Analysis
-
max time kernel
143s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 20:01
Static task
static1
Behavioral task
behavioral1
Sample
26e4dc69f0d7a25a4ae222b317c290a488feec3f44ef2f3a7518e03bb5b598bd.dll
Resource
win7-20240221-en
General
-
Target
26e4dc69f0d7a25a4ae222b317c290a488feec3f44ef2f3a7518e03bb5b598bd.dll
-
Size
120KB
-
MD5
e976dbc171d407020a5cc6a6fa0f033a
-
SHA1
199916460894dc53d2d0446029b46b1b77ad371c
-
SHA256
26e4dc69f0d7a25a4ae222b317c290a488feec3f44ef2f3a7518e03bb5b598bd
-
SHA512
6d09fc6b1489308b8875902ec22e717e059938a44fcf7b16fb52ccc99c4b7bc6245a46073ff0b61fa326a59ee55654ccb37d1792ee80de278023429eedbc8cd7
-
SSDEEP
1536:UsTqMu+5SzVpDVObENz4yC8lA9TC19RVvP9/go6Kqdqa46Pqk0cDwc5f2XEw:UyCKO4nFUP/gkoqa46PvrOX
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
e57f405.exee5801a1.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57f405.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57f405.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57f405.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e5801a1.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e5801a1.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e5801a1.exe -
Processes:
e57f405.exee5801a1.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57f405.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5801a1.exe -
Processes:
e57f405.exee5801a1.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57f405.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57f405.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5801a1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5801a1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5801a1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57f405.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57f405.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57f405.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5801a1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57f405.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5801a1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5801a1.exe -
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 30 IoCs
Processes:
resource yara_rule behavioral2/memory/772-7-0x0000000000750000-0x000000000180A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/772-11-0x0000000000750000-0x000000000180A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/772-14-0x0000000000750000-0x000000000180A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/772-10-0x0000000000750000-0x000000000180A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/772-15-0x0000000000750000-0x000000000180A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/772-16-0x0000000000750000-0x000000000180A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/772-22-0x0000000000750000-0x000000000180A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/772-9-0x0000000000750000-0x000000000180A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/772-12-0x0000000000750000-0x000000000180A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/772-21-0x0000000000750000-0x000000000180A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/772-36-0x0000000000750000-0x000000000180A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/772-37-0x0000000000750000-0x000000000180A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/772-38-0x0000000000750000-0x000000000180A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/772-52-0x0000000000750000-0x000000000180A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/772-53-0x0000000000750000-0x000000000180A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/772-55-0x0000000000750000-0x000000000180A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/772-56-0x0000000000750000-0x000000000180A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/772-58-0x0000000000750000-0x000000000180A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/772-59-0x0000000000750000-0x000000000180A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/772-60-0x0000000000750000-0x000000000180A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/772-75-0x0000000000750000-0x000000000180A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/772-73-0x0000000000750000-0x000000000180A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/772-81-0x0000000000750000-0x000000000180A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/772-82-0x0000000000750000-0x000000000180A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/772-86-0x0000000000750000-0x000000000180A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/772-87-0x0000000000750000-0x000000000180A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/772-90-0x0000000000750000-0x000000000180A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/772-89-0x0000000000750000-0x000000000180A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4984-129-0x0000000000B70000-0x0000000001C2A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4984-142-0x0000000000B70000-0x0000000001C2A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine -
UPX dump on OEP (original entry point) 34 IoCs
Processes:
resource yara_rule behavioral2/memory/772-7-0x0000000000750000-0x000000000180A000-memory.dmp UPX behavioral2/memory/772-11-0x0000000000750000-0x000000000180A000-memory.dmp UPX behavioral2/memory/772-14-0x0000000000750000-0x000000000180A000-memory.dmp UPX behavioral2/memory/772-10-0x0000000000750000-0x000000000180A000-memory.dmp UPX behavioral2/memory/772-15-0x0000000000750000-0x000000000180A000-memory.dmp UPX behavioral2/memory/772-16-0x0000000000750000-0x000000000180A000-memory.dmp UPX behavioral2/memory/772-22-0x0000000000750000-0x000000000180A000-memory.dmp UPX behavioral2/memory/772-9-0x0000000000750000-0x000000000180A000-memory.dmp UPX behavioral2/memory/772-12-0x0000000000750000-0x000000000180A000-memory.dmp UPX behavioral2/memory/772-21-0x0000000000750000-0x000000000180A000-memory.dmp UPX behavioral2/memory/772-36-0x0000000000750000-0x000000000180A000-memory.dmp UPX behavioral2/memory/772-37-0x0000000000750000-0x000000000180A000-memory.dmp UPX behavioral2/memory/772-38-0x0000000000750000-0x000000000180A000-memory.dmp UPX behavioral2/memory/772-52-0x0000000000750000-0x000000000180A000-memory.dmp UPX behavioral2/memory/772-53-0x0000000000750000-0x000000000180A000-memory.dmp UPX behavioral2/memory/772-55-0x0000000000750000-0x000000000180A000-memory.dmp UPX behavioral2/memory/772-56-0x0000000000750000-0x000000000180A000-memory.dmp UPX behavioral2/memory/772-58-0x0000000000750000-0x000000000180A000-memory.dmp UPX behavioral2/memory/772-59-0x0000000000750000-0x000000000180A000-memory.dmp UPX behavioral2/memory/772-60-0x0000000000750000-0x000000000180A000-memory.dmp UPX behavioral2/memory/772-75-0x0000000000750000-0x000000000180A000-memory.dmp UPX behavioral2/memory/772-73-0x0000000000750000-0x000000000180A000-memory.dmp UPX behavioral2/memory/772-81-0x0000000000750000-0x000000000180A000-memory.dmp UPX behavioral2/memory/772-82-0x0000000000750000-0x000000000180A000-memory.dmp UPX behavioral2/memory/772-86-0x0000000000750000-0x000000000180A000-memory.dmp UPX behavioral2/memory/772-87-0x0000000000750000-0x000000000180A000-memory.dmp UPX behavioral2/memory/772-90-0x0000000000750000-0x000000000180A000-memory.dmp UPX behavioral2/memory/772-89-0x0000000000750000-0x000000000180A000-memory.dmp UPX behavioral2/memory/772-109-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/3884-113-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/3944-117-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4984-129-0x0000000000B70000-0x0000000001C2A000-memory.dmp UPX behavioral2/memory/4984-143-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4984-142-0x0000000000B70000-0x0000000001C2A000-memory.dmp UPX -
Executes dropped EXE 4 IoCs
Processes:
e57f405.exee57fb19.exee580134.exee5801a1.exepid process 772 e57f405.exe 3884 e57fb19.exe 3944 e580134.exe 4984 e5801a1.exe -
Processes:
resource yara_rule behavioral2/memory/772-7-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/772-11-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/772-14-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/772-10-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/772-15-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/772-16-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/772-22-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/772-9-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/772-12-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/772-21-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/772-36-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/772-37-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/772-38-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/772-52-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/772-53-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/772-55-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/772-56-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/772-58-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/772-59-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/772-60-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/772-75-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/772-73-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/772-81-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/772-82-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/772-86-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/772-87-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/772-90-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/772-89-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/4984-129-0x0000000000B70000-0x0000000001C2A000-memory.dmp upx behavioral2/memory/4984-142-0x0000000000B70000-0x0000000001C2A000-memory.dmp upx -
Processes:
e57f405.exee5801a1.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57f405.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5801a1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5801a1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5801a1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57f405.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57f405.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57f405.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57f405.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5801a1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5801a1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5801a1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57f405.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e5801a1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57f405.exe -
Processes:
e57f405.exee5801a1.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57f405.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5801a1.exe -
Enumerates connected drives 3 TTPs 12 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
e57f405.exedescription ioc process File opened (read-only) \??\G: e57f405.exe File opened (read-only) \??\I: e57f405.exe File opened (read-only) \??\K: e57f405.exe File opened (read-only) \??\L: e57f405.exe File opened (read-only) \??\M: e57f405.exe File opened (read-only) \??\N: e57f405.exe File opened (read-only) \??\O: e57f405.exe File opened (read-only) \??\E: e57f405.exe File opened (read-only) \??\Q: e57f405.exe File opened (read-only) \??\P: e57f405.exe File opened (read-only) \??\J: e57f405.exe File opened (read-only) \??\H: e57f405.exe -
Drops file in Windows directory 3 IoCs
Processes:
e57f405.exee5801a1.exedescription ioc process File created C:\Windows\e57f695 e57f405.exe File opened for modification C:\Windows\SYSTEM.INI e57f405.exe File created C:\Windows\e5851e4 e5801a1.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
e57f405.exee5801a1.exepid process 772 e57f405.exe 772 e57f405.exe 772 e57f405.exe 772 e57f405.exe 4984 e5801a1.exe 4984 e5801a1.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
e57f405.exedescription pid process Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe Token: SeDebugPrivilege 772 e57f405.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
rundll32.exerundll32.exee57f405.exedescription pid process target process PID 2916 wrote to memory of 4452 2916 rundll32.exe rundll32.exe PID 2916 wrote to memory of 4452 2916 rundll32.exe rundll32.exe PID 2916 wrote to memory of 4452 2916 rundll32.exe rundll32.exe PID 4452 wrote to memory of 772 4452 rundll32.exe e57f405.exe PID 4452 wrote to memory of 772 4452 rundll32.exe e57f405.exe PID 4452 wrote to memory of 772 4452 rundll32.exe e57f405.exe PID 772 wrote to memory of 800 772 e57f405.exe fontdrvhost.exe PID 772 wrote to memory of 804 772 e57f405.exe fontdrvhost.exe PID 772 wrote to memory of 336 772 e57f405.exe dwm.exe PID 772 wrote to memory of 2820 772 e57f405.exe sihost.exe PID 772 wrote to memory of 2852 772 e57f405.exe svchost.exe PID 772 wrote to memory of 3036 772 e57f405.exe taskhostw.exe PID 772 wrote to memory of 3336 772 e57f405.exe Explorer.EXE PID 772 wrote to memory of 3508 772 e57f405.exe svchost.exe PID 772 wrote to memory of 3708 772 e57f405.exe DllHost.exe PID 772 wrote to memory of 3844 772 e57f405.exe StartMenuExperienceHost.exe PID 772 wrote to memory of 3928 772 e57f405.exe RuntimeBroker.exe PID 772 wrote to memory of 4012 772 e57f405.exe SearchApp.exe PID 772 wrote to memory of 4112 772 e57f405.exe RuntimeBroker.exe PID 772 wrote to memory of 492 772 e57f405.exe RuntimeBroker.exe PID 772 wrote to memory of 4660 772 e57f405.exe TextInputHost.exe PID 772 wrote to memory of 3120 772 e57f405.exe msedge.exe PID 772 wrote to memory of 2336 772 e57f405.exe msedge.exe PID 772 wrote to memory of 4800 772 e57f405.exe msedge.exe PID 772 wrote to memory of 416 772 e57f405.exe msedge.exe PID 772 wrote to memory of 3208 772 e57f405.exe msedge.exe PID 772 wrote to memory of 4304 772 e57f405.exe msedge.exe PID 772 wrote to memory of 4328 772 e57f405.exe msedge.exe PID 772 wrote to memory of 2916 772 e57f405.exe rundll32.exe PID 772 wrote to memory of 4452 772 e57f405.exe rundll32.exe PID 772 wrote to memory of 4452 772 e57f405.exe rundll32.exe PID 4452 wrote to memory of 3884 4452 rundll32.exe e57fb19.exe PID 4452 wrote to memory of 3884 4452 rundll32.exe e57fb19.exe PID 4452 wrote to memory of 3884 4452 rundll32.exe e57fb19.exe PID 4452 wrote to memory of 3944 4452 rundll32.exe e580134.exe PID 4452 wrote to memory of 3944 4452 rundll32.exe e580134.exe PID 4452 wrote to memory of 3944 4452 rundll32.exe e580134.exe PID 4452 wrote to memory of 4984 4452 rundll32.exe e5801a1.exe PID 4452 wrote to memory of 4984 4452 rundll32.exe e5801a1.exe PID 4452 wrote to memory of 4984 4452 rundll32.exe e5801a1.exe PID 772 wrote to memory of 800 772 e57f405.exe fontdrvhost.exe PID 772 wrote to memory of 804 772 e57f405.exe fontdrvhost.exe PID 772 wrote to memory of 336 772 e57f405.exe dwm.exe PID 772 wrote to memory of 2820 772 e57f405.exe sihost.exe PID 772 wrote to memory of 2852 772 e57f405.exe svchost.exe PID 772 wrote to memory of 3036 772 e57f405.exe taskhostw.exe PID 772 wrote to memory of 3336 772 e57f405.exe Explorer.EXE PID 772 wrote to memory of 3508 772 e57f405.exe svchost.exe PID 772 wrote to memory of 3708 772 e57f405.exe DllHost.exe PID 772 wrote to memory of 3844 772 e57f405.exe StartMenuExperienceHost.exe PID 772 wrote to memory of 3928 772 e57f405.exe RuntimeBroker.exe PID 772 wrote to memory of 4012 772 e57f405.exe SearchApp.exe PID 772 wrote to memory of 4112 772 e57f405.exe RuntimeBroker.exe PID 772 wrote to memory of 492 772 e57f405.exe RuntimeBroker.exe PID 772 wrote to memory of 4660 772 e57f405.exe TextInputHost.exe PID 772 wrote to memory of 3120 772 e57f405.exe msedge.exe PID 772 wrote to memory of 2336 772 e57f405.exe msedge.exe PID 772 wrote to memory of 4800 772 e57f405.exe msedge.exe PID 772 wrote to memory of 416 772 e57f405.exe msedge.exe PID 772 wrote to memory of 3208 772 e57f405.exe msedge.exe PID 772 wrote to memory of 4304 772 e57f405.exe msedge.exe PID 772 wrote to memory of 4328 772 e57f405.exe msedge.exe PID 772 wrote to memory of 3884 772 e57f405.exe e57fb19.exe PID 772 wrote to memory of 3884 772 e57f405.exe e57fb19.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
e57f405.exee5801a1.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57f405.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5801a1.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\26e4dc69f0d7a25a4ae222b317c290a488feec3f44ef2f3a7518e03bb5b598bd.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\26e4dc69f0d7a25a4ae222b317c290a488feec3f44ef2f3a7518e03bb5b598bd.dll,#13⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e57f405.exeC:\Users\Admin\AppData\Local\Temp\e57f405.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\e57fb19.exeC:\Users\Admin\AppData\Local\Temp\e57fb19.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\e580134.exeC:\Users\Admin\AppData\Local\Temp\e580134.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\e5801a1.exeC:\Users\Admin\AppData\Local\Temp\e5801a1.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- System policy modification
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b0,0x7ffa2d402e98,0x7ffa2d402ea4,0x7ffa2d402eb02⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3056 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3144 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:32⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3264 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --mojo-platform-channel-handle=5484 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=5620 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4828 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:82⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\e57f405.exeFilesize
97KB
MD5db43d620df054c2b5fc4545ea01b8c14
SHA16fca2b0349055014b96bcdd6130584f4978719b1
SHA256a6ba27aa9fda2dd24cdd3eb288982dbd3dee4c53554b4f7bffe8e91ddd0fc37d
SHA512641cb050813ded7596e3efe5f8045165bcb6f8920fdc898081f158681f1101f901d372c9e9741718624f5fee925f71e4548cce14ecce2504830a324d1fcf2cf5
-
C:\Windows\SYSTEM.INIFilesize
257B
MD52ddcc9c72fb539f5efd35a89a5c8bdcb
SHA14a7cd34813cd5b19035617cd1a023bffbfcd6640
SHA2567fb6cb2979e046ecfe3884a1a246d2fd5b3a5df91034a5fafc7c5c86f678c432
SHA5126b3fba2653b3abcce667d19cae6b385e11f3fed709685c37d9694dfa54e3bf4d579488099640199ae784941da6f809af2bc52036a42f13d0a2b1fa84f08b193d
-
memory/772-55-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/772-73-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/772-11-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/772-14-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/772-10-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/772-15-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/772-16-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/772-22-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/772-9-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/772-12-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/772-29-0x0000000001AB0000-0x0000000001AB2000-memory.dmpFilesize
8KB
-
memory/772-21-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/772-5-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/772-34-0x0000000001AB0000-0x0000000001AB2000-memory.dmpFilesize
8KB
-
memory/772-56-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/772-36-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/772-28-0x0000000001AC0000-0x0000000001AC1000-memory.dmpFilesize
4KB
-
memory/772-109-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/772-97-0x0000000001AB0000-0x0000000001AB2000-memory.dmpFilesize
8KB
-
memory/772-89-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/772-37-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/772-90-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/772-38-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/772-87-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/772-52-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/772-53-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/772-86-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/772-82-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/772-81-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/772-59-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/772-60-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/772-7-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/772-75-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/772-58-0x0000000000750000-0x000000000180A000-memory.dmpFilesize
16.7MB
-
memory/3884-70-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/3884-65-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/3884-74-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/3884-35-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3884-113-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3944-117-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3944-76-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/3944-67-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/3944-43-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3944-71-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/4452-26-0x0000000004AE0000-0x0000000004AE1000-memory.dmpFilesize
4KB
-
memory/4452-23-0x0000000004550000-0x0000000004552000-memory.dmpFilesize
8KB
-
memory/4452-24-0x0000000004550000-0x0000000004552000-memory.dmpFilesize
8KB
-
memory/4452-33-0x0000000004550000-0x0000000004552000-memory.dmpFilesize
8KB
-
memory/4452-0-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/4984-142-0x0000000000B70000-0x0000000001C2A000-memory.dmpFilesize
16.7MB
-
memory/4984-51-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4984-69-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/4984-72-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/4984-77-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/4984-143-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4984-129-0x0000000000B70000-0x0000000001C2A000-memory.dmpFilesize
16.7MB