-28-0x0000000003660000-0x0000000003662000-memory.dmpFilesize
8KB
-
memory/4332-9-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/4332-6-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/4332-4-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB