Analysis
-
max time kernel
147s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 09:18
Static task
static1
Behavioral task
behavioral1
Sample
e656f9518fd583d55867d46db0592c7a729073e682612ab5d46dd68cd7047c98.dll
Resource
win7-20231129-en
General
-
Target
e656f9518fd583d55867d46db0592c7a729073e682612ab5d46dd68cd7047c98.dll
-
Size
120KB
-
MD5
52111a3a8f0fe04023b9f7aa4d7f6c83
-
SHA1
4616cb7ebbecc822203895504201b21c46be6357
-
SHA256
e656f9518fd583d55867d46db0592c7a729073e682612ab5d46dd68cd7047c98
-
SHA512
6f5eff69474fad46c45bd5b8369bdbae576587e1a84c6fd8857b995050e9e7ac7ba7f67930c9f0a04823a49e1c2dd7b31704be3529ee356fe005d9c5df6c66d6
-
SSDEEP
3072:mMk1Af3JL9CU2bs99NLHeOHmjfPgQePRVE:QWxeo995HyDZaVE
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 9 IoCs
Processes:
e577520.exee574759.exee574a28.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e577520.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e574759.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e574759.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e574a28.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e574a28.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e574a28.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e574759.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e577520.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e577520.exe -
Processes:
e577520.exee574759.exee574a28.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e577520.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e574759.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e574a28.exe -
Processes:
e574759.exee574a28.exee577520.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e574759.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e574759.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e574a28.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e577520.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e577520.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e574759.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e574759.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e574759.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e574a28.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e577520.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e574759.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e574a28.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e574a28.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e577520.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e577520.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e577520.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e574a28.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e574a28.exe -
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 29 IoCs
Processes:
resource yara_rule behavioral2/memory/100-9-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/100-8-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/100-10-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/100-12-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/100-14-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/100-11-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/100-20-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/100-22-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/100-21-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/100-13-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/100-37-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/100-36-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/100-38-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/100-39-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/100-40-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/100-46-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/100-60-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/100-61-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/100-62-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/100-64-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/100-66-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/100-68-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/100-71-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/100-72-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/100-74-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2104-94-0x0000000000B40000-0x0000000001BFA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2104-96-0x0000000000B40000-0x0000000001BFA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2104-110-0x0000000000B40000-0x0000000001BFA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2104-129-0x0000000000B40000-0x0000000001BFA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine -
UPX dump on OEP (original entry point) 36 IoCs
Processes:
resource yara_rule behavioral2/memory/100-5-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/100-9-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/100-8-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/100-10-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/100-12-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/100-14-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/100-11-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/100-20-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/2104-35-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/100-22-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/100-21-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/100-13-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/100-37-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/100-36-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/100-38-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/100-39-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/100-40-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/100-46-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/4472-53-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/100-60-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/100-61-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/100-62-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/100-64-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/100-66-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/100-68-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/100-71-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/100-72-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/100-74-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/100-93-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/2104-94-0x0000000000B40000-0x0000000001BFA000-memory.dmp UPX behavioral2/memory/2104-96-0x0000000000B40000-0x0000000001BFA000-memory.dmp UPX behavioral2/memory/2104-110-0x0000000000B40000-0x0000000001BFA000-memory.dmp UPX behavioral2/memory/2104-130-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/2104-129-0x0000000000B40000-0x0000000001BFA000-memory.dmp UPX behavioral2/memory/4472-158-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4732-162-0x0000000000400000-0x0000000000412000-memory.dmp UPX -
Executes dropped EXE 4 IoCs
Processes:
e574759.exee574a28.exee577520.exee57753f.exepid process 100 e574759.exe 2104 e574a28.exe 4472 e577520.exe 4732 e57753f.exe -
Processes:
resource yara_rule behavioral2/memory/100-9-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/100-8-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/100-10-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/100-12-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/100-14-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/100-11-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/100-20-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/100-22-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/100-21-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/100-13-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/100-37-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/100-36-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/100-38-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/100-39-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/100-40-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/100-46-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/100-60-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/100-61-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/100-62-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/100-64-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/100-66-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/100-68-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/100-71-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/100-72-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/100-74-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/2104-94-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx behavioral2/memory/2104-96-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx behavioral2/memory/2104-110-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx behavioral2/memory/2104-129-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx -
Processes:
e577520.exee574759.exee574a28.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e577520.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e577520.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e577520.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e574759.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e574a28.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e574a28.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e574759.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e574759.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e574a28.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e574a28.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e574a28.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e574a28.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e577520.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e574759.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e574759.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e574759.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e577520.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e577520.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e574759.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e574a28.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e577520.exe -
Processes:
e574759.exee574a28.exee577520.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e574759.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e574a28.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e577520.exe -
Enumerates connected drives 3 TTPs 9 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
e574759.exedescription ioc process File opened (read-only) \??\K: e574759.exe File opened (read-only) \??\L: e574759.exe File opened (read-only) \??\M: e574759.exe File opened (read-only) \??\E: e574759.exe File opened (read-only) \??\G: e574759.exe File opened (read-only) \??\H: e574759.exe File opened (read-only) \??\I: e574759.exe File opened (read-only) \??\J: e574759.exe File opened (read-only) \??\N: e574759.exe -
Drops file in Windows directory 4 IoCs
Processes:
e577520.exee574759.exee574a28.exedescription ioc process File created C:\Windows\e57c1aa e577520.exe File created C:\Windows\e5747c7 e574759.exe File opened for modification C:\Windows\SYSTEM.INI e574759.exe File created C:\Windows\e579923 e574a28.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
e574759.exee574a28.exee577520.exepid process 100 e574759.exe 100 e574759.exe 100 e574759.exe 100 e574759.exe 2104 e574a28.exe 2104 e574a28.exe 4472 e577520.exe 4472 e577520.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
e574759.exedescription pid process Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe Token: SeDebugPrivilege 100 e574759.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
rundll32.exerundll32.exee574759.exee574a28.exedescription pid process target process PID 432 wrote to memory of 1692 432 rundll32.exe rundll32.exe PID 432 wrote to memory of 1692 432 rundll32.exe rundll32.exe PID 432 wrote to memory of 1692 432 rundll32.exe rundll32.exe PID 1692 wrote to memory of 100 1692 rundll32.exe e574759.exe PID 1692 wrote to memory of 100 1692 rundll32.exe e574759.exe PID 1692 wrote to memory of 100 1692 rundll32.exe e574759.exe PID 100 wrote to memory of 788 100 e574759.exe fontdrvhost.exe PID 100 wrote to memory of 796 100 e574759.exe fontdrvhost.exe PID 100 wrote to memory of 68 100 e574759.exe dwm.exe PID 100 wrote to memory of 2552 100 e574759.exe sihost.exe PID 100 wrote to memory of 2564 100 e574759.exe svchost.exe PID 100 wrote to memory of 2820 100 e574759.exe taskhostw.exe PID 100 wrote to memory of 3488 100 e574759.exe Explorer.EXE PID 100 wrote to memory of 3632 100 e574759.exe svchost.exe PID 100 wrote to memory of 3808 100 e574759.exe DllHost.exe PID 100 wrote to memory of 3908 100 e574759.exe StartMenuExperienceHost.exe PID 100 wrote to memory of 3972 100 e574759.exe RuntimeBroker.exe PID 100 wrote to memory of 4048 100 e574759.exe SearchApp.exe PID 100 wrote to memory of 4208 100 e574759.exe RuntimeBroker.exe PID 100 wrote to memory of 4600 100 e574759.exe RuntimeBroker.exe PID 100 wrote to memory of 4716 100 e574759.exe TextInputHost.exe PID 100 wrote to memory of 4460 100 e574759.exe backgroundTaskHost.exe PID 100 wrote to memory of 3584 100 e574759.exe backgroundTaskHost.exe PID 100 wrote to memory of 432 100 e574759.exe rundll32.exe PID 100 wrote to memory of 1692 100 e574759.exe rundll32.exe PID 100 wrote to memory of 1692 100 e574759.exe rundll32.exe PID 1692 wrote to memory of 2104 1692 rundll32.exe e574a28.exe PID 1692 wrote to memory of 2104 1692 rundll32.exe e574a28.exe PID 1692 wrote to memory of 2104 1692 rundll32.exe e574a28.exe PID 100 wrote to memory of 788 100 e574759.exe fontdrvhost.exe PID 100 wrote to memory of 796 100 e574759.exe fontdrvhost.exe PID 100 wrote to memory of 68 100 e574759.exe dwm.exe PID 100 wrote to memory of 2552 100 e574759.exe sihost.exe PID 100 wrote to memory of 2564 100 e574759.exe svchost.exe PID 100 wrote to memory of 2820 100 e574759.exe taskhostw.exe PID 100 wrote to memory of 3488 100 e574759.exe Explorer.EXE PID 100 wrote to memory of 3632 100 e574759.exe svchost.exe PID 100 wrote to memory of 3808 100 e574759.exe DllHost.exe PID 100 wrote to memory of 3908 100 e574759.exe StartMenuExperienceHost.exe PID 100 wrote to memory of 3972 100 e574759.exe RuntimeBroker.exe PID 100 wrote to memory of 4048 100 e574759.exe SearchApp.exe PID 100 wrote to memory of 4208 100 e574759.exe RuntimeBroker.exe PID 100 wrote to memory of 4600 100 e574759.exe RuntimeBroker.exe PID 100 wrote to memory of 4716 100 e574759.exe TextInputHost.exe PID 100 wrote to memory of 4460 100 e574759.exe backgroundTaskHost.exe PID 100 wrote to memory of 3584 100 e574759.exe backgroundTaskHost.exe PID 100 wrote to memory of 432 100 e574759.exe rundll32.exe PID 100 wrote to memory of 2104 100 e574759.exe e574a28.exe PID 100 wrote to memory of 2104 100 e574759.exe e574a28.exe PID 100 wrote to memory of 4656 100 e574759.exe RuntimeBroker.exe PID 100 wrote to memory of 1876 100 e574759.exe RuntimeBroker.exe PID 1692 wrote to memory of 4472 1692 rundll32.exe e577520.exe PID 1692 wrote to memory of 4472 1692 rundll32.exe e577520.exe PID 1692 wrote to memory of 4472 1692 rundll32.exe e577520.exe PID 1692 wrote to memory of 4732 1692 rundll32.exe e57753f.exe PID 1692 wrote to memory of 4732 1692 rundll32.exe e57753f.exe PID 1692 wrote to memory of 4732 1692 rundll32.exe e57753f.exe PID 2104 wrote to memory of 788 2104 e574a28.exe fontdrvhost.exe PID 2104 wrote to memory of 796 2104 e574a28.exe fontdrvhost.exe PID 2104 wrote to memory of 68 2104 e574a28.exe dwm.exe PID 2104 wrote to memory of 2552 2104 e574a28.exe sihost.exe PID 2104 wrote to memory of 2564 2104 e574a28.exe svchost.exe PID 2104 wrote to memory of 2820 2104 e574a28.exe taskhostw.exe PID 2104 wrote to memory of 3488 2104 e574a28.exe Explorer.EXE -
System policy modification 1 TTPs 3 IoCs
Processes:
e574759.exee574a28.exee577520.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e574759.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e574a28.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e577520.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e656f9518fd583d55867d46db0592c7a729073e682612ab5d46dd68cd7047c98.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e656f9518fd583d55867d46db0592c7a729073e682612ab5d46dd68cd7047c98.dll,#13⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e574759.exeC:\Users\Admin\AppData\Local\Temp\e574759.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\e574a28.exeC:\Users\Admin\AppData\Local\Temp\e574a28.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\e577520.exeC:\Users\Admin\AppData\Local\Temp\e577520.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\e57753f.exeC:\Users\Admin\AppData\Local\Temp\e57753f.exe4⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\e574759.exeFilesize
97KB
MD5e92c5fdcf6968e9ae5a22638ad387711
SHA1a67eb0b3699d5e22d9b76bc52578ac0a40351336
SHA256518f5bcd24161f6a37b68797e3d2625e16ac8029af72ae574f3af4c1fd7c05d4
SHA512f88465eb5facd7d1bfd0a85768f3e2f3934c03c7812d9d12cb7cab2636cbeee11b7c4f0b5c4f0b7fe879e9b0c01220c4a808c777ee8edf97deeba394be69f0f5
-
C:\Windows\SYSTEM.INIFilesize
257B
MD589ee7b5ab3fd51e45be1d74dcba98cc4
SHA1a5e2b54c75a91318027be987e22de0c037d1908e
SHA256577a72e8e56996b60f9d69ea167687f40d60a8a85b9948eb3b76a6fe1e5687bf
SHA512e20ea77a73e3a4f2d373c61faaf77ed91c36a425f5ebc77ca1a65f3bb343a8c88115110f9100066885d9222dd1792f3e452dfa16189d32327c03103728da4c58
-
memory/100-71-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/100-12-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/100-5-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/100-10-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/100-93-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/100-14-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/100-11-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/100-20-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/100-81-0x0000000003660000-0x0000000003662000-memory.dmpFilesize
8KB
-
memory/100-32-0x0000000003660000-0x0000000003662000-memory.dmpFilesize
8KB
-
memory/100-74-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/100-22-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/100-31-0x0000000003660000-0x0000000003662000-memory.dmpFilesize
8KB
-
memory/100-21-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/100-27-0x0000000004370000-0x0000000004371000-memory.dmpFilesize
4KB
-
memory/100-72-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/100-68-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/100-66-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/100-13-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/100-37-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/100-36-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/100-38-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/100-39-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/100-40-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/100-8-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/100-9-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/100-64-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/100-46-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/100-62-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/100-61-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/100-60-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/1692-28-0x0000000001380000-0x0000000001382000-memory.dmpFilesize
8KB
-
memory/1692-1-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/1692-55-0x0000000001380000-0x0000000001382000-memory.dmpFilesize
8KB
-
memory/1692-25-0x0000000001380000-0x0000000001382000-memory.dmpFilesize
8KB
-
memory/1692-23-0x0000000001380000-0x0000000001382000-memory.dmpFilesize
8KB
-
memory/1692-24-0x0000000004760000-0x0000000004761000-memory.dmpFilesize
4KB
-
memory/2104-129-0x0000000000B40000-0x0000000001BFA000-memory.dmpFilesize
16.7MB
-
memory/2104-43-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/2104-94-0x0000000000B40000-0x0000000001BFA000-memory.dmpFilesize
16.7MB
-
memory/2104-96-0x0000000000B40000-0x0000000001BFA000-memory.dmpFilesize
16.7MB
-
memory/2104-44-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/2104-110-0x0000000000B40000-0x0000000001BFA000-memory.dmpFilesize
16.7MB
-
memory/2104-130-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2104-35-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2104-45-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/4472-53-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4472-158-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4732-162-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4732-58-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB