Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 02:15
Static task
static1
Behavioral task
behavioral1
Sample
b4cd8e3fbbd1a33ba39fa93d52b22777fca5f16213ec99015dba9c02ee75f36e.dll
Resource
win7-20240508-en
General
-
Target
b4cd8e3fbbd1a33ba39fa93d52b22777fca5f16213ec99015dba9c02ee75f36e.dll
-
Size
120KB
-
MD5
0c2f844693c809e025bc11d1b353508c
-
SHA1
c6e200af1dbee09767f6c12c307c204725e5ce43
-
SHA256
b4cd8e3fbbd1a33ba39fa93d52b22777fca5f16213ec99015dba9c02ee75f36e
-
SHA512
478dee54de7d3852538a31ecb6f36a657ab8b535ee392b9bcd810ac93120a0ee247510dc64545d26533f87ef7e54d284513a88866d092dfb97442f4f95a07ef4
-
SSDEEP
3072:iwOWJGM4JznqPUcnUDEeNoLM078NMQXLmm959n66:8WyNsUYUTYMu8NMKI6
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
f762607.exef762443.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f762607.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f762443.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f762443.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f762443.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f762607.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f762607.exe -
Processes:
f762443.exef762607.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f762443.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f762607.exe -
Processes:
f762443.exef762607.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f762443.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f762443.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f762443.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f762607.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f762607.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f762607.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f762443.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f762443.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f762443.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f762607.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f762607.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f762607.exe -
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 23 IoCs
Processes:
resource yara_rule behavioral1/memory/2596-16-0x0000000000700000-0x00000000017BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2596-19-0x0000000000700000-0x00000000017BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2596-18-0x0000000000700000-0x00000000017BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2596-14-0x0000000000700000-0x00000000017BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2596-22-0x0000000000700000-0x00000000017BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2596-23-0x0000000000700000-0x00000000017BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2596-24-0x0000000000700000-0x00000000017BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2596-17-0x0000000000700000-0x00000000017BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2596-21-0x0000000000700000-0x00000000017BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2596-20-0x0000000000700000-0x00000000017BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2596-63-0x0000000000700000-0x00000000017BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2596-64-0x0000000000700000-0x00000000017BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2596-65-0x0000000000700000-0x00000000017BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2596-66-0x0000000000700000-0x00000000017BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2596-67-0x0000000000700000-0x00000000017BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2596-69-0x0000000000700000-0x00000000017BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2596-82-0x0000000000700000-0x00000000017BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2596-83-0x0000000000700000-0x00000000017BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2596-105-0x0000000000700000-0x00000000017BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2596-107-0x0000000000700000-0x00000000017BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2596-147-0x0000000000700000-0x00000000017BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2680-159-0x0000000000920000-0x00000000019DA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2680-183-0x0000000000920000-0x00000000019DA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine -
UPX dump on OEP (original entry point) 26 IoCs
Processes:
resource yara_rule behavioral1/memory/2596-16-0x0000000000700000-0x00000000017BA000-memory.dmp UPX behavioral1/memory/2596-19-0x0000000000700000-0x00000000017BA000-memory.dmp UPX behavioral1/memory/2596-18-0x0000000000700000-0x00000000017BA000-memory.dmp UPX behavioral1/memory/2596-14-0x0000000000700000-0x00000000017BA000-memory.dmp UPX behavioral1/memory/2596-22-0x0000000000700000-0x00000000017BA000-memory.dmp UPX behavioral1/memory/2596-23-0x0000000000700000-0x00000000017BA000-memory.dmp UPX behavioral1/memory/2596-24-0x0000000000700000-0x00000000017BA000-memory.dmp UPX behavioral1/memory/2596-17-0x0000000000700000-0x00000000017BA000-memory.dmp UPX behavioral1/memory/2596-21-0x0000000000700000-0x00000000017BA000-memory.dmp UPX behavioral1/memory/2596-20-0x0000000000700000-0x00000000017BA000-memory.dmp UPX behavioral1/memory/2596-63-0x0000000000700000-0x00000000017BA000-memory.dmp UPX behavioral1/memory/2596-64-0x0000000000700000-0x00000000017BA000-memory.dmp UPX behavioral1/memory/2596-65-0x0000000000700000-0x00000000017BA000-memory.dmp UPX behavioral1/memory/2596-66-0x0000000000700000-0x00000000017BA000-memory.dmp UPX behavioral1/memory/2596-67-0x0000000000700000-0x00000000017BA000-memory.dmp UPX behavioral1/memory/2596-69-0x0000000000700000-0x00000000017BA000-memory.dmp UPX behavioral1/memory/2596-82-0x0000000000700000-0x00000000017BA000-memory.dmp UPX behavioral1/memory/2596-83-0x0000000000700000-0x00000000017BA000-memory.dmp UPX behavioral1/memory/2596-105-0x0000000000700000-0x00000000017BA000-memory.dmp UPX behavioral1/memory/2596-107-0x0000000000700000-0x00000000017BA000-memory.dmp UPX behavioral1/memory/2596-146-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/2596-147-0x0000000000700000-0x00000000017BA000-memory.dmp UPX behavioral1/memory/2680-159-0x0000000000920000-0x00000000019DA000-memory.dmp UPX behavioral1/memory/2680-182-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/2680-183-0x0000000000920000-0x00000000019DA000-memory.dmp UPX behavioral1/memory/1328-187-0x0000000000400000-0x0000000000412000-memory.dmp UPX -
Executes dropped EXE 3 IoCs
Processes:
f762443.exef762607.exef764902.exepid process 2596 f762443.exe 2680 f762607.exe 1328 f764902.exe -
Loads dropped DLL 6 IoCs
Processes:
rundll32.exepid process 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe -
Processes:
resource yara_rule behavioral1/memory/2596-16-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2596-19-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2596-18-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2596-14-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2596-22-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2596-23-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2596-24-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2596-17-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2596-21-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2596-20-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2596-63-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2596-64-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2596-65-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2596-66-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2596-67-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2596-69-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2596-82-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2596-83-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2596-105-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2596-107-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2596-147-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2680-159-0x0000000000920000-0x00000000019DA000-memory.dmp upx behavioral1/memory/2680-183-0x0000000000920000-0x00000000019DA000-memory.dmp upx -
Processes:
f762443.exef762607.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f762443.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f762607.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f762607.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f762443.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f762443.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f762607.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f762607.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f762443.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f762607.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f762607.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f762443.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f762443.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f762443.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f762607.exe -
Processes:
f762443.exef762607.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f762443.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f762607.exe -
Enumerates connected drives 3 TTPs 12 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
f762443.exedescription ioc process File opened (read-only) \??\I: f762443.exe File opened (read-only) \??\M: f762443.exe File opened (read-only) \??\N: f762443.exe File opened (read-only) \??\K: f762443.exe File opened (read-only) \??\L: f762443.exe File opened (read-only) \??\O: f762443.exe File opened (read-only) \??\P: f762443.exe File opened (read-only) \??\E: f762443.exe File opened (read-only) \??\G: f762443.exe File opened (read-only) \??\H: f762443.exe File opened (read-only) \??\J: f762443.exe File opened (read-only) \??\Q: f762443.exe -
Drops file in Windows directory 3 IoCs
Processes:
f762443.exef762607.exedescription ioc process File created C:\Windows\f7624b0 f762443.exe File opened for modification C:\Windows\SYSTEM.INI f762443.exe File created C:\Windows\f767520 f762607.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
f762443.exef762607.exepid process 2596 f762443.exe 2596 f762443.exe 2680 f762607.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
Processes:
f762443.exef762607.exedescription pid process Token: SeDebugPrivilege 2596 f762443.exe Token: SeDebugPrivilege 2596 f762443.exe Token: SeDebugPrivilege 2596 f762443.exe Token: SeDebugPrivilege 2596 f762443.exe Token: SeDebugPrivilege 2596 f762443.exe Token: SeDebugPrivilege 2596 f762443.exe Token: SeDebugPrivilege 2596 f762443.exe Token: SeDebugPrivilege 2596 f762443.exe Token: SeDebugPrivilege 2596 f762443.exe Token: SeDebugPrivilege 2596 f762443.exe Token: SeDebugPrivilege 2596 f762443.exe Token: SeDebugPrivilege 2596 f762443.exe Token: SeDebugPrivilege 2596 f762443.exe Token: SeDebugPrivilege 2596 f762443.exe Token: SeDebugPrivilege 2596 f762443.exe Token: SeDebugPrivilege 2596 f762443.exe Token: SeDebugPrivilege 2596 f762443.exe Token: SeDebugPrivilege 2596 f762443.exe Token: SeDebugPrivilege 2596 f762443.exe Token: SeDebugPrivilege 2596 f762443.exe Token: SeDebugPrivilege 2596 f762443.exe Token: SeDebugPrivilege 2680 f762607.exe Token: SeDebugPrivilege 2680 f762607.exe Token: SeDebugPrivilege 2680 f762607.exe Token: SeDebugPrivilege 2680 f762607.exe Token: SeDebugPrivilege 2680 f762607.exe Token: SeDebugPrivilege 2680 f762607.exe Token: SeDebugPrivilege 2680 f762607.exe Token: SeDebugPrivilege 2680 f762607.exe Token: SeDebugPrivilege 2680 f762607.exe Token: SeDebugPrivilege 2680 f762607.exe Token: SeDebugPrivilege 2680 f762607.exe Token: SeDebugPrivilege 2680 f762607.exe Token: SeDebugPrivilege 2680 f762607.exe Token: SeDebugPrivilege 2680 f762607.exe Token: SeDebugPrivilege 2680 f762607.exe Token: SeDebugPrivilege 2680 f762607.exe Token: SeDebugPrivilege 2680 f762607.exe Token: SeDebugPrivilege 2680 f762607.exe Token: SeDebugPrivilege 2680 f762607.exe Token: SeDebugPrivilege 2680 f762607.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
rundll32.exerundll32.exef762443.exef762607.exedescription pid process target process PID 2232 wrote to memory of 316 2232 rundll32.exe rundll32.exe PID 2232 wrote to memory of 316 2232 rundll32.exe rundll32.exe PID 2232 wrote to memory of 316 2232 rundll32.exe rundll32.exe PID 2232 wrote to memory of 316 2232 rundll32.exe rundll32.exe PID 2232 wrote to memory of 316 2232 rundll32.exe rundll32.exe PID 2232 wrote to memory of 316 2232 rundll32.exe rundll32.exe PID 2232 wrote to memory of 316 2232 rundll32.exe rundll32.exe PID 316 wrote to memory of 2596 316 rundll32.exe f762443.exe PID 316 wrote to memory of 2596 316 rundll32.exe f762443.exe PID 316 wrote to memory of 2596 316 rundll32.exe f762443.exe PID 316 wrote to memory of 2596 316 rundll32.exe f762443.exe PID 2596 wrote to memory of 1104 2596 f762443.exe taskhost.exe PID 2596 wrote to memory of 1180 2596 f762443.exe Dwm.exe PID 2596 wrote to memory of 1208 2596 f762443.exe Explorer.EXE PID 2596 wrote to memory of 2252 2596 f762443.exe DllHost.exe PID 2596 wrote to memory of 2232 2596 f762443.exe rundll32.exe PID 2596 wrote to memory of 316 2596 f762443.exe rundll32.exe PID 2596 wrote to memory of 316 2596 f762443.exe rundll32.exe PID 316 wrote to memory of 2680 316 rundll32.exe f762607.exe PID 316 wrote to memory of 2680 316 rundll32.exe f762607.exe PID 316 wrote to memory of 2680 316 rundll32.exe f762607.exe PID 316 wrote to memory of 2680 316 rundll32.exe f762607.exe PID 316 wrote to memory of 1328 316 rundll32.exe f764902.exe PID 316 wrote to memory of 1328 316 rundll32.exe f764902.exe PID 316 wrote to memory of 1328 316 rundll32.exe f764902.exe PID 316 wrote to memory of 1328 316 rundll32.exe f764902.exe PID 2596 wrote to memory of 1104 2596 f762443.exe taskhost.exe PID 2596 wrote to memory of 1180 2596 f762443.exe Dwm.exe PID 2596 wrote to memory of 1208 2596 f762443.exe Explorer.EXE PID 2596 wrote to memory of 2680 2596 f762443.exe f762607.exe PID 2596 wrote to memory of 2680 2596 f762443.exe f762607.exe PID 2596 wrote to memory of 1328 2596 f762443.exe f764902.exe PID 2596 wrote to memory of 1328 2596 f762443.exe f764902.exe PID 2680 wrote to memory of 1104 2680 f762607.exe taskhost.exe PID 2680 wrote to memory of 1180 2680 f762607.exe Dwm.exe PID 2680 wrote to memory of 1208 2680 f762607.exe Explorer.EXE -
System policy modification 1 TTPs 2 IoCs
Processes:
f762443.exef762607.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f762443.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f762607.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1104
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1180
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1208
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b4cd8e3fbbd1a33ba39fa93d52b22777fca5f16213ec99015dba9c02ee75f36e.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b4cd8e3fbbd1a33ba39fa93d52b22777fca5f16213ec99015dba9c02ee75f36e.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Users\Admin\AppData\Local\Temp\f762443.exeC:\Users\Admin\AppData\Local\Temp\f762443.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\f762607.exeC:\Users\Admin\AppData\Local\Temp\f762607.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\f764902.exeC:\Users\Admin\AppData\Local\Temp\f764902.exe4⤵
- Executes dropped EXE
PID:1328
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:2252
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\f762443.exeFilesize
97KB
MD5b124090d1d22691f606c29561a56ec49
SHA1c745392a14fe656fd916ba3483809328374e83d6
SHA256ef5c7baa0db3143cbdba6cfaed5f6a525a6cf713fb96a995eb503796963a4a88
SHA5124f6c387ac7bcdec4821d0b61880ce925563c6e766f4859eadeb230441654d40571a19d6b4648d074cc2c8bff5c881d236973fd9540788e752db7e1c0276e3988
-
C:\Windows\SYSTEM.INIFilesize
257B
MD5772b2e793560bcf24cd839bed7f3bf0a
SHA115ac88bd8f746fc1c3e8385f1f9a33f662700520
SHA25681c90c00e539db15f4cb25707e58fbd7e82740aadbe965070552d6c45012cf71
SHA512dc9a14d2ecc8b9f19583b66243cdff19b60b463d6ee49c64d0a22883dd0a956e37004f725b7f6b1ca74fecc16fd53c5eae010676a40b5efb2be4cb22bb021435
-
memory/316-11-0x00000000001D0000-0x00000000001E2000-memory.dmpFilesize
72KB
-
memory/316-0-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/316-38-0x00000000001F0000-0x00000000001F2000-memory.dmpFilesize
8KB
-
memory/316-1-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/316-3-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/316-2-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/316-60-0x0000000000380000-0x0000000000392000-memory.dmpFilesize
72KB
-
memory/316-61-0x00000000001F0000-0x00000000001F2000-memory.dmpFilesize
8KB
-
memory/316-48-0x0000000000200000-0x0000000000201000-memory.dmpFilesize
4KB
-
memory/316-78-0x00000000001F0000-0x00000000001F2000-memory.dmpFilesize
8KB
-
memory/316-39-0x0000000000200000-0x0000000000201000-memory.dmpFilesize
4KB
-
memory/1104-30-0x00000000003A0000-0x00000000003A2000-memory.dmpFilesize
8KB
-
memory/1328-187-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1328-81-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1328-102-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/1328-100-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/1328-104-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/2596-63-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2596-14-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2596-59-0x00000000003F0000-0x00000000003F2000-memory.dmpFilesize
8KB
-
memory/2596-49-0x00000000004E0000-0x00000000004E1000-memory.dmpFilesize
4KB
-
memory/2596-17-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2596-21-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2596-20-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2596-51-0x00000000003F0000-0x00000000003F2000-memory.dmpFilesize
8KB
-
memory/2596-64-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2596-65-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2596-66-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2596-67-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2596-69-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2596-23-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2596-22-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2596-82-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2596-13-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2596-24-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2596-16-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2596-18-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2596-83-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2596-147-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2596-19-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2596-105-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2596-107-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2596-123-0x00000000003F0000-0x00000000003F2000-memory.dmpFilesize
8KB
-
memory/2596-146-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2680-103-0x00000000001B0000-0x00000000001B2000-memory.dmpFilesize
8KB
-
memory/2680-101-0x00000000001B0000-0x00000000001B2000-memory.dmpFilesize
8KB
-
memory/2680-159-0x0000000000920000-0x00000000019DA000-memory.dmpFilesize
16.7MB
-
memory/2680-182-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2680-183-0x0000000000920000-0x00000000019DA000-memory.dmpFilesize
16.7MB
-
memory/2680-94-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB