Analysis
-
max time kernel
24s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 02:24
Static task
static1
Behavioral task
behavioral1
Sample
a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe
Resource
win7-20240221-en
General
-
Target
a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe
-
Size
1.3MB
-
MD5
780331c1ca6bb5df11eff07d0e2ae963
-
SHA1
dd6d3f3d8367b9a8cbecfe2b5839c542caea7225
-
SHA256
a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d
-
SHA512
229d70fab70a26d01109c0d56eebc28b7bc71c7410d14356e2309b97c9cc7222677ced289c26c9072145dfa04b54fd7dac06a0de34a58cde62a790d391ea4f8c
-
SSDEEP
24576:X7ZNQ1pZtDtfu67T8a+SHDy45m5ZbHNYG4k2EV2ynovuTGn7QWxxdALx:X7ZNQ1pZDuOTLHhs/pV2yn7TG7ZRAd
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
Logo1_.exea1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" Logo1_.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" Logo1_.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" Logo1_.exe -
Processes:
a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exeLogo1_.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Logo1_.exe -
Processes:
Logo1_.exea1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" Logo1_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" Logo1_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" Logo1_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" Logo1_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" Logo1_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" Logo1_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2368 cmd.exe -
Executes dropped EXE 2 IoCs
Processes:
Logo1_.exea1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exepid process 2212 Logo1_.exe 2560 a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 2368 cmd.exe -
Processes:
resource yara_rule behavioral1/memory/2560-31-0x0000000001EA0000-0x0000000002F2E000-memory.dmp upx behavioral1/memory/2560-34-0x0000000001EA0000-0x0000000002F2E000-memory.dmp upx behavioral1/memory/2560-39-0x0000000001EA0000-0x0000000002F2E000-memory.dmp upx behavioral1/memory/2560-38-0x0000000001EA0000-0x0000000002F2E000-memory.dmp upx behavioral1/memory/2560-40-0x0000000001EA0000-0x0000000002F2E000-memory.dmp upx behavioral1/memory/2560-36-0x0000000001EA0000-0x0000000002F2E000-memory.dmp upx behavioral1/memory/2560-37-0x0000000001EA0000-0x0000000002F2E000-memory.dmp upx behavioral1/memory/2560-35-0x0000000001EA0000-0x0000000002F2E000-memory.dmp upx behavioral1/memory/2560-33-0x0000000001EA0000-0x0000000002F2E000-memory.dmp upx behavioral1/memory/2560-41-0x0000000001EA0000-0x0000000002F2E000-memory.dmp upx behavioral1/memory/2560-42-0x0000000001EA0000-0x0000000002F2E000-memory.dmp upx behavioral1/memory/2560-81-0x0000000001EA0000-0x0000000002F2E000-memory.dmp upx behavioral1/memory/2560-82-0x0000000001EA0000-0x0000000002F2E000-memory.dmp upx behavioral1/memory/2560-84-0x0000000001EA0000-0x0000000002F2E000-memory.dmp upx behavioral1/memory/2560-88-0x0000000001EA0000-0x0000000002F2E000-memory.dmp upx behavioral1/memory/2560-89-0x0000000001EA0000-0x0000000002F2E000-memory.dmp upx behavioral1/memory/2560-90-0x0000000001EA0000-0x0000000002F2E000-memory.dmp upx behavioral1/memory/2560-92-0x0000000001EA0000-0x0000000002F2E000-memory.dmp upx behavioral1/memory/2560-94-0x0000000001EA0000-0x0000000002F2E000-memory.dmp upx behavioral1/memory/2212-133-0x0000000003050000-0x00000000040DE000-memory.dmp upx behavioral1/memory/2212-216-0x0000000003050000-0x00000000040DE000-memory.dmp upx -
Processes:
a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exeLogo1_.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" Logo1_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" Logo1_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" Logo1_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc Logo1_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" Logo1_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" Logo1_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" Logo1_.exe -
Processes:
a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exeLogo1_.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Logo1_.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
Logo1_.exea1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exedescription ioc process File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\I: a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\G: a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\E: a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\H: a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe -
Drops file in Windows directory 5 IoCs
Processes:
a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exeLogo1_.exea1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exedescription ioc process File created C:\Windows\Logo1_.exe a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File opened for modification C:\Windows\SYSTEM.INI a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe File created C:\Windows\vDll.dll Logo1_.exe File created C:\Windows\rundl132.exe a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
Logo1_.exea1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exepid process 2212 Logo1_.exe 2212 Logo1_.exe 2212 Logo1_.exe 2212 Logo1_.exe 2212 Logo1_.exe 2212 Logo1_.exe 2560 a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe 2212 Logo1_.exe 2212 Logo1_.exe 2212 Logo1_.exe 2212 Logo1_.exe 2212 Logo1_.exe 2212 Logo1_.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
Processes:
a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exeLogo1_.exedescription pid process Token: SeDebugPrivilege 2560 a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe Token: SeDebugPrivilege 2560 a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe Token: SeDebugPrivilege 2560 a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe Token: SeDebugPrivilege 2560 a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe Token: SeDebugPrivilege 2560 a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe Token: SeDebugPrivilege 2560 a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe Token: SeDebugPrivilege 2560 a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe Token: SeDebugPrivilege 2560 a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe Token: SeDebugPrivilege 2560 a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe Token: SeDebugPrivilege 2560 a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe Token: SeDebugPrivilege 2560 a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe Token: SeDebugPrivilege 2560 a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe Token: SeDebugPrivilege 2560 a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe Token: SeDebugPrivilege 2560 a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe Token: SeDebugPrivilege 2560 a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe Token: SeDebugPrivilege 2560 a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe Token: SeDebugPrivilege 2560 a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe Token: SeDebugPrivilege 2560 a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe Token: SeDebugPrivilege 2560 a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe Token: SeDebugPrivilege 2560 a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe Token: SeDebugPrivilege 2212 Logo1_.exe Token: SeDebugPrivilege 2212 Logo1_.exe Token: SeDebugPrivilege 2212 Logo1_.exe Token: SeDebugPrivilege 2212 Logo1_.exe Token: SeDebugPrivilege 2212 Logo1_.exe Token: SeDebugPrivilege 2212 Logo1_.exe Token: SeDebugPrivilege 2212 Logo1_.exe Token: SeDebugPrivilege 2212 Logo1_.exe Token: SeDebugPrivilege 2212 Logo1_.exe Token: SeDebugPrivilege 2212 Logo1_.exe Token: SeDebugPrivilege 2212 Logo1_.exe Token: SeDebugPrivilege 2212 Logo1_.exe Token: SeDebugPrivilege 2212 Logo1_.exe Token: SeDebugPrivilege 2212 Logo1_.exe Token: SeDebugPrivilege 2212 Logo1_.exe Token: SeDebugPrivilege 2212 Logo1_.exe Token: SeDebugPrivilege 2212 Logo1_.exe Token: SeDebugPrivilege 2212 Logo1_.exe Token: SeDebugPrivilege 2212 Logo1_.exe Token: SeDebugPrivilege 2212 Logo1_.exe Token: SeDebugPrivilege 2212 Logo1_.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exeLogo1_.exenet.execmd.exea1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exedescription pid process target process PID 2952 wrote to memory of 2368 2952 a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe cmd.exe PID 2952 wrote to memory of 2368 2952 a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe cmd.exe PID 2952 wrote to memory of 2368 2952 a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe cmd.exe PID 2952 wrote to memory of 2368 2952 a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe cmd.exe PID 2952 wrote to memory of 2212 2952 a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe Logo1_.exe PID 2952 wrote to memory of 2212 2952 a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe Logo1_.exe PID 2952 wrote to memory of 2212 2952 a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe Logo1_.exe PID 2952 wrote to memory of 2212 2952 a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe Logo1_.exe PID 2212 wrote to memory of 3048 2212 Logo1_.exe net.exe PID 2212 wrote to memory of 3048 2212 Logo1_.exe net.exe PID 2212 wrote to memory of 3048 2212 Logo1_.exe net.exe PID 2212 wrote to memory of 3048 2212 Logo1_.exe net.exe PID 3048 wrote to memory of 2636 3048 net.exe net1.exe PID 3048 wrote to memory of 2636 3048 net.exe net1.exe PID 3048 wrote to memory of 2636 3048 net.exe net1.exe PID 3048 wrote to memory of 2636 3048 net.exe net1.exe PID 2368 wrote to memory of 2560 2368 cmd.exe a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe PID 2368 wrote to memory of 2560 2368 cmd.exe a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe PID 2368 wrote to memory of 2560 2368 cmd.exe a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe PID 2368 wrote to memory of 2560 2368 cmd.exe a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe PID 2368 wrote to memory of 2560 2368 cmd.exe a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe PID 2368 wrote to memory of 2560 2368 cmd.exe a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe PID 2368 wrote to memory of 2560 2368 cmd.exe a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe PID 2560 wrote to memory of 1112 2560 a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe taskhost.exe PID 2560 wrote to memory of 1172 2560 a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe Dwm.exe PID 2560 wrote to memory of 1204 2560 a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe Explorer.EXE PID 2560 wrote to memory of 1656 2560 a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe DllHost.exe PID 2560 wrote to memory of 2368 2560 a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe cmd.exe PID 2560 wrote to memory of 2368 2560 a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe cmd.exe PID 2560 wrote to memory of 2212 2560 a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe Logo1_.exe PID 2560 wrote to memory of 2212 2560 a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe Logo1_.exe PID 2560 wrote to memory of 3060 2560 a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe conhost.exe PID 2212 wrote to memory of 1204 2212 Logo1_.exe Explorer.EXE PID 2212 wrote to memory of 1204 2212 Logo1_.exe Explorer.EXE PID 2212 wrote to memory of 1112 2212 Logo1_.exe taskhost.exe PID 2212 wrote to memory of 1172 2212 Logo1_.exe Dwm.exe PID 2212 wrote to memory of 1204 2212 Logo1_.exe Explorer.EXE PID 2212 wrote to memory of 1112 2212 Logo1_.exe taskhost.exe PID 2212 wrote to memory of 1172 2212 Logo1_.exe Dwm.exe PID 2212 wrote to memory of 1204 2212 Logo1_.exe Explorer.EXE -
System policy modification 1 TTPs 2 IoCs
Processes:
a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exeLogo1_.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Logo1_.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1112
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1172
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe"C:\Users\Admin\AppData\Local\Temp\a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$a2378.bat3⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe"C:\Users\Admin\AppData\Local\Temp\a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe"4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2560 -
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2212 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:2636
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1656
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1551881041712146641-18004275619248980231531479077-766010252-1404914250-1363507020"1⤵PID:3060
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\$$a2378.batFilesize
722B
MD5218095b4448b6f127e9a683b481ee771
SHA14e7a61d47aa7c0729ea4ea41d323d4a1eb2a6942
SHA256d1e2981bb66ab6589db358dcffcbec4045ad26a328af1fe1d1e027e120d3090c
SHA512c3e02e938e8918ac1bdf06a7fdf0ccf3850233b4b98943477dd2f6ddaffc27cbe0fa30ac108ee34a64c523aa57f4dd3e0db292b22a414e39733d54960b3c9e66
-
C:\Users\Admin\AppData\Local\Temp\0F76277E_Rar\a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exeFilesize
1.2MB
MD508ca52e2af42b3f0c61803915ed62730
SHA1e03545f2ae7dfacbbdb3a7baed0477d7e5eceb3e
SHA2566ee365b385d95f0068e83c8662d534f014c1b686dba1c6d4196ae9d31fe131ed
SHA5121e74f898b7a11347510e9175f34233c86a7bf2b016f0789663ea70a1c660f7aa8d4b87dfa6151691ac3ebf270bf79c430b562a294d94675ccfcd0ff2d148c745
-
C:\Users\Admin\AppData\Local\Temp\a1fa405e15cbdf1b3dd7247d5a708b9d8e62ade764a9df7b9075fbbe14dcb71d.exe.exeFilesize
1.2MB
MD52323dc69d087110d33212d4e27d86327
SHA158f28716e205445072bcdf474f83c4c558f8cae1
SHA2569b8b7f54f9b2ce28d8c11d3ecaf4c8b84317aeed2357fea7c1e2f6e0cace9eb0
SHA512841bdaf45497d8e99cbbcb12f7cdb682c0af0791e9e4539ec3f1d57d262708f07543c29769ecfad4567ebd219d78e0b4e12226f4645be0abf63ecf430bfd7652
-
C:\Windows\Logo1_.exeFilesize
26KB
MD5b029778f3ac823d7c0b7150399fb9da1
SHA1f3f4b3615f75b7ff4992e41e62f7ceac37d06e11
SHA25634ac708d04dc44510292d2642c1fee1d74a0c64977d79c6086c8b38f7ab34d29
SHA512af256d7118bb42bf8216dab9a34078d1970d21d42ccb382208ff4f8a53f66041d11a04e687fa70b0cf4bca542b743c1f57c227aba889232c705925a79c3504a0
-
C:\Windows\SYSTEM.INIFilesize
257B
MD5e7561d7ff852714bb3e93acdf36b4b90
SHA12d204187e4b8c98171449ff81e781eca05d0a8a5
SHA256257a1d4edac77a2d44369fc51075f3dd94426cfb3a8e1548d4b033919d443b8f
SHA5123cdc14f716bc01fd3917dd55e4f2bd4639bf572bfdbd412b2dd33e9d617c8464c71085afdf03edf20c94c639bae4547e52e69617ed98aaa6113627c8269cc03f
-
F:\$RECYCLE.BIN\S-1-5-21-1298544033-3225604241-2703760938-1000\_desktop.iniFilesize
9B
MD51d8a3f28a10f9f8be912b9aa0d257c6f
SHA1358ca1e31914fb991e009c945a40796cf465bb50
SHA2563887316b3cbbf3fa224813b5883e0ee043c8422d4f72d4ebdf0ae8a195b40d3e
SHA512b1ec3f07af4abcdc007ab43a9e685419176d74a6856df9be9085f5bc33178b91b30fc44667fd083d2aa818483b4ea216920fa479ebb277325c7b1e5d7a8caec1
-
memory/1112-43-0x0000000000220000-0x0000000000222000-memory.dmpFilesize
8KB
-
memory/2212-133-0x0000000003050000-0x00000000040DE000-memory.dmpFilesize
16.6MB
-
memory/2212-66-0x00000000002E0000-0x00000000002E2000-memory.dmpFilesize
8KB
-
memory/2212-145-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/2212-216-0x0000000003050000-0x00000000040DE000-memory.dmpFilesize
16.6MB
-
memory/2212-18-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/2212-79-0x00000000002E0000-0x00000000002E2000-memory.dmpFilesize
8KB
-
memory/2212-69-0x0000000000320000-0x0000000000321000-memory.dmpFilesize
4KB
-
memory/2212-180-0x00000000002E0000-0x00000000002E2000-memory.dmpFilesize
8KB
-
memory/2368-62-0x0000000000270000-0x0000000000272000-memory.dmpFilesize
8KB
-
memory/2368-61-0x0000000000280000-0x0000000000281000-memory.dmpFilesize
4KB
-
memory/2368-78-0x0000000000270000-0x0000000000272000-memory.dmpFilesize
8KB
-
memory/2368-60-0x0000000000280000-0x0000000000281000-memory.dmpFilesize
4KB
-
memory/2368-51-0x0000000000270000-0x0000000000272000-memory.dmpFilesize
8KB
-
memory/2368-28-0x0000000002360000-0x00000000024A2000-memory.dmpFilesize
1.3MB
-
memory/2560-80-0x00000000003E0000-0x00000000003E2000-memory.dmpFilesize
8KB
-
memory/2560-84-0x0000000001EA0000-0x0000000002F2E000-memory.dmpFilesize
16.6MB
-
memory/2560-42-0x0000000001EA0000-0x0000000002F2E000-memory.dmpFilesize
16.6MB
-
memory/2560-41-0x0000000001EA0000-0x0000000002F2E000-memory.dmpFilesize
16.6MB
-
memory/2560-77-0x00000000003E0000-0x00000000003E2000-memory.dmpFilesize
8KB
-
memory/2560-76-0x0000000000640000-0x0000000000641000-memory.dmpFilesize
4KB
-
memory/2560-33-0x0000000001EA0000-0x0000000002F2E000-memory.dmpFilesize
16.6MB
-
memory/2560-35-0x0000000001EA0000-0x0000000002F2E000-memory.dmpFilesize
16.6MB
-
memory/2560-37-0x0000000001EA0000-0x0000000002F2E000-memory.dmpFilesize
16.6MB
-
memory/2560-36-0x0000000001EA0000-0x0000000002F2E000-memory.dmpFilesize
16.6MB
-
memory/2560-40-0x0000000001EA0000-0x0000000002F2E000-memory.dmpFilesize
16.6MB
-
memory/2560-81-0x0000000001EA0000-0x0000000002F2E000-memory.dmpFilesize
16.6MB
-
memory/2560-82-0x0000000001EA0000-0x0000000002F2E000-memory.dmpFilesize
16.6MB
-
memory/2560-29-0x0000000000400000-0x0000000000542000-memory.dmpFilesize
1.3MB
-
memory/2560-88-0x0000000001EA0000-0x0000000002F2E000-memory.dmpFilesize
16.6MB
-
memory/2560-89-0x0000000001EA0000-0x0000000002F2E000-memory.dmpFilesize
16.6MB
-
memory/2560-90-0x0000000001EA0000-0x0000000002F2E000-memory.dmpFilesize
16.6MB
-
memory/2560-92-0x0000000001EA0000-0x0000000002F2E000-memory.dmpFilesize
16.6MB
-
memory/2560-94-0x0000000001EA0000-0x0000000002F2E000-memory.dmpFilesize
16.6MB
-
memory/2560-112-0x0000000000400000-0x0000000000542000-memory.dmpFilesize
1.3MB
-
memory/2560-38-0x0000000001EA0000-0x0000000002F2E000-memory.dmpFilesize
16.6MB
-
memory/2560-39-0x0000000001EA0000-0x0000000002F2E000-memory.dmpFilesize
16.6MB
-
memory/2560-34-0x0000000001EA0000-0x0000000002F2E000-memory.dmpFilesize
16.6MB
-
memory/2560-31-0x0000000001EA0000-0x0000000002F2E000-memory.dmpFilesize
16.6MB
-
memory/2952-0-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/2952-16-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB