Malware Analysis Report

2024-11-16 13:20

Sample ID 240519-w2l9tabd38
Target 65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b
SHA256 65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b
Tags
sality backdoor evasion trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b

Threat Level: Known bad

The file 65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b was found to be: Known bad.

Malicious Activity Summary

sality backdoor evasion trojan upx

Sality

Windows security bypass

Modifies firewall policy service

UAC bypass

Checks computer location settings

UPX packed file

Windows security modification

Deletes itself

Checks whether UAC is enabled

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Runs net.exe

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

System policy modification

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-19 18:25

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-19 18:25

Reported

2024-05-19 18:27

Platform

win7-20231129-en

Max time kernel

122s

Max time network

124s

Command Line

"taskhost.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A

Enumerates physical storage devices

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3040 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe C:\Windows\system32\taskhost.exe
PID 3040 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe C:\Windows\system32\Dwm.exe
PID 3040 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe C:\Windows\Explorer.EXE
PID 3040 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe C:\Windows\system32\DllHost.exe
PID 3040 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe C:\Windows\SysWOW64\net.exe
PID 3040 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe C:\Windows\SysWOW64\net.exe
PID 3040 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe C:\Windows\SysWOW64\net.exe
PID 3040 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe C:\Windows\SysWOW64\net.exe
PID 2764 wrote to memory of 2624 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2764 wrote to memory of 2624 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2764 wrote to memory of 2624 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2764 wrote to memory of 2624 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 3040 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe C:\Windows\SysWOW64\cmd.exe
PID 3040 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe C:\Windows\SysWOW64\cmd.exe
PID 3040 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe C:\Windows\SysWOW64\cmd.exe
PID 3040 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe C:\Windows\SysWOW64\cmd.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A

Processes

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe

"C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe"

C:\Windows\SysWOW64\net.exe

net stop "Kingsoft AntiVirus Service"

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"

C:\Windows\SysWOW64\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$$a1F53.bat

Network

N/A

Files

memory/3040-0-0x0000000000400000-0x0000000000452000-memory.dmp

memory/3040-2-0x0000000000660000-0x00000000016EE000-memory.dmp

memory/3040-8-0x0000000000660000-0x00000000016EE000-memory.dmp

memory/3040-7-0x0000000000660000-0x00000000016EE000-memory.dmp

memory/3040-22-0x0000000004DD0000-0x0000000004DD2000-memory.dmp

memory/3040-10-0x0000000000660000-0x00000000016EE000-memory.dmp

memory/3040-21-0x0000000004F20000-0x0000000004F21000-memory.dmp

memory/3040-19-0x0000000004F20000-0x0000000004F21000-memory.dmp

memory/3040-18-0x0000000004DD0000-0x0000000004DD2000-memory.dmp

memory/1260-12-0x0000000000320000-0x0000000000322000-memory.dmp

memory/3040-11-0x0000000000660000-0x00000000016EE000-memory.dmp

memory/3040-23-0x0000000004DD0000-0x0000000004DD2000-memory.dmp

memory/3040-9-0x0000000000660000-0x00000000016EE000-memory.dmp

memory/3040-5-0x0000000000660000-0x00000000016EE000-memory.dmp

memory/3040-4-0x0000000000660000-0x00000000016EE000-memory.dmp

memory/3040-6-0x0000000000660000-0x00000000016EE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\$$a1F53.bat

MD5 5a7f215f6aca6f6f700bed6a34bbfaff
SHA1 f5ec93b9f2002195b7896155408e7753a14ec393
SHA256 112ddb4c9c2c6772a73ed32963205e93470fe6044ef33633f9dc7df237159087
SHA512 5b954c1700032e56518715a3b9429a98f0805914f2def33e6bbbfc0ea43570b3c0274f056aba2b6a89814b4ae06efaf329bef6ea7d3901e35dfaea8bb186c071

memory/3040-25-0x0000000000660000-0x00000000016EE000-memory.dmp

memory/3040-51-0x0000000000400000-0x0000000000452000-memory.dmp

memory/3040-52-0x0000000000660000-0x00000000016EE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe.exe

MD5 84298b523c40c35f30d499df04cfc798
SHA1 ecbdda36bdb8919bc75d0eb3c88696103ba50b7e
SHA256 f9e320949ff09d846e8a3fad7ba0777ac3298a09cf1079257d2dc1a30c190d5a
SHA512 93048958c2c114f02aaee2eb969e8916ae27f886d821906323f124a618ec5eef3394687a4679152aba43a4fe47ae38d35189dd35d57c6d232ac9d926a1ed07de

memory/3040-24-0x0000000000660000-0x00000000016EE000-memory.dmp

memory/2440-86-0x00000000024D0000-0x00000000024D1000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-19 18:25

Reported

2024-05-19 18:27

Platform

win10v2004-20240508-en

Max time kernel

111s

Max time network

120s

Command Line

"fontdrvhost.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\cmd.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A

Enumerates physical storage devices

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2196 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe C:\Windows\system32\fontdrvhost.exe
PID 2196 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe C:\Windows\system32\fontdrvhost.exe
PID 2196 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe C:\Windows\system32\dwm.exe
PID 2196 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe C:\Windows\system32\sihost.exe
PID 2196 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe C:\Windows\system32\svchost.exe
PID 2196 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe C:\Windows\system32\taskhostw.exe
PID 2196 wrote to memory of 3500 N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe C:\Windows\Explorer.EXE
PID 2196 wrote to memory of 3628 N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe C:\Windows\system32\svchost.exe
PID 2196 wrote to memory of 3828 N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe C:\Windows\system32\DllHost.exe
PID 2196 wrote to memory of 3928 N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 2196 wrote to memory of 3992 N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe C:\Windows\System32\RuntimeBroker.exe
PID 2196 wrote to memory of 4072 N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 2196 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe C:\Windows\System32\RuntimeBroker.exe
PID 2196 wrote to memory of 4608 N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe C:\Windows\System32\RuntimeBroker.exe
PID 2196 wrote to memory of 3744 N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 2196 wrote to memory of 3864 N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe C:\Windows\system32\backgroundTaskHost.exe
PID 2196 wrote to memory of 3600 N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe C:\Windows\system32\backgroundTaskHost.exe
PID 2196 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe C:\Windows\SysWOW64\net.exe
PID 2196 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe C:\Windows\SysWOW64\net.exe
PID 2196 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe C:\Windows\SysWOW64\net.exe
PID 1792 wrote to memory of 3120 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1792 wrote to memory of 3120 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1792 wrote to memory of 3120 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2196 wrote to memory of 3724 N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe C:\Windows\SysWOW64\cmd.exe
PID 2196 wrote to memory of 3724 N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe C:\Windows\SysWOW64\cmd.exe
PID 2196 wrote to memory of 3724 N/A C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe C:\Windows\SysWOW64\cmd.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe N/A

Processes

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca

C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe

"C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe"

C:\Windows\SysWOW64\net.exe

net stop "Kingsoft AntiVirus Service"

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E4F.bat

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
NL 23.62.61.129:443 www.bing.com tcp
US 8.8.8.8:53 129.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

memory/2196-0-0x0000000000400000-0x0000000000452000-memory.dmp

memory/2196-3-0x00000000007F0000-0x000000000187E000-memory.dmp

memory/2196-5-0x00000000007F0000-0x000000000187E000-memory.dmp

memory/2196-4-0x00000000007F0000-0x000000000187E000-memory.dmp

memory/2196-10-0x0000000001B10000-0x0000000001B12000-memory.dmp

memory/2196-9-0x00000000007F0000-0x000000000187E000-memory.dmp

memory/2196-8-0x00000000007F0000-0x000000000187E000-memory.dmp

memory/2196-12-0x00000000007F0000-0x000000000187E000-memory.dmp

memory/2196-7-0x0000000001B20000-0x0000000001B21000-memory.dmp

memory/2196-6-0x0000000001B10000-0x0000000001B12000-memory.dmp

memory/2196-11-0x00000000007F0000-0x000000000187E000-memory.dmp

memory/2196-14-0x0000000001B10000-0x0000000001B12000-memory.dmp

memory/2196-13-0x00000000007F0000-0x000000000187E000-memory.dmp

memory/2196-15-0x00000000007F0000-0x000000000187E000-memory.dmp

memory/2196-1-0x00000000007F0000-0x000000000187E000-memory.dmp

memory/2196-19-0x00000000007F0000-0x000000000187E000-memory.dmp

memory/2196-38-0x0000000000400000-0x0000000000452000-memory.dmp

memory/2196-18-0x00000000007F0000-0x000000000187E000-memory.dmp

memory/2196-39-0x00000000007F0000-0x000000000187E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\65e3a97c046623647d98f23b9439809bd816d95087b5d04145608d1e26324a4b.exe.exe

MD5 84298b523c40c35f30d499df04cfc798
SHA1 ecbdda36bdb8919bc75d0eb3c88696103ba50b7e
SHA256 f9e320949ff09d846e8a3fad7ba0777ac3298a09cf1079257d2dc1a30c190d5a
SHA512 93048958c2c114f02aaee2eb969e8916ae27f886d821906323f124a618ec5eef3394687a4679152aba43a4fe47ae38d35189dd35d57c6d232ac9d926a1ed07de

C:\Users\Admin\AppData\Local\Temp\$$a4E4F.bat

MD5 e638f805b24be35a0e6b1650442c24ed
SHA1 c8d380c7a09c893eeb1a3ec309b91027bd57e28a
SHA256 c2bdfa2cbf17474183c99166e6c17d9c5e3c54a4e0b5dc4f5e9e84290e517fc1
SHA512 5a7b0b35a49c116a4c0600ccc031a404d773819769e33aeddd6a9fd7028006064c6c0e459f88349c848237ddc13337c1cb24cdc88396ce3894bef1641eb9b5e8