Analysis
-
max time kernel
141s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 23:14
Static task
static1
Behavioral task
behavioral1
Sample
654c3c819cba323e39c0b0559e00fdb8ebc1158afe4737f14c5f65b4a7308d7e.dll
Resource
win7-20240221-en
General
-
Target
654c3c819cba323e39c0b0559e00fdb8ebc1158afe4737f14c5f65b4a7308d7e.dll
-
Size
120KB
-
MD5
8cf2bfbe41a50952a72d453ff8e53285
-
SHA1
9bf3b00b470f0f77f7b9c14cc5f691cad9d79d4a
-
SHA256
654c3c819cba323e39c0b0559e00fdb8ebc1158afe4737f14c5f65b4a7308d7e
-
SHA512
f5e0ab3f64610abc7093bdf7eedd4ba6b766a4056ca068b376d86eb37261dfde7a47785d3d0fec23fc03a79fd7332d9c6bac466c954eb208643545f3f24e437a
-
SSDEEP
1536:HoUEnIGDTRjdb2c1LIq/gUltBkOkDx2nqEu8VquOnMfHiqfPs0GlYs2UpcmD:CIIjD/gUltoDxYqED4uOeXs08BN
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
e5742f4.exee577407.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e5742f4.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e5742f4.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e577407.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e577407.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e577407.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e5742f4.exe -
Processes:
e5742f4.exee577407.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5742f4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e577407.exe -
Processes:
e5742f4.exee577407.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5742f4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e577407.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e577407.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e577407.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e577407.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e577407.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5742f4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5742f4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5742f4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5742f4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5742f4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e577407.exe -
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 28 IoCs
Processes:
resource yara_rule behavioral2/memory/2004-6-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2004-11-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2004-10-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2004-13-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2004-28-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2004-35-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2004-33-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2004-12-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2004-27-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2004-9-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2004-8-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2004-37-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2004-36-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2004-38-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2004-40-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2004-39-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2004-46-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2004-55-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2004-56-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2004-58-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2004-60-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2004-61-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2004-62-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2004-64-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2004-69-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4032-95-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4032-104-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4032-146-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine -
UPX dump on OEP (original entry point) 33 IoCs
Processes:
resource yara_rule behavioral2/memory/2004-5-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/2004-6-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/2004-11-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/2004-10-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/2004-13-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/2004-28-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/2004-35-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/2004-33-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/1332-34-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/2004-12-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/2004-27-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/2004-9-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/2004-8-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/2004-37-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/2004-36-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/2004-38-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/2004-40-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/2004-39-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/2004-46-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/2004-55-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/2004-56-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/2004-58-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/2004-60-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/2004-61-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/2004-62-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/2004-64-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/2004-69-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/2004-86-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/1332-90-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4032-95-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/4032-104-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/4032-145-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4032-146-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX -
Executes dropped EXE 3 IoCs
Processes:
e5742f4.exee57444c.exee577407.exepid process 2004 e5742f4.exe 1332 e57444c.exe 4032 e577407.exe -
Processes:
resource yara_rule behavioral2/memory/2004-6-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/2004-11-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/2004-10-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/2004-13-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/2004-28-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/2004-35-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/2004-33-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/2004-12-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/2004-27-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/2004-9-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/2004-8-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/2004-37-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/2004-36-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/2004-38-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/2004-40-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/2004-39-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/2004-46-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/2004-55-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/2004-56-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/2004-58-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/2004-60-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/2004-61-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/2004-62-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/2004-64-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/2004-69-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4032-95-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/4032-104-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/4032-146-0x00000000007F0000-0x00000000018AA000-memory.dmp upx -
Processes:
e5742f4.exee577407.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e5742f4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e577407.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e577407.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e577407.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5742f4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e577407.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e577407.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e577407.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e577407.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5742f4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5742f4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5742f4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5742f4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5742f4.exe -
Processes:
e5742f4.exee577407.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5742f4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e577407.exe -
Enumerates connected drives 3 TTPs 13 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
e5742f4.exee577407.exedescription ioc process File opened (read-only) \??\H: e5742f4.exe File opened (read-only) \??\I: e5742f4.exe File opened (read-only) \??\L: e5742f4.exe File opened (read-only) \??\G: e5742f4.exe File opened (read-only) \??\J: e5742f4.exe File opened (read-only) \??\M: e5742f4.exe File opened (read-only) \??\I: e577407.exe File opened (read-only) \??\E: e5742f4.exe File opened (read-only) \??\H: e577407.exe File opened (read-only) \??\J: e577407.exe File opened (read-only) \??\G: e577407.exe File opened (read-only) \??\E: e577407.exe File opened (read-only) \??\K: e5742f4.exe -
Drops file in Windows directory 3 IoCs
Processes:
e577407.exee5742f4.exedescription ioc process File created C:\Windows\e579b55 e577407.exe File created C:\Windows\e574333 e5742f4.exe File opened for modification C:\Windows\SYSTEM.INI e5742f4.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
e5742f4.exee577407.exepid process 2004 e5742f4.exe 2004 e5742f4.exe 2004 e5742f4.exe 2004 e5742f4.exe 4032 e577407.exe 4032 e577407.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
e5742f4.exedescription pid process Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe Token: SeDebugPrivilege 2004 e5742f4.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
rundll32.exerundll32.exee5742f4.exee577407.exedescription pid process target process PID 1284 wrote to memory of 4304 1284 rundll32.exe rundll32.exe PID 1284 wrote to memory of 4304 1284 rundll32.exe rundll32.exe PID 1284 wrote to memory of 4304 1284 rundll32.exe rundll32.exe PID 4304 wrote to memory of 2004 4304 rundll32.exe e5742f4.exe PID 4304 wrote to memory of 2004 4304 rundll32.exe e5742f4.exe PID 4304 wrote to memory of 2004 4304 rundll32.exe e5742f4.exe PID 2004 wrote to memory of 776 2004 e5742f4.exe fontdrvhost.exe PID 2004 wrote to memory of 780 2004 e5742f4.exe fontdrvhost.exe PID 2004 wrote to memory of 64 2004 e5742f4.exe dwm.exe PID 2004 wrote to memory of 2552 2004 e5742f4.exe sihost.exe PID 2004 wrote to memory of 2560 2004 e5742f4.exe svchost.exe PID 2004 wrote to memory of 2672 2004 e5742f4.exe taskhostw.exe PID 2004 wrote to memory of 3528 2004 e5742f4.exe Explorer.EXE PID 2004 wrote to memory of 3636 2004 e5742f4.exe svchost.exe PID 2004 wrote to memory of 3824 2004 e5742f4.exe DllHost.exe PID 2004 wrote to memory of 3916 2004 e5742f4.exe StartMenuExperienceHost.exe PID 2004 wrote to memory of 3984 2004 e5742f4.exe RuntimeBroker.exe PID 2004 wrote to memory of 4068 2004 e5742f4.exe SearchApp.exe PID 2004 wrote to memory of 3768 2004 e5742f4.exe RuntimeBroker.exe PID 2004 wrote to memory of 2144 2004 e5742f4.exe RuntimeBroker.exe PID 2004 wrote to memory of 4744 2004 e5742f4.exe TextInputHost.exe PID 2004 wrote to memory of 2336 2004 e5742f4.exe backgroundTaskHost.exe PID 2004 wrote to memory of 3848 2004 e5742f4.exe backgroundTaskHost.exe PID 2004 wrote to memory of 1284 2004 e5742f4.exe rundll32.exe PID 2004 wrote to memory of 4304 2004 e5742f4.exe rundll32.exe PID 2004 wrote to memory of 4304 2004 e5742f4.exe rundll32.exe PID 4304 wrote to memory of 1332 4304 rundll32.exe e57444c.exe PID 4304 wrote to memory of 1332 4304 rundll32.exe e57444c.exe PID 4304 wrote to memory of 1332 4304 rundll32.exe e57444c.exe PID 2004 wrote to memory of 776 2004 e5742f4.exe fontdrvhost.exe PID 2004 wrote to memory of 780 2004 e5742f4.exe fontdrvhost.exe PID 2004 wrote to memory of 64 2004 e5742f4.exe dwm.exe PID 2004 wrote to memory of 2552 2004 e5742f4.exe sihost.exe PID 2004 wrote to memory of 2560 2004 e5742f4.exe svchost.exe PID 2004 wrote to memory of 2672 2004 e5742f4.exe taskhostw.exe PID 2004 wrote to memory of 3528 2004 e5742f4.exe Explorer.EXE PID 2004 wrote to memory of 3636 2004 e5742f4.exe svchost.exe PID 2004 wrote to memory of 3824 2004 e5742f4.exe DllHost.exe PID 2004 wrote to memory of 3916 2004 e5742f4.exe StartMenuExperienceHost.exe PID 2004 wrote to memory of 3984 2004 e5742f4.exe RuntimeBroker.exe PID 2004 wrote to memory of 4068 2004 e5742f4.exe SearchApp.exe PID 2004 wrote to memory of 3768 2004 e5742f4.exe RuntimeBroker.exe PID 2004 wrote to memory of 2144 2004 e5742f4.exe RuntimeBroker.exe PID 2004 wrote to memory of 4744 2004 e5742f4.exe TextInputHost.exe PID 2004 wrote to memory of 2336 2004 e5742f4.exe backgroundTaskHost.exe PID 2004 wrote to memory of 3848 2004 e5742f4.exe backgroundTaskHost.exe PID 2004 wrote to memory of 1284 2004 e5742f4.exe rundll32.exe PID 2004 wrote to memory of 1332 2004 e5742f4.exe e57444c.exe PID 2004 wrote to memory of 1332 2004 e5742f4.exe e57444c.exe PID 2004 wrote to memory of 3944 2004 e5742f4.exe BackgroundTaskHost.exe PID 2004 wrote to memory of 2488 2004 e5742f4.exe RuntimeBroker.exe PID 4304 wrote to memory of 4032 4304 rundll32.exe e577407.exe PID 4304 wrote to memory of 4032 4304 rundll32.exe e577407.exe PID 4304 wrote to memory of 4032 4304 rundll32.exe e577407.exe PID 4032 wrote to memory of 776 4032 e577407.exe fontdrvhost.exe PID 4032 wrote to memory of 780 4032 e577407.exe fontdrvhost.exe PID 4032 wrote to memory of 64 4032 e577407.exe dwm.exe PID 4032 wrote to memory of 2552 4032 e577407.exe sihost.exe PID 4032 wrote to memory of 2560 4032 e577407.exe svchost.exe PID 4032 wrote to memory of 2672 4032 e577407.exe taskhostw.exe PID 4032 wrote to memory of 3528 4032 e577407.exe Explorer.EXE PID 4032 wrote to memory of 3636 4032 e577407.exe svchost.exe PID 4032 wrote to memory of 3824 4032 e577407.exe DllHost.exe PID 4032 wrote to memory of 3916 4032 e577407.exe StartMenuExperienceHost.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
e5742f4.exee577407.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5742f4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e577407.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\654c3c819cba323e39c0b0559e00fdb8ebc1158afe4737f14c5f65b4a7308d7e.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\654c3c819cba323e39c0b0559e00fdb8ebc1158afe4737f14c5f65b4a7308d7e.dll,#13⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e5742f4.exeC:\Users\Admin\AppData\Local\Temp\e5742f4.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\e57444c.exeC:\Users\Admin\AppData\Local\Temp\e57444c.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\e577407.exeC:\Users\Admin\AppData\Local\Temp\e577407.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\system32\BackgroundTaskHost.exe"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\e5742f4.exeFilesize
97KB
MD51ec93b7e1a4936b8e2480d5a35b4630e
SHA1c0969fdf1d5652b4792ad47067907f9f2a4adc4c
SHA256d16566006304ffdcd0f37ad0c7816dc8b850e4e507801daa22006ada533db2d1
SHA512d7ce61490b4a85c011a01e231cb75daf260967c18d0d1c9fc024e6db0b9bbb3bc206ffaaf4c33b26ae66e92d6c30f4821f04cb7bbec824c3745e211439be2409
-
C:\Windows\SYSTEM.INIFilesize
257B
MD57533ad0edcda56ecb3dc3876c514ed12
SHA1558d837769fb9610d31696e939bd8d29b589acb8
SHA256a7bd6d43368ae74e0f9d5366591b49f7d78119ff3a152777fc0f003fc5e31d0a
SHA512d363a9966822ba4a2bc3cbdf6d87ecad9f14f36a5c9869562f8ca792ec78b1e8ba20840b3b6b048eadb1f6c40c41a504247047b1bc6e450215dad3135dee6a16
-
memory/1332-34-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1332-87-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/1332-90-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1332-44-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/1332-45-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/1332-43-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/2004-40-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/2004-64-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/2004-35-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/2004-12-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/2004-27-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/2004-26-0x0000000001A30000-0x0000000001A32000-memory.dmpFilesize
8KB
-
memory/2004-30-0x0000000001A30000-0x0000000001A32000-memory.dmpFilesize
8KB
-
memory/2004-5-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2004-6-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/2004-86-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2004-17-0x0000000001A40000-0x0000000001A41000-memory.dmpFilesize
4KB
-
memory/2004-69-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/2004-9-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/2004-8-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/2004-37-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/2004-36-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/2004-38-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/2004-28-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/2004-39-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/2004-13-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/2004-10-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/2004-11-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/2004-46-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/2004-76-0x0000000001A30000-0x0000000001A32000-memory.dmpFilesize
8KB
-
memory/2004-33-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/2004-55-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/2004-56-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/2004-58-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/2004-60-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/2004-61-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/2004-62-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/4032-95-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/4032-146-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/4032-145-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4032-51-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4032-104-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/4032-111-0x0000000001BF0000-0x0000000001BF2000-memory.dmpFilesize
8KB
-
memory/4032-112-0x0000000004370000-0x0000000004371000-memory.dmpFilesize
4KB
-
memory/4304-25-0x0000000000D90000-0x0000000000D92000-memory.dmpFilesize
8KB
-
memory/4304-2-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/4304-29-0x0000000000D90000-0x0000000000D92000-memory.dmpFilesize
8KB
-
memory/4304-14-0x0000000000D90000-0x0000000000D92000-memory.dmpFilesize
8KB
-
memory/4304-15-0x0000000000DE0000-0x0000000000DE1000-memory.dmpFilesize
4KB
-
memory/4304-52-0x0000000000D90000-0x0000000000D92000-memory.dmpFilesize
8KB