Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 19:02
Static task
static1
Behavioral task
behavioral1
Sample
16b4dfc06457a6bcfd10a4d7543c4a8f5aed127719d16a730e95ee08e4bd7328.dll
Resource
win7-20240508-en
General
-
Target
16b4dfc06457a6bcfd10a4d7543c4a8f5aed127719d16a730e95ee08e4bd7328.dll
-
Size
120KB
-
MD5
9a9a328c781a0fcbeab84401750ab0b3
-
SHA1
856a320f326bb622de155f0e206892db0490d43e
-
SHA256
16b4dfc06457a6bcfd10a4d7543c4a8f5aed127719d16a730e95ee08e4bd7328
-
SHA512
e88fdfe1e86d2f2baeead719a1ee0bed84b5c70e1f19c3f38a43f3291ccca505e2f2e6f27b3a8fb1d2484ec90af377139fce793779e079687e811990c1e6d7d1
-
SSDEEP
1536:xQRskiO82WOFJnxM7YtICBqLSqKfe/sA2CZeMo1zJVTDwffOwe53UKl4Op2:xXO7JxM7/C4SqV/p26eHTVTcfWKKl3
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
f761304.exef762edd.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f761304.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f761304.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f761304.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f762edd.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f762edd.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f762edd.exe -
Processes:
f761304.exef762edd.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f761304.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f762edd.exe -
Processes:
f761304.exef762edd.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f761304.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f761304.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f762edd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f762edd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f761304.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f761304.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f761304.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f761304.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f762edd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f762edd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f762edd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f762edd.exe -
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 24 IoCs
Processes:
resource yara_rule behavioral1/memory/2096-17-0x00000000006C0000-0x000000000177A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2096-16-0x00000000006C0000-0x000000000177A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2096-18-0x00000000006C0000-0x000000000177A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2096-14-0x00000000006C0000-0x000000000177A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2096-22-0x00000000006C0000-0x000000000177A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2096-20-0x00000000006C0000-0x000000000177A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2096-15-0x00000000006C0000-0x000000000177A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2096-23-0x00000000006C0000-0x000000000177A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2096-21-0x00000000006C0000-0x000000000177A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2096-19-0x00000000006C0000-0x000000000177A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2096-63-0x00000000006C0000-0x000000000177A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2096-64-0x00000000006C0000-0x000000000177A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2096-65-0x00000000006C0000-0x000000000177A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2096-79-0x00000000006C0000-0x000000000177A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2096-80-0x00000000006C0000-0x000000000177A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2096-82-0x00000000006C0000-0x000000000177A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2096-102-0x00000000006C0000-0x000000000177A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2096-103-0x00000000006C0000-0x000000000177A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2096-105-0x00000000006C0000-0x000000000177A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2096-107-0x00000000006C0000-0x000000000177A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2096-115-0x00000000006C0000-0x000000000177A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2096-153-0x00000000006C0000-0x000000000177A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2212-171-0x0000000000970000-0x0000000001A2A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2212-204-0x0000000000970000-0x0000000001A2A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine -
UPX dump on OEP (original entry point) 29 IoCs
Processes:
resource yara_rule behavioral1/memory/2096-17-0x00000000006C0000-0x000000000177A000-memory.dmp UPX behavioral1/memory/2096-16-0x00000000006C0000-0x000000000177A000-memory.dmp UPX behavioral1/memory/2096-18-0x00000000006C0000-0x000000000177A000-memory.dmp UPX behavioral1/memory/2096-14-0x00000000006C0000-0x000000000177A000-memory.dmp UPX behavioral1/memory/2096-22-0x00000000006C0000-0x000000000177A000-memory.dmp UPX behavioral1/memory/2096-20-0x00000000006C0000-0x000000000177A000-memory.dmp UPX behavioral1/memory/2644-62-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/2096-15-0x00000000006C0000-0x000000000177A000-memory.dmp UPX behavioral1/memory/2096-23-0x00000000006C0000-0x000000000177A000-memory.dmp UPX behavioral1/memory/2096-21-0x00000000006C0000-0x000000000177A000-memory.dmp UPX behavioral1/memory/2096-19-0x00000000006C0000-0x000000000177A000-memory.dmp UPX behavioral1/memory/2096-63-0x00000000006C0000-0x000000000177A000-memory.dmp UPX behavioral1/memory/2096-64-0x00000000006C0000-0x000000000177A000-memory.dmp UPX behavioral1/memory/2096-65-0x00000000006C0000-0x000000000177A000-memory.dmp UPX behavioral1/memory/2212-78-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/2096-79-0x00000000006C0000-0x000000000177A000-memory.dmp UPX behavioral1/memory/2096-80-0x00000000006C0000-0x000000000177A000-memory.dmp UPX behavioral1/memory/2096-82-0x00000000006C0000-0x000000000177A000-memory.dmp UPX behavioral1/memory/2096-102-0x00000000006C0000-0x000000000177A000-memory.dmp UPX behavioral1/memory/2096-103-0x00000000006C0000-0x000000000177A000-memory.dmp UPX behavioral1/memory/2096-105-0x00000000006C0000-0x000000000177A000-memory.dmp UPX behavioral1/memory/2096-107-0x00000000006C0000-0x000000000177A000-memory.dmp UPX behavioral1/memory/2096-115-0x00000000006C0000-0x000000000177A000-memory.dmp UPX behavioral1/memory/2096-149-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/2096-153-0x00000000006C0000-0x000000000177A000-memory.dmp UPX behavioral1/memory/2644-154-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/2212-171-0x0000000000970000-0x0000000001A2A000-memory.dmp UPX behavioral1/memory/2212-204-0x0000000000970000-0x0000000001A2A000-memory.dmp UPX behavioral1/memory/2212-205-0x0000000000400000-0x0000000000412000-memory.dmp UPX -
Executes dropped EXE 3 IoCs
Processes:
f761304.exef76148a.exef762edd.exepid process 2096 f761304.exe 2644 f76148a.exe 2212 f762edd.exe -
Loads dropped DLL 6 IoCs
Processes:
rundll32.exepid process 2116 rundll32.exe 2116 rundll32.exe 2116 rundll32.exe 2116 rundll32.exe 2116 rundll32.exe 2116 rundll32.exe -
Processes:
resource yara_rule behavioral1/memory/2096-17-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2096-16-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2096-18-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2096-14-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2096-22-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2096-20-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2096-15-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2096-23-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2096-21-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2096-19-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2096-63-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2096-64-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2096-65-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2096-79-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2096-80-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2096-82-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2096-102-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2096-103-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2096-105-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2096-107-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2096-115-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2096-153-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2212-171-0x0000000000970000-0x0000000001A2A000-memory.dmp upx behavioral1/memory/2212-204-0x0000000000970000-0x0000000001A2A000-memory.dmp upx -
Processes:
f762edd.exef761304.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f762edd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f762edd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f762edd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f761304.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f762edd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f761304.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f762edd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f761304.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f761304.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f761304.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f762edd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f762edd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f761304.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f761304.exe -
Processes:
f761304.exef762edd.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f761304.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f762edd.exe -
Enumerates connected drives 3 TTPs 13 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
f761304.exef762edd.exedescription ioc process File opened (read-only) \??\J: f761304.exe File opened (read-only) \??\K: f761304.exe File opened (read-only) \??\M: f761304.exe File opened (read-only) \??\O: f761304.exe File opened (read-only) \??\G: f761304.exe File opened (read-only) \??\H: f761304.exe File opened (read-only) \??\E: f761304.exe File opened (read-only) \??\I: f761304.exe File opened (read-only) \??\N: f761304.exe File opened (read-only) \??\G: f762edd.exe File opened (read-only) \??\E: f762edd.exe File opened (read-only) \??\L: f761304.exe File opened (read-only) \??\P: f761304.exe -
Drops file in Windows directory 3 IoCs
Processes:
f761304.exef762edd.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI f761304.exe File created C:\Windows\f766364 f762edd.exe File created C:\Windows\f761352 f761304.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
f761304.exef762edd.exepid process 2096 f761304.exe 2096 f761304.exe 2212 f762edd.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
Processes:
f761304.exef762edd.exedescription pid process Token: SeDebugPrivilege 2096 f761304.exe Token: SeDebugPrivilege 2096 f761304.exe Token: SeDebugPrivilege 2096 f761304.exe Token: SeDebugPrivilege 2096 f761304.exe Token: SeDebugPrivilege 2096 f761304.exe Token: SeDebugPrivilege 2096 f761304.exe Token: SeDebugPrivilege 2096 f761304.exe Token: SeDebugPrivilege 2096 f761304.exe Token: SeDebugPrivilege 2096 f761304.exe Token: SeDebugPrivilege 2096 f761304.exe Token: SeDebugPrivilege 2096 f761304.exe Token: SeDebugPrivilege 2096 f761304.exe Token: SeDebugPrivilege 2096 f761304.exe Token: SeDebugPrivilege 2096 f761304.exe Token: SeDebugPrivilege 2096 f761304.exe Token: SeDebugPrivilege 2096 f761304.exe Token: SeDebugPrivilege 2096 f761304.exe Token: SeDebugPrivilege 2096 f761304.exe Token: SeDebugPrivilege 2096 f761304.exe Token: SeDebugPrivilege 2096 f761304.exe Token: SeDebugPrivilege 2096 f761304.exe Token: SeDebugPrivilege 2212 f762edd.exe Token: SeDebugPrivilege 2212 f762edd.exe Token: SeDebugPrivilege 2212 f762edd.exe Token: SeDebugPrivilege 2212 f762edd.exe Token: SeDebugPrivilege 2212 f762edd.exe Token: SeDebugPrivilege 2212 f762edd.exe Token: SeDebugPrivilege 2212 f762edd.exe Token: SeDebugPrivilege 2212 f762edd.exe Token: SeDebugPrivilege 2212 f762edd.exe Token: SeDebugPrivilege 2212 f762edd.exe Token: SeDebugPrivilege 2212 f762edd.exe Token: SeDebugPrivilege 2212 f762edd.exe Token: SeDebugPrivilege 2212 f762edd.exe Token: SeDebugPrivilege 2212 f762edd.exe Token: SeDebugPrivilege 2212 f762edd.exe Token: SeDebugPrivilege 2212 f762edd.exe Token: SeDebugPrivilege 2212 f762edd.exe Token: SeDebugPrivilege 2212 f762edd.exe Token: SeDebugPrivilege 2212 f762edd.exe Token: SeDebugPrivilege 2212 f762edd.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
rundll32.exerundll32.exef761304.exef762edd.exedescription pid process target process PID 1232 wrote to memory of 2116 1232 rundll32.exe rundll32.exe PID 1232 wrote to memory of 2116 1232 rundll32.exe rundll32.exe PID 1232 wrote to memory of 2116 1232 rundll32.exe rundll32.exe PID 1232 wrote to memory of 2116 1232 rundll32.exe rundll32.exe PID 1232 wrote to memory of 2116 1232 rundll32.exe rundll32.exe PID 1232 wrote to memory of 2116 1232 rundll32.exe rundll32.exe PID 1232 wrote to memory of 2116 1232 rundll32.exe rundll32.exe PID 2116 wrote to memory of 2096 2116 rundll32.exe f761304.exe PID 2116 wrote to memory of 2096 2116 rundll32.exe f761304.exe PID 2116 wrote to memory of 2096 2116 rundll32.exe f761304.exe PID 2116 wrote to memory of 2096 2116 rundll32.exe f761304.exe PID 2096 wrote to memory of 1108 2096 f761304.exe taskhost.exe PID 2096 wrote to memory of 1172 2096 f761304.exe Dwm.exe PID 2096 wrote to memory of 1200 2096 f761304.exe Explorer.EXE PID 2096 wrote to memory of 2012 2096 f761304.exe DllHost.exe PID 2096 wrote to memory of 1232 2096 f761304.exe rundll32.exe PID 2096 wrote to memory of 2116 2096 f761304.exe rundll32.exe PID 2096 wrote to memory of 2116 2096 f761304.exe rundll32.exe PID 2116 wrote to memory of 2644 2116 rundll32.exe f76148a.exe PID 2116 wrote to memory of 2644 2116 rundll32.exe f76148a.exe PID 2116 wrote to memory of 2644 2116 rundll32.exe f76148a.exe PID 2116 wrote to memory of 2644 2116 rundll32.exe f76148a.exe PID 2116 wrote to memory of 2212 2116 rundll32.exe f762edd.exe PID 2116 wrote to memory of 2212 2116 rundll32.exe f762edd.exe PID 2116 wrote to memory of 2212 2116 rundll32.exe f762edd.exe PID 2116 wrote to memory of 2212 2116 rundll32.exe f762edd.exe PID 2096 wrote to memory of 1108 2096 f761304.exe taskhost.exe PID 2096 wrote to memory of 1172 2096 f761304.exe Dwm.exe PID 2096 wrote to memory of 1200 2096 f761304.exe Explorer.EXE PID 2096 wrote to memory of 2644 2096 f761304.exe f76148a.exe PID 2096 wrote to memory of 2644 2096 f761304.exe f76148a.exe PID 2096 wrote to memory of 2212 2096 f761304.exe f762edd.exe PID 2096 wrote to memory of 2212 2096 f761304.exe f762edd.exe PID 2212 wrote to memory of 1108 2212 f762edd.exe taskhost.exe PID 2212 wrote to memory of 1172 2212 f762edd.exe Dwm.exe PID 2212 wrote to memory of 1200 2212 f762edd.exe Explorer.EXE -
System policy modification 1 TTPs 2 IoCs
Processes:
f761304.exef762edd.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f761304.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f762edd.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\16b4dfc06457a6bcfd10a4d7543c4a8f5aed127719d16a730e95ee08e4bd7328.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\16b4dfc06457a6bcfd10a4d7543c4a8f5aed127719d16a730e95ee08e4bd7328.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f761304.exeC:\Users\Admin\AppData\Local\Temp\f761304.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\f76148a.exeC:\Users\Admin\AppData\Local\Temp\f76148a.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\f762edd.exeC:\Users\Admin\AppData\Local\Temp\f762edd.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SYSTEM.INIFilesize
257B
MD588f248751c931d20aa112190baf53451
SHA190db7f86a4911f5f3a72246bd37dbbb6b0fb5724
SHA256af91e3f44bb628da57febbf71dbde03982563eef383cd287acaec8a0fb4a9a2e
SHA512f658bcffa552f0d604dc77f048eac0e94899fa6d3dc0ff55fc43af67a42d992e78d39390abd8426d5885b5771ce74598fd1c23283958de8f285dc435a52dab2d
-
\Users\Admin\AppData\Local\Temp\f761304.exeFilesize
97KB
MD55e1e7322707fe9f471fcb71dbc7019a2
SHA123ded2e8f9c6dbede023357c9e8db3349680074c
SHA2566f69c25685f41b3f7ddfab8026c4cd3a4c0d20ba5cfeb5a34a982db31ee30cb1
SHA512f405059b1dc75e453437610a0be53618dde2cd469b30aa9f9a1e543fd76ca431725b97022af55d09e3e3f344dfaab793574bada86d01c19a58088f1a903724e5
-
memory/1108-29-0x00000000020F0000-0x00000000020F2000-memory.dmpFilesize
8KB
-
memory/2096-63-0x00000000006C0000-0x000000000177A000-memory.dmpFilesize
16.7MB
-
memory/2096-18-0x00000000006C0000-0x000000000177A000-memory.dmpFilesize
16.7MB
-
memory/2096-64-0x00000000006C0000-0x000000000177A000-memory.dmpFilesize
16.7MB
-
memory/2096-19-0x00000000006C0000-0x000000000177A000-memory.dmpFilesize
16.7MB
-
memory/2096-65-0x00000000006C0000-0x000000000177A000-memory.dmpFilesize
16.7MB
-
memory/2096-153-0x00000000006C0000-0x000000000177A000-memory.dmpFilesize
16.7MB
-
memory/2096-17-0x00000000006C0000-0x000000000177A000-memory.dmpFilesize
16.7MB
-
memory/2096-115-0x00000000006C0000-0x000000000177A000-memory.dmpFilesize
16.7MB
-
memory/2096-48-0x00000000004A0000-0x00000000004A1000-memory.dmpFilesize
4KB
-
memory/2096-50-0x00000000003F0000-0x00000000003F2000-memory.dmpFilesize
8KB
-
memory/2096-22-0x00000000006C0000-0x000000000177A000-memory.dmpFilesize
16.7MB
-
memory/2096-20-0x00000000006C0000-0x000000000177A000-memory.dmpFilesize
16.7MB
-
memory/2096-11-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2096-79-0x00000000006C0000-0x000000000177A000-memory.dmpFilesize
16.7MB
-
memory/2096-107-0x00000000006C0000-0x000000000177A000-memory.dmpFilesize
16.7MB
-
memory/2096-105-0x00000000006C0000-0x000000000177A000-memory.dmpFilesize
16.7MB
-
memory/2096-59-0x00000000003F0000-0x00000000003F2000-memory.dmpFilesize
8KB
-
memory/2096-14-0x00000000006C0000-0x000000000177A000-memory.dmpFilesize
16.7MB
-
memory/2096-15-0x00000000006C0000-0x000000000177A000-memory.dmpFilesize
16.7MB
-
memory/2096-23-0x00000000006C0000-0x000000000177A000-memory.dmpFilesize
16.7MB
-
memory/2096-103-0x00000000006C0000-0x000000000177A000-memory.dmpFilesize
16.7MB
-
memory/2096-21-0x00000000006C0000-0x000000000177A000-memory.dmpFilesize
16.7MB
-
memory/2096-102-0x00000000006C0000-0x000000000177A000-memory.dmpFilesize
16.7MB
-
memory/2096-149-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2096-16-0x00000000006C0000-0x000000000177A000-memory.dmpFilesize
16.7MB
-
memory/2096-82-0x00000000006C0000-0x000000000177A000-memory.dmpFilesize
16.7MB
-
memory/2096-80-0x00000000006C0000-0x000000000177A000-memory.dmpFilesize
16.7MB
-
memory/2116-47-0x0000000000200000-0x0000000000201000-memory.dmpFilesize
4KB
-
memory/2116-1-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/2116-74-0x00000000001F0000-0x00000000001F2000-memory.dmpFilesize
8KB
-
memory/2116-60-0x0000000000210000-0x0000000000222000-memory.dmpFilesize
72KB
-
memory/2116-10-0x0000000000180000-0x0000000000192000-memory.dmpFilesize
72KB
-
memory/2116-9-0x0000000000180000-0x0000000000192000-memory.dmpFilesize
72KB
-
memory/2116-38-0x0000000000200000-0x0000000000201000-memory.dmpFilesize
4KB
-
memory/2116-37-0x00000000001F0000-0x00000000001F2000-memory.dmpFilesize
8KB
-
memory/2116-61-0x00000000001F0000-0x00000000001F2000-memory.dmpFilesize
8KB
-
memory/2116-77-0x0000000000180000-0x0000000000182000-memory.dmpFilesize
8KB
-
memory/2116-57-0x00000000001F0000-0x00000000001F2000-memory.dmpFilesize
8KB
-
memory/2212-205-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2212-171-0x0000000000970000-0x0000000001A2A000-memory.dmpFilesize
16.7MB
-
memory/2212-101-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/2212-98-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/2212-99-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2212-204-0x0000000000970000-0x0000000001A2A000-memory.dmpFilesize
16.7MB
-
memory/2212-78-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2644-62-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2644-154-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2644-100-0x00000000003E0000-0x00000000003E2000-memory.dmpFilesize
8KB
-
memory/2644-92-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/2644-93-0x00000000003E0000-0x00000000003E2000-memory.dmpFilesize
8KB