Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 04:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d43c86d213f307f16cb5e4afbaa1e07a9be28b9ed9928c2b138451d8fbb633b2.dll
Resource
win7-20240215-en
windows7-x64
17 signatures
150 seconds
General
-
Target
d43c86d213f307f16cb5e4afbaa1e07a9be28b9ed9928c2b138451d8fbb633b2.dll
-
Size
120KB
-
MD5
ffe35c6d119e92cd68c23822c9946719
-
SHA1
af96c01b71939b730098ad56f1d577ec7cead147
-
SHA256
d43c86d213f307f16cb5e4afbaa1e07a9be28b9ed9928c2b138451d8fbb633b2
-
SHA512
b51be176bda92f54000680b162352f5e98015012c93b97aa8d575ecb6081eea0ed25a04ffd7af18dbf7e899755f586f55f4da6fc9e1a71a81c21184f96a5890f
-
SSDEEP
1536:zAjzcxM7bx9s2CBO/hLQkd4rI3o2qtxXEs0jWs8YC+NSE8jsgcjr57dVYg:zk57bx22CBOVQYEITGCwYpSE8jqjr9d
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f75fe2d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f75fe2d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f75fe2d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f7619a8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f7619a8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f7619a8.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f75fe2d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7619a8.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f75fe2d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f75fe2d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7619a8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f75fe2d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7619a8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7619a8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7619a8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7619a8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f75fe2d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f75fe2d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f75fe2d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7619a8.exe -
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 25 IoCs
resource yara_rule behavioral1/memory/2600-13-0x0000000000690000-0x000000000174A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2600-19-0x0000000000690000-0x000000000174A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2600-15-0x0000000000690000-0x000000000174A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2600-20-0x0000000000690000-0x000000000174A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2600-16-0x0000000000690000-0x000000000174A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2600-22-0x0000000000690000-0x000000000174A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2600-18-0x0000000000690000-0x000000000174A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2600-21-0x0000000000690000-0x000000000174A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2600-17-0x0000000000690000-0x000000000174A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2600-23-0x0000000000690000-0x000000000174A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2600-61-0x0000000000690000-0x000000000174A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2600-60-0x0000000000690000-0x000000000174A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2600-62-0x0000000000690000-0x000000000174A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2600-64-0x0000000000690000-0x000000000174A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2600-63-0x0000000000690000-0x000000000174A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2600-66-0x0000000000690000-0x000000000174A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2600-67-0x0000000000690000-0x000000000174A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2600-82-0x0000000000690000-0x000000000174A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2600-83-0x0000000000690000-0x000000000174A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2600-85-0x0000000000690000-0x000000000174A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2600-103-0x0000000000690000-0x000000000174A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2600-87-0x0000000000690000-0x000000000174A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2600-152-0x0000000000690000-0x000000000174A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1048-169-0x0000000000940000-0x00000000019FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1048-208-0x0000000000940000-0x00000000019FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine -
UPX dump on OEP (original entry point) 29 IoCs
resource yara_rule behavioral1/memory/2600-13-0x0000000000690000-0x000000000174A000-memory.dmp UPX behavioral1/memory/2600-19-0x0000000000690000-0x000000000174A000-memory.dmp UPX behavioral1/memory/2600-15-0x0000000000690000-0x000000000174A000-memory.dmp UPX behavioral1/memory/2600-20-0x0000000000690000-0x000000000174A000-memory.dmp UPX behavioral1/memory/2600-16-0x0000000000690000-0x000000000174A000-memory.dmp UPX behavioral1/memory/2600-22-0x0000000000690000-0x000000000174A000-memory.dmp UPX behavioral1/memory/2600-18-0x0000000000690000-0x000000000174A000-memory.dmp UPX behavioral1/memory/2600-21-0x0000000000690000-0x000000000174A000-memory.dmp UPX behavioral1/memory/2600-17-0x0000000000690000-0x000000000174A000-memory.dmp UPX behavioral1/memory/2420-59-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/2600-23-0x0000000000690000-0x000000000174A000-memory.dmp UPX behavioral1/memory/2600-61-0x0000000000690000-0x000000000174A000-memory.dmp UPX behavioral1/memory/2600-60-0x0000000000690000-0x000000000174A000-memory.dmp UPX behavioral1/memory/2600-62-0x0000000000690000-0x000000000174A000-memory.dmp UPX behavioral1/memory/2600-64-0x0000000000690000-0x000000000174A000-memory.dmp UPX behavioral1/memory/2600-63-0x0000000000690000-0x000000000174A000-memory.dmp UPX behavioral1/memory/2600-66-0x0000000000690000-0x000000000174A000-memory.dmp UPX behavioral1/memory/2600-67-0x0000000000690000-0x000000000174A000-memory.dmp UPX behavioral1/memory/2600-82-0x0000000000690000-0x000000000174A000-memory.dmp UPX behavioral1/memory/2600-83-0x0000000000690000-0x000000000174A000-memory.dmp UPX behavioral1/memory/2600-85-0x0000000000690000-0x000000000174A000-memory.dmp UPX behavioral1/memory/2600-103-0x0000000000690000-0x000000000174A000-memory.dmp UPX behavioral1/memory/2600-87-0x0000000000690000-0x000000000174A000-memory.dmp UPX behavioral1/memory/2600-153-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/2420-157-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/2600-152-0x0000000000690000-0x000000000174A000-memory.dmp UPX behavioral1/memory/1048-169-0x0000000000940000-0x00000000019FA000-memory.dmp UPX behavioral1/memory/1048-207-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/1048-208-0x0000000000940000-0x00000000019FA000-memory.dmp UPX -
Executes dropped EXE 3 IoCs
pid Process 2600 f75fe2d.exe 2420 f760001.exe 1048 f7619a8.exe -
Loads dropped DLL 6 IoCs
pid Process 1636 rundll32.exe 1636 rundll32.exe 1636 rundll32.exe 1636 rundll32.exe 1636 rundll32.exe 1636 rundll32.exe -
resource yara_rule behavioral1/memory/2600-13-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2600-19-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2600-15-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2600-20-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2600-16-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2600-22-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2600-18-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2600-21-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2600-17-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2600-23-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2600-61-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2600-60-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2600-62-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2600-64-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2600-63-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2600-66-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2600-67-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2600-82-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2600-83-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2600-85-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2600-103-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2600-87-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2600-152-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/1048-169-0x0000000000940000-0x00000000019FA000-memory.dmp upx behavioral1/memory/1048-208-0x0000000000940000-0x00000000019FA000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f75fe2d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f75fe2d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f75fe2d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7619a8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7619a8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7619a8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f75fe2d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7619a8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f7619a8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f75fe2d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f75fe2d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f75fe2d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7619a8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7619a8.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7619a8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f75fe2d.exe -
Enumerates connected drives 3 TTPs 17 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: f75fe2d.exe File opened (read-only) \??\T: f75fe2d.exe File opened (read-only) \??\E: f75fe2d.exe File opened (read-only) \??\I: f75fe2d.exe File opened (read-only) \??\O: f75fe2d.exe File opened (read-only) \??\P: f75fe2d.exe File opened (read-only) \??\R: f75fe2d.exe File opened (read-only) \??\S: f75fe2d.exe File opened (read-only) \??\G: f7619a8.exe File opened (read-only) \??\G: f75fe2d.exe File opened (read-only) \??\K: f75fe2d.exe File opened (read-only) \??\Q: f75fe2d.exe File opened (read-only) \??\E: f7619a8.exe File opened (read-only) \??\J: f75fe2d.exe File opened (read-only) \??\L: f75fe2d.exe File opened (read-only) \??\H: f75fe2d.exe File opened (read-only) \??\N: f75fe2d.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f75fe8a f75fe2d.exe File opened for modification C:\Windows\SYSTEM.INI f75fe2d.exe File created C:\Windows\f764f1a f7619a8.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2600 f75fe2d.exe 2600 f75fe2d.exe 1048 f7619a8.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 2600 f75fe2d.exe Token: SeDebugPrivilege 2600 f75fe2d.exe Token: SeDebugPrivilege 2600 f75fe2d.exe Token: SeDebugPrivilege 2600 f75fe2d.exe Token: SeDebugPrivilege 2600 f75fe2d.exe Token: SeDebugPrivilege 2600 f75fe2d.exe Token: SeDebugPrivilege 2600 f75fe2d.exe Token: SeDebugPrivilege 2600 f75fe2d.exe Token: SeDebugPrivilege 2600 f75fe2d.exe Token: SeDebugPrivilege 2600 f75fe2d.exe Token: SeDebugPrivilege 2600 f75fe2d.exe Token: SeDebugPrivilege 2600 f75fe2d.exe Token: SeDebugPrivilege 2600 f75fe2d.exe Token: SeDebugPrivilege 2600 f75fe2d.exe Token: SeDebugPrivilege 2600 f75fe2d.exe Token: SeDebugPrivilege 2600 f75fe2d.exe Token: SeDebugPrivilege 2600 f75fe2d.exe Token: SeDebugPrivilege 2600 f75fe2d.exe Token: SeDebugPrivilege 2600 f75fe2d.exe Token: SeDebugPrivilege 2600 f75fe2d.exe Token: SeDebugPrivilege 2600 f75fe2d.exe Token: SeDebugPrivilege 1048 f7619a8.exe Token: SeDebugPrivilege 1048 f7619a8.exe Token: SeDebugPrivilege 1048 f7619a8.exe Token: SeDebugPrivilege 1048 f7619a8.exe Token: SeDebugPrivilege 1048 f7619a8.exe Token: SeDebugPrivilege 1048 f7619a8.exe Token: SeDebugPrivilege 1048 f7619a8.exe Token: SeDebugPrivilege 1048 f7619a8.exe Token: SeDebugPrivilege 1048 f7619a8.exe Token: SeDebugPrivilege 1048 f7619a8.exe Token: SeDebugPrivilege 1048 f7619a8.exe Token: SeDebugPrivilege 1048 f7619a8.exe Token: SeDebugPrivilege 1048 f7619a8.exe Token: SeDebugPrivilege 1048 f7619a8.exe Token: SeDebugPrivilege 1048 f7619a8.exe Token: SeDebugPrivilege 1048 f7619a8.exe Token: SeDebugPrivilege 1048 f7619a8.exe Token: SeDebugPrivilege 1048 f7619a8.exe Token: SeDebugPrivilege 1048 f7619a8.exe Token: SeDebugPrivilege 1048 f7619a8.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 1680 wrote to memory of 1636 1680 rundll32.exe 28 PID 1680 wrote to memory of 1636 1680 rundll32.exe 28 PID 1680 wrote to memory of 1636 1680 rundll32.exe 28 PID 1680 wrote to memory of 1636 1680 rundll32.exe 28 PID 1680 wrote to memory of 1636 1680 rundll32.exe 28 PID 1680 wrote to memory of 1636 1680 rundll32.exe 28 PID 1680 wrote to memory of 1636 1680 rundll32.exe 28 PID 1636 wrote to memory of 2600 1636 rundll32.exe 29 PID 1636 wrote to memory of 2600 1636 rundll32.exe 29 PID 1636 wrote to memory of 2600 1636 rundll32.exe 29 PID 1636 wrote to memory of 2600 1636 rundll32.exe 29 PID 2600 wrote to memory of 1056 2600 f75fe2d.exe 17 PID 2600 wrote to memory of 1100 2600 f75fe2d.exe 18 PID 2600 wrote to memory of 1116 2600 f75fe2d.exe 20 PID 2600 wrote to memory of 2180 2600 f75fe2d.exe 23 PID 2600 wrote to memory of 1680 2600 f75fe2d.exe 27 PID 2600 wrote to memory of 1636 2600 f75fe2d.exe 28 PID 2600 wrote to memory of 1636 2600 f75fe2d.exe 28 PID 1636 wrote to memory of 2420 1636 rundll32.exe 30 PID 1636 wrote to memory of 2420 1636 rundll32.exe 30 PID 1636 wrote to memory of 2420 1636 rundll32.exe 30 PID 1636 wrote to memory of 2420 1636 rundll32.exe 30 PID 1636 wrote to memory of 1048 1636 rundll32.exe 31 PID 1636 wrote to memory of 1048 1636 rundll32.exe 31 PID 1636 wrote to memory of 1048 1636 rundll32.exe 31 PID 1636 wrote to memory of 1048 1636 rundll32.exe 31 PID 2600 wrote to memory of 1056 2600 f75fe2d.exe 17 PID 2600 wrote to memory of 1100 2600 f75fe2d.exe 18 PID 2600 wrote to memory of 1116 2600 f75fe2d.exe 20 PID 2600 wrote to memory of 2420 2600 f75fe2d.exe 30 PID 2600 wrote to memory of 2420 2600 f75fe2d.exe 30 PID 2600 wrote to memory of 1048 2600 f75fe2d.exe 31 PID 2600 wrote to memory of 1048 2600 f75fe2d.exe 31 PID 1048 wrote to memory of 1056 1048 f7619a8.exe 17 PID 1048 wrote to memory of 1100 1048 f7619a8.exe 18 PID 1048 wrote to memory of 1116 1048 f7619a8.exe 20 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f75fe2d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7619a8.exe
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1056
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1100
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d43c86d213f307f16cb5e4afbaa1e07a9be28b9ed9928c2b138451d8fbb633b2.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d43c86d213f307f16cb5e4afbaa1e07a9be28b9ed9928c2b138451d8fbb633b2.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\f75fe2d.exeC:\Users\Admin\AppData\Local\Temp\f75fe2d.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2600
-
-
C:\Users\Admin\AppData\Local\Temp\f760001.exeC:\Users\Admin\AppData\Local\Temp\f760001.exe4⤵
- Executes dropped EXE
PID:2420
-
-
C:\Users\Admin\AppData\Local\Temp\f7619a8.exeC:\Users\Admin\AppData\Local\Temp\f7619a8.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1048
-
-
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1116
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:2180
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD5dd2e80b3c79be3d57385f5718225bbc3
SHA170e621177e507a1efd5a6b01c64fd0c41544a827
SHA2569dacbe8ba01a6fabacf45c50e4e48c24a0c61908b435a41281663e16273e83a6
SHA5123f4d43972db2455d302b388efa0bab11c1807a6d8c6dbe6db82dbbdcb0e52feca30884f340ca4b2c447897ad60fd27649a1f42b2ab56eb06c50214fd8e99cc24
-
Filesize
97KB
MD58356dedd10e9fa71584c068b821a7dfb
SHA1ca50b8f1be014d09b1b6dc3241007214d4874c1b
SHA25698c5d8445d92cd54871f68156a980666cc70fff9ec333d82e8aa037a68437afd
SHA512bb74e5e3de29b555a40cbf2befc06a49e6b4583c3ba2a8e27ec4d0f384a76a92a7ee83b3939fef9bbc00c0b81b08f11ae697a3a82a403cac146ced2deba41831