Analysis
-
max time kernel
125s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 23:40
Static task
static1
Behavioral task
behavioral1
Sample
小笨鸟万能论坛自动顶帖机软件 1.3破解版/小笨鸟万能论坛自动顶帖机软件1.3.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
小笨鸟万能论坛自动顶帖机软件 1.3破解版/小笨鸟万能论坛自动顶帖机软件1.3.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
小笨鸟万能论坛自动顶帖机软件 1.3破解版/更多软件下载.url
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
小笨鸟万能论坛自动顶帖机软件 1.3破解版/更多软件下载.url
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
小笨鸟万能论坛自动顶帖机软件 1.3破解版/飘荡软件.url
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
小笨鸟万能论坛自动顶帖机软件 1.3破解版/飘荡软件.url
Resource
win10v2004-20240426-en
General
-
Target
小笨鸟万能论坛自动顶帖机软件 1.3破解版/小笨鸟万能论坛自动顶帖机软件1.3.exe
-
Size
2.4MB
-
MD5
bea30d48453f1e355a9696450bf5ff9f
-
SHA1
c535c02da7e6a4ea234da574c9d2a89ccdd72539
-
SHA256
54472feb835d6cfc4dfe0f661f904e60185984fb7711c8decef8cb9bd2bde1ae
-
SHA512
e4bfdb440a6a9a962d290ccaab52c8b9083cc7d10097d4e879010c0d0bae7e6fa4968f98f9d3542cdbc3ad6f507b75ad0d94d9150770b8f6cac5c33a4da2da62
-
SSDEEP
24576:0w34ZhrtzT3gkd3o8SxkSkI4z9OIu4d1KCH/CbtmmxUGUuH3GvNcW:0bhzDgkzu/2ruyJHanxUGUuXIX
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
小笨鸟万能论坛自动顶帖机软件1.3.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 小笨鸟万能论坛自动顶帖机软件1.3.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 小笨鸟万能论坛自动顶帖机软件1.3.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 小笨鸟万能论坛自动顶帖机软件1.3.exe -
Processes:
小笨鸟万能论坛自动顶帖机软件1.3.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 小笨鸟万能论坛自动顶帖机软件1.3.exe -
Processes:
小笨鸟万能论坛自动顶帖机软件1.3.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 小笨鸟万能论坛自动顶帖机软件1.3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 小笨鸟万能论坛自动顶帖机软件1.3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 小笨鸟万能论坛自动顶帖机软件1.3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 小笨鸟万能论坛自动顶帖机软件1.3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 小笨鸟万能论坛自动顶帖机软件1.3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 小笨鸟万能论坛自动顶帖机软件1.3.exe -
Processes:
resource yara_rule behavioral1/memory/2724-2-0x0000000002130000-0x00000000031BE000-memory.dmp upx behavioral1/memory/2724-1-0x0000000002130000-0x00000000031BE000-memory.dmp upx behavioral1/memory/2724-8-0x0000000002130000-0x00000000031BE000-memory.dmp upx behavioral1/memory/2724-4-0x0000000002130000-0x00000000031BE000-memory.dmp upx behavioral1/memory/2724-5-0x0000000002130000-0x00000000031BE000-memory.dmp upx behavioral1/memory/2724-9-0x0000000002130000-0x00000000031BE000-memory.dmp upx behavioral1/memory/2724-7-0x0000000002130000-0x00000000031BE000-memory.dmp upx behavioral1/memory/2724-11-0x0000000002130000-0x00000000031BE000-memory.dmp upx behavioral1/memory/2724-10-0x0000000002130000-0x00000000031BE000-memory.dmp upx behavioral1/memory/2724-6-0x0000000002130000-0x00000000031BE000-memory.dmp upx behavioral1/memory/2724-12-0x0000000002130000-0x00000000031BE000-memory.dmp upx behavioral1/memory/2724-13-0x0000000002130000-0x00000000031BE000-memory.dmp upx behavioral1/memory/2724-15-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2724-62-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2724-61-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2724-60-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2724-58-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2724-56-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2724-54-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2724-52-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2724-50-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2724-48-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2724-46-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2724-44-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2724-42-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2724-40-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2724-38-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2724-36-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2724-34-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2724-32-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2724-30-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2724-28-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2724-26-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2724-24-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2724-22-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2724-20-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2724-19-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2724-18-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2724-17-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2724-112-0x0000000002130000-0x00000000031BE000-memory.dmp upx -
Processes:
小笨鸟万能论坛自动顶帖机软件1.3.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 小笨鸟万能论坛自动顶帖机软件1.3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 小笨鸟万能论坛自动顶帖机软件1.3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 小笨鸟万能论坛自动顶帖机软件1.3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 小笨鸟万能论坛自动顶帖机软件1.3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 小笨鸟万能论坛自动顶帖机软件1.3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 小笨鸟万能论坛自动顶帖机软件1.3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 小笨鸟万能论坛自动顶帖机软件1.3.exe -
Processes:
小笨鸟万能论坛自动顶帖机软件1.3.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 小笨鸟万能论坛自动顶帖机软件1.3.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
小笨鸟万能论坛自动顶帖机软件1.3.exedescription ioc process File opened (read-only) \??\E: 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened (read-only) \??\G: 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened (read-only) \??\M: 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened (read-only) \??\Q: 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened (read-only) \??\N: 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened (read-only) \??\P: 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened (read-only) \??\R: 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened (read-only) \??\S: 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened (read-only) \??\H: 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened (read-only) \??\J: 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened (read-only) \??\K: 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened (read-only) \??\L: 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened (read-only) \??\W: 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened (read-only) \??\I: 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened (read-only) \??\T: 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened (read-only) \??\U: 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened (read-only) \??\V: 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened (read-only) \??\O: 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened (read-only) \??\X: 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened (read-only) \??\Y: 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened (read-only) \??\Z: 小笨鸟万能论坛自动顶帖机软件1.3.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
小笨鸟万能论坛自动顶帖机软件1.3.exedescription ioc process File opened for modification \??\PhysicalDrive0 小笨鸟万能论坛自动顶帖机软件1.3.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
小笨鸟万能论坛自动顶帖机软件1.3.exedescription ioc process File opened for modification F:\autorun.inf 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened for modification C:\autorun.inf 小笨鸟万能论坛自动顶帖机软件1.3.exe -
Drops file in Program Files directory 5 IoCs
Processes:
小笨鸟万能论坛自动顶帖机软件1.3.exedescription ioc process File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe 小笨鸟万能论坛自动顶帖机软件1.3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe 小笨鸟万能论坛自动顶帖机软件1.3.exe -
Drops file in Windows directory 1 IoCs
Processes:
小笨鸟万能论坛自动顶帖机软件1.3.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI 小笨鸟万能论坛自动顶帖机软件1.3.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
小笨鸟万能论坛自动顶帖机软件1.3.exepid process 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe -
Suspicious use of AdjustPrivilegeToken 32 IoCs
Processes:
小笨鸟万能论坛自动顶帖机软件1.3.exedescription pid process Token: SeDebugPrivilege 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Token: SeDebugPrivilege 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
小笨鸟万能论坛自动顶帖机软件1.3.exepid process 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe -
Suspicious use of WriteProcessMemory 52 IoCs
Processes:
小笨鸟万能论坛自动顶帖机软件1.3.exedescription pid process target process PID 2724 wrote to memory of 1064 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Dwm.exe PID 2724 wrote to memory of 1096 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe taskhost.exe PID 2724 wrote to memory of 1152 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Explorer.EXE PID 2724 wrote to memory of 2128 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe DllHost.exe PID 2724 wrote to memory of 1064 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Dwm.exe PID 2724 wrote to memory of 1096 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe taskhost.exe PID 2724 wrote to memory of 1152 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Explorer.EXE PID 2724 wrote to memory of 2128 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe DllHost.exe PID 2724 wrote to memory of 1064 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Dwm.exe PID 2724 wrote to memory of 1096 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe taskhost.exe PID 2724 wrote to memory of 1152 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Explorer.EXE PID 2724 wrote to memory of 2128 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe DllHost.exe PID 2724 wrote to memory of 1064 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Dwm.exe PID 2724 wrote to memory of 1096 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe taskhost.exe PID 2724 wrote to memory of 1152 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Explorer.EXE PID 2724 wrote to memory of 2128 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe DllHost.exe PID 2724 wrote to memory of 1064 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Dwm.exe PID 2724 wrote to memory of 1096 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe taskhost.exe PID 2724 wrote to memory of 1152 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Explorer.EXE PID 2724 wrote to memory of 2128 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe DllHost.exe PID 2724 wrote to memory of 1064 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Dwm.exe PID 2724 wrote to memory of 1096 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe taskhost.exe PID 2724 wrote to memory of 1152 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Explorer.EXE PID 2724 wrote to memory of 2128 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe DllHost.exe PID 2724 wrote to memory of 1064 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Dwm.exe PID 2724 wrote to memory of 1096 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe taskhost.exe PID 2724 wrote to memory of 1152 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Explorer.EXE PID 2724 wrote to memory of 2128 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe DllHost.exe PID 2724 wrote to memory of 1064 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Dwm.exe PID 2724 wrote to memory of 1096 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe taskhost.exe PID 2724 wrote to memory of 1152 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Explorer.EXE PID 2724 wrote to memory of 2128 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe DllHost.exe PID 2724 wrote to memory of 1064 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Dwm.exe PID 2724 wrote to memory of 1096 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe taskhost.exe PID 2724 wrote to memory of 1152 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Explorer.EXE PID 2724 wrote to memory of 2128 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe DllHost.exe PID 2724 wrote to memory of 1064 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Dwm.exe PID 2724 wrote to memory of 1096 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe taskhost.exe PID 2724 wrote to memory of 1152 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Explorer.EXE PID 2724 wrote to memory of 2128 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe DllHost.exe PID 2724 wrote to memory of 1064 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Dwm.exe PID 2724 wrote to memory of 1096 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe taskhost.exe PID 2724 wrote to memory of 1152 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Explorer.EXE PID 2724 wrote to memory of 2128 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe DllHost.exe PID 2724 wrote to memory of 1064 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Dwm.exe PID 2724 wrote to memory of 1096 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe taskhost.exe PID 2724 wrote to memory of 1152 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Explorer.EXE PID 2724 wrote to memory of 2128 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe DllHost.exe PID 2724 wrote to memory of 1064 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Dwm.exe PID 2724 wrote to memory of 1096 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe taskhost.exe PID 2724 wrote to memory of 1152 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe Explorer.EXE PID 2724 wrote to memory of 2128 2724 小笨鸟万能论坛自动顶帖机软件1.3.exe DllHost.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
小笨鸟万能论坛自动顶帖机软件1.3.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 小笨鸟万能论坛自动顶帖机软件1.3.exe
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1064
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1096
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\小笨鸟万能论坛自动顶帖机软件 1.3破解版\小笨鸟万能论坛自动顶帖机软件1.3.exe"C:\Users\Admin\AppData\Local\Temp\小笨鸟万能论坛自动顶帖机软件 1.3破解版\小笨鸟万能论坛自动顶帖机软件1.3.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2724
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:2128
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
-
F:\ipehc.pifFilesize
100KB
MD5fa5e702d9b6ea0c18e910ee62d0bb513
SHA1a19f84c037fc4f160b0ddad78b8b89201b4d2f44
SHA25618fc93edf42bb964d57de1926f0b39a523e4103830934ffac806936793d4556a
SHA51209ee7a6ef5a18d28b031ef50bd352d1e83f741279edaae55d284f770e1fcef4ca26700a23545b6d14d8bceba31af31ca00996e2d297b010344340ee3b737a20b
-
memory/1064-63-0x0000000002010000-0x0000000002012000-memory.dmpFilesize
8KB
-
memory/2724-54-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2724-5-0x0000000002130000-0x00000000031BE000-memory.dmpFilesize
16.6MB
-
memory/2724-4-0x0000000002130000-0x00000000031BE000-memory.dmpFilesize
16.6MB
-
memory/2724-52-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2724-9-0x0000000002130000-0x00000000031BE000-memory.dmpFilesize
16.6MB
-
memory/2724-7-0x0000000002130000-0x00000000031BE000-memory.dmpFilesize
16.6MB
-
memory/2724-11-0x0000000002130000-0x00000000031BE000-memory.dmpFilesize
16.6MB
-
memory/2724-10-0x0000000002130000-0x00000000031BE000-memory.dmpFilesize
16.6MB
-
memory/2724-6-0x0000000002130000-0x00000000031BE000-memory.dmpFilesize
16.6MB
-
memory/2724-12-0x0000000002130000-0x00000000031BE000-memory.dmpFilesize
16.6MB
-
memory/2724-0-0x0000000000400000-0x00000000006A9000-memory.dmpFilesize
2.7MB
-
memory/2724-15-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2724-50-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2724-77-0x0000000005010000-0x0000000005011000-memory.dmpFilesize
4KB
-
memory/2724-1-0x0000000002130000-0x00000000031BE000-memory.dmpFilesize
16.6MB
-
memory/2724-62-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2724-61-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2724-60-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2724-58-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2724-56-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2724-13-0x0000000002130000-0x00000000031BE000-memory.dmpFilesize
16.6MB
-
memory/2724-8-0x0000000002130000-0x00000000031BE000-memory.dmpFilesize
16.6MB
-
memory/2724-76-0x0000000004FC0000-0x0000000004FC2000-memory.dmpFilesize
8KB
-
memory/2724-48-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2724-46-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2724-44-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2724-42-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2724-40-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2724-38-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2724-36-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2724-34-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2724-32-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2724-30-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2724-28-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2724-26-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2724-24-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2724-22-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2724-20-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2724-19-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2724-18-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2724-17-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2724-112-0x0000000002130000-0x00000000031BE000-memory.dmpFilesize
16.6MB
-
memory/2724-132-0x0000000004FC0000-0x0000000004FC2000-memory.dmpFilesize
8KB
-
memory/2724-2-0x0000000002130000-0x00000000031BE000-memory.dmpFilesize
16.6MB