Analysis
-
max time kernel
33s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 18:18
Static task
static1
Behavioral task
behavioral1
Sample
18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe
Resource
win7-20240508-en
General
-
Target
18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe
-
Size
1.5MB
-
MD5
0aeca481aacf87ee7d2136705455edd2
-
SHA1
11e10c7b59bb5bec242c37896c8f4373c009c552
-
SHA256
18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d
-
SHA512
621ca61abdc9f5e5bb8efe80081b2f4c8a6febbeec96406d1e1d14d71ef0824de149bf7599800f61e5ecf4d20722b2a85bd67a2c725bff76f45d2e9495919bca
-
SSDEEP
24576:nLFZeV9rUW3uRIgRNMK88q9s14+6fsqetItnwn56fTaINc9q:LFgVIRIgRNMR8qq1bSsqEw/eEB
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe -
Processes:
18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe -
Processes:
18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe -
Processes:
resource yara_rule behavioral1/memory/1596-2-0x0000000002050000-0x00000000030DE000-memory.dmp upx behavioral1/memory/1596-6-0x0000000002050000-0x00000000030DE000-memory.dmp upx behavioral1/memory/1596-4-0x0000000002050000-0x00000000030DE000-memory.dmp upx behavioral1/memory/1596-9-0x0000000002050000-0x00000000030DE000-memory.dmp upx behavioral1/memory/1596-5-0x0000000002050000-0x00000000030DE000-memory.dmp upx behavioral1/memory/1596-8-0x0000000002050000-0x00000000030DE000-memory.dmp upx behavioral1/memory/1596-10-0x0000000002050000-0x00000000030DE000-memory.dmp upx behavioral1/memory/1596-23-0x0000000002050000-0x00000000030DE000-memory.dmp upx behavioral1/memory/1596-7-0x0000000002050000-0x00000000030DE000-memory.dmp upx behavioral1/memory/1596-29-0x0000000002050000-0x00000000030DE000-memory.dmp upx behavioral1/memory/1596-30-0x0000000002050000-0x00000000030DE000-memory.dmp upx behavioral1/memory/1596-31-0x0000000002050000-0x00000000030DE000-memory.dmp upx behavioral1/memory/1596-32-0x0000000002050000-0x00000000030DE000-memory.dmp upx behavioral1/memory/1596-33-0x0000000002050000-0x00000000030DE000-memory.dmp upx behavioral1/memory/1596-35-0x0000000002050000-0x00000000030DE000-memory.dmp upx behavioral1/memory/1596-36-0x0000000002050000-0x00000000030DE000-memory.dmp upx behavioral1/memory/1596-37-0x0000000002050000-0x00000000030DE000-memory.dmp upx behavioral1/memory/1596-39-0x0000000002050000-0x00000000030DE000-memory.dmp upx behavioral1/memory/1596-53-0x0000000002050000-0x00000000030DE000-memory.dmp upx behavioral1/memory/1596-55-0x0000000002050000-0x00000000030DE000-memory.dmp upx behavioral1/memory/1596-56-0x0000000002050000-0x00000000030DE000-memory.dmp upx behavioral1/memory/1596-59-0x0000000002050000-0x00000000030DE000-memory.dmp upx behavioral1/memory/1596-60-0x0000000002050000-0x00000000030DE000-memory.dmp upx behavioral1/memory/1596-82-0x0000000002050000-0x00000000030DE000-memory.dmp upx behavioral1/memory/2728-98-0x0000000002A70000-0x0000000003AFE000-memory.dmp upx behavioral1/memory/2728-165-0x0000000002A70000-0x0000000003AFE000-memory.dmp upx -
Processes:
18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe -
Processes:
18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe -
Enumerates connected drives 3 TTPs 16 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exedescription ioc process File opened (read-only) \??\N: 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe File opened (read-only) \??\J: 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe File opened (read-only) \??\H: 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe File opened (read-only) \??\K: 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe File opened (read-only) \??\G: 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe File opened (read-only) \??\H: 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe File opened (read-only) \??\I: 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe File opened (read-only) \??\E: 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe File opened (read-only) \??\L: 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe File opened (read-only) \??\L: 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe File opened (read-only) \??\G: 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe File opened (read-only) \??\K: 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe File opened (read-only) \??\M: 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe File opened (read-only) \??\E: 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe File opened (read-only) \??\I: 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe File opened (read-only) \??\J: 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe -
Drops file in Windows directory 1 IoCs
Processes:
18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exepid process 1596 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe 1596 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe 2728 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe 2728 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
Processes:
18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exedescription pid process Token: SeIncreaseQuotaPrivilege 1596 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Token: SeDebugPrivilege 1596 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Token: SeDebugPrivilege 1596 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Token: SeDebugPrivilege 1596 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Token: SeDebugPrivilege 1596 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Token: SeDebugPrivilege 1596 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Token: SeDebugPrivilege 1596 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Token: SeDebugPrivilege 1596 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Token: SeDebugPrivilege 1596 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Token: SeDebugPrivilege 1596 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Token: SeDebugPrivilege 1596 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Token: SeDebugPrivilege 1596 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Token: SeDebugPrivilege 1596 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Token: SeDebugPrivilege 1596 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Token: SeDebugPrivilege 1596 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Token: SeDebugPrivilege 1596 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Token: SeDebugPrivilege 1596 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Token: SeDebugPrivilege 1596 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Token: SeDebugPrivilege 1596 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Token: SeDebugPrivilege 1596 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Token: SeDebugPrivilege 1596 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Token: SeDebugPrivilege 1596 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Token: SeDebugPrivilege 2728 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Token: SeDebugPrivilege 2728 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Token: SeDebugPrivilege 2728 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Token: SeDebugPrivilege 2728 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Token: SeDebugPrivilege 2728 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Token: SeDebugPrivilege 2728 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Token: SeDebugPrivilege 2728 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Token: SeDebugPrivilege 2728 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Token: SeDebugPrivilege 2728 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Token: SeDebugPrivilege 2728 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Token: SeDebugPrivilege 2728 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Token: SeDebugPrivilege 2728 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Token: SeDebugPrivilege 2728 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Token: SeDebugPrivilege 2728 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Token: SeDebugPrivilege 2728 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Token: SeDebugPrivilege 2728 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Token: SeDebugPrivilege 2728 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Token: SeDebugPrivilege 2728 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Token: SeDebugPrivilege 2728 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Token: SeDebugPrivilege 2728 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Token: SeDebugPrivilege 2728 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exedescription pid process target process PID 1596 wrote to memory of 1108 1596 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe taskhost.exe PID 1596 wrote to memory of 1172 1596 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Dwm.exe PID 1596 wrote to memory of 1204 1596 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Explorer.EXE PID 1596 wrote to memory of 1848 1596 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe DllHost.exe PID 1596 wrote to memory of 2728 1596 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe PID 1596 wrote to memory of 2728 1596 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe PID 1596 wrote to memory of 2728 1596 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe PID 1596 wrote to memory of 2728 1596 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe PID 1596 wrote to memory of 1108 1596 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe taskhost.exe PID 1596 wrote to memory of 1172 1596 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Dwm.exe PID 1596 wrote to memory of 1204 1596 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Explorer.EXE PID 1596 wrote to memory of 2728 1596 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe PID 1596 wrote to memory of 2728 1596 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe PID 2728 wrote to memory of 1108 2728 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe taskhost.exe PID 2728 wrote to memory of 1172 2728 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Dwm.exe PID 2728 wrote to memory of 1204 2728 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Explorer.EXE PID 2728 wrote to memory of 1108 2728 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe taskhost.exe PID 2728 wrote to memory of 1172 2728 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Dwm.exe PID 2728 wrote to memory of 1204 2728 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Explorer.EXE -
System policy modification 1 TTPs 2 IoCs
Processes:
18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe"C:\Users\Admin\AppData\Local\Temp\18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe"C:\Users\Admin\AppData\Local\Temp\18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d.exe" --ws3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SYSTEM.INIFilesize
257B
MD5ab2f2838fa68bcf329dca7897929eea6
SHA1523584399b40a2719e5f24968b939ed33f07c70a
SHA2562f2008856bdb30443f468cc63dc39c83e91f8957631fcc30b9a6590e07540cad
SHA512b3782b8e0b6b56560414496cd75c777621c948223848955a78744acfe21c2e6dbf303ca69f6bfc2c81664246f6de96e1728b597d3aa60384dd5c51a70a7d1aa3
-
memory/1108-11-0x00000000001D0000-0x00000000001D2000-memory.dmpFilesize
8KB
-
memory/1596-30-0x0000000002050000-0x00000000030DE000-memory.dmpFilesize
16.6MB
-
memory/1596-25-0x00000000003D0000-0x00000000003D2000-memory.dmpFilesize
8KB
-
memory/1596-24-0x00000000003D0000-0x00000000003D2000-memory.dmpFilesize
8KB
-
memory/1596-32-0x0000000002050000-0x00000000030DE000-memory.dmpFilesize
16.6MB
-
memory/1596-5-0x0000000002050000-0x00000000030DE000-memory.dmpFilesize
16.6MB
-
memory/1596-35-0x0000000002050000-0x00000000030DE000-memory.dmpFilesize
16.6MB
-
memory/1596-10-0x0000000002050000-0x00000000030DE000-memory.dmpFilesize
16.6MB
-
memory/1596-33-0x0000000002050000-0x00000000030DE000-memory.dmpFilesize
16.6MB
-
memory/1596-23-0x0000000002050000-0x00000000030DE000-memory.dmpFilesize
16.6MB
-
memory/1596-22-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/1596-20-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/1596-19-0x00000000003D0000-0x00000000003D2000-memory.dmpFilesize
8KB
-
memory/1596-6-0x0000000002050000-0x00000000030DE000-memory.dmpFilesize
16.6MB
-
memory/1596-7-0x0000000002050000-0x00000000030DE000-memory.dmpFilesize
16.6MB
-
memory/1596-26-0x0000000004610000-0x0000000004620000-memory.dmpFilesize
64KB
-
memory/1596-2-0x0000000002050000-0x00000000030DE000-memory.dmpFilesize
16.6MB
-
memory/1596-27-0x0000000004FD0000-0x000000000516F000-memory.dmpFilesize
1.6MB
-
memory/1596-29-0x0000000002050000-0x00000000030DE000-memory.dmpFilesize
16.6MB
-
memory/1596-0-0x0000000000400000-0x000000000059F000-memory.dmpFilesize
1.6MB
-
memory/1596-31-0x0000000002050000-0x00000000030DE000-memory.dmpFilesize
16.6MB
-
memory/1596-9-0x0000000002050000-0x00000000030DE000-memory.dmpFilesize
16.6MB
-
memory/1596-4-0x0000000002050000-0x00000000030DE000-memory.dmpFilesize
16.6MB
-
memory/1596-8-0x0000000002050000-0x00000000030DE000-memory.dmpFilesize
16.6MB
-
memory/1596-36-0x0000000002050000-0x00000000030DE000-memory.dmpFilesize
16.6MB
-
memory/1596-37-0x0000000002050000-0x00000000030DE000-memory.dmpFilesize
16.6MB
-
memory/1596-39-0x0000000002050000-0x00000000030DE000-memory.dmpFilesize
16.6MB
-
memory/1596-82-0x0000000002050000-0x00000000030DE000-memory.dmpFilesize
16.6MB
-
memory/1596-81-0x0000000000400000-0x000000000059F000-memory.dmpFilesize
1.6MB
-
memory/1596-61-0x00000000003D0000-0x00000000003D2000-memory.dmpFilesize
8KB
-
memory/1596-53-0x0000000002050000-0x00000000030DE000-memory.dmpFilesize
16.6MB
-
memory/1596-55-0x0000000002050000-0x00000000030DE000-memory.dmpFilesize
16.6MB
-
memory/1596-56-0x0000000002050000-0x00000000030DE000-memory.dmpFilesize
16.6MB
-
memory/1596-59-0x0000000002050000-0x00000000030DE000-memory.dmpFilesize
16.6MB
-
memory/1596-60-0x0000000002050000-0x00000000030DE000-memory.dmpFilesize
16.6MB
-
memory/2728-50-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/2728-51-0x0000000000390000-0x0000000000392000-memory.dmpFilesize
8KB
-
memory/2728-52-0x0000000000390000-0x0000000000392000-memory.dmpFilesize
8KB
-
memory/2728-28-0x0000000000400000-0x000000000059F000-memory.dmpFilesize
1.6MB
-
memory/2728-98-0x0000000002A70000-0x0000000003AFE000-memory.dmpFilesize
16.6MB
-
memory/2728-129-0x0000000000390000-0x0000000000392000-memory.dmpFilesize
8KB
-
memory/2728-165-0x0000000002A70000-0x0000000003AFE000-memory.dmpFilesize
16.6MB