Analysis
- max time kernel
136s - max time network
105s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
23/05/2024, 05:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
faad7ef1bc441fd7f8a5bea8728d8d491a71cd02fd10f170220b350beb002f3c.dll
Resource
win7-20240221-en
windows7-x64
17 signatures
150 seconds
General
- Target faad7ef1bc441fd7f8a5bea8728d8d491a71cd02fd10f170220b350beb002f3c.dll
- Size 120KB
- Sample240523-fre5raef85
- SHA256 faad7ef1bc441fd7f8a5bea8728d8d491a71cd02fd10f170220b350beb002f3c
- MD5 cc4573141109d400d08d76928212c401
- SHA1 09191a9fb538adcbb5ef5fcdc5dbda23f9922a20
- SHA512 6838b71fd003a6de46a22bb81f3a6d7a8538f757a0eef259739e91671b212d74fb205e2f7220e9f8232bf78dc0f2994900b3b6084155627e95a6c280d24cd239
- SSDEEP 3072:tcbCiNA4fWC6gPZkOiYjmBLjkGup1UQlmb5n:tMCiuHgxkOiYk3kGupi
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57322c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57322c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57349d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57349d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57349d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57322c.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57322c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57349d.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57322c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57349d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57349d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57322c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57322c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57322c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57322c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57322c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57349d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57349d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57349d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57349d.exe - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 33 IoCs
resource yara_rule behavioral2/memory/1200-8-0x00000000008A0000-0x000000000195A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1200-10-0x00000000008A0000-0x000000000195A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1200-13-0x00000000008A0000-0x000000000195A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1200-19-0x00000000008A0000-0x000000000195A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1200-20-0x00000000008A0000-0x000000000195A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1200-22-0x00000000008A0000-0x000000000195A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1200-12-0x00000000008A0000-0x000000000195A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1200-21-0x00000000008A0000-0x000000000195A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1200-11-0x00000000008A0000-0x000000000195A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1200-6-0x00000000008A0000-0x000000000195A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1200-37-0x00000000008A0000-0x000000000195A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1200-36-0x00000000008A0000-0x000000000195A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1200-38-0x00000000008A0000-0x000000000195A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1200-39-0x00000000008A0000-0x000000000195A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1200-40-0x00000000008A0000-0x000000000195A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1200-42-0x00000000008A0000-0x000000000195A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1200-43-0x00000000008A0000-0x000000000195A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1200-57-0x00000000008A0000-0x000000000195A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1200-59-0x00000000008A0000-0x000000000195A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1200-60-0x00000000008A0000-0x000000000195A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1200-62-0x00000000008A0000-0x000000000195A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1200-76-0x00000000008A0000-0x000000000195A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1200-79-0x00000000008A0000-0x000000000195A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1200-81-0x00000000008A0000-0x000000000195A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1200-82-0x00000000008A0000-0x000000000195A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1200-83-0x00000000008A0000-0x000000000195A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1200-84-0x00000000008A0000-0x000000000195A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1200-86-0x00000000008A0000-0x000000000195A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1200-94-0x00000000008A0000-0x000000000195A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1200-96-0x00000000008A0000-0x000000000195A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1200-100-0x00000000008A0000-0x000000000195A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4700-128-0x0000000000B50000-0x0000000001C0A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4700-141-0x0000000000B50000-0x0000000001C0A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 37 IoCs
resource yara_rule behavioral2/memory/1200-8-0x00000000008A0000-0x000000000195A000-memory.dmp UPX behavioral2/memory/1200-10-0x00000000008A0000-0x000000000195A000-memory.dmp UPX behavioral2/memory/1200-13-0x00000000008A0000-0x000000000195A000-memory.dmp UPX behavioral2/memory/1200-19-0x00000000008A0000-0x000000000195A000-memory.dmp UPX behavioral2/memory/1200-20-0x00000000008A0000-0x000000000195A000-memory.dmp UPX behavioral2/memory/1200-22-0x00000000008A0000-0x000000000195A000-memory.dmp UPX behavioral2/memory/1200-12-0x00000000008A0000-0x000000000195A000-memory.dmp UPX behavioral2/memory/1200-21-0x00000000008A0000-0x000000000195A000-memory.dmp UPX behavioral2/memory/1200-11-0x00000000008A0000-0x000000000195A000-memory.dmp UPX behavioral2/memory/1200-6-0x00000000008A0000-0x000000000195A000-memory.dmp UPX behavioral2/memory/1200-37-0x00000000008A0000-0x000000000195A000-memory.dmp UPX behavioral2/memory/1200-36-0x00000000008A0000-0x000000000195A000-memory.dmp UPX behavioral2/memory/1200-38-0x00000000008A0000-0x000000000195A000-memory.dmp UPX behavioral2/memory/1200-39-0x00000000008A0000-0x000000000195A000-memory.dmp UPX behavioral2/memory/1200-40-0x00000000008A0000-0x000000000195A000-memory.dmp UPX behavioral2/memory/1200-42-0x00000000008A0000-0x000000000195A000-memory.dmp UPX behavioral2/memory/1200-43-0x00000000008A0000-0x000000000195A000-memory.dmp UPX behavioral2/memory/1200-57-0x00000000008A0000-0x000000000195A000-memory.dmp UPX behavioral2/memory/1200-59-0x00000000008A0000-0x000000000195A000-memory.dmp UPX behavioral2/memory/1200-60-0x00000000008A0000-0x000000000195A000-memory.dmp UPX behavioral2/memory/1200-62-0x00000000008A0000-0x000000000195A000-memory.dmp UPX behavioral2/memory/1200-76-0x00000000008A0000-0x000000000195A000-memory.dmp UPX behavioral2/memory/1200-79-0x00000000008A0000-0x000000000195A000-memory.dmp UPX behavioral2/memory/1200-81-0x00000000008A0000-0x000000000195A000-memory.dmp UPX behavioral2/memory/1200-82-0x00000000008A0000-0x000000000195A000-memory.dmp UPX behavioral2/memory/1200-83-0x00000000008A0000-0x000000000195A000-memory.dmp UPX behavioral2/memory/1200-84-0x00000000008A0000-0x000000000195A000-memory.dmp UPX behavioral2/memory/1200-86-0x00000000008A0000-0x000000000195A000-memory.dmp UPX behavioral2/memory/1200-94-0x00000000008A0000-0x000000000195A000-memory.dmp UPX behavioral2/memory/1200-96-0x00000000008A0000-0x000000000195A000-memory.dmp UPX behavioral2/memory/1200-100-0x00000000008A0000-0x000000000195A000-memory.dmp UPX behavioral2/memory/1200-116-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4700-128-0x0000000000B50000-0x0000000001C0A000-memory.dmp UPX behavioral2/memory/4700-142-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4700-141-0x0000000000B50000-0x0000000001C0A000-memory.dmp UPX behavioral2/memory/444-150-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/2184-149-0x0000000000400000-0x0000000000412000-memory.dmp UPX - Executes dropped EXE 4 IoCs
pid Process 1200 e57322c.exe 4700 e57349d.exe 444 e574e01.exe 2184 e574e10.exe -
resource yara_rule behavioral2/memory/1200-8-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/1200-10-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/1200-13-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/1200-19-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/1200-20-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/1200-22-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/1200-12-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/1200-21-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/1200-11-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/1200-6-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/1200-37-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/1200-36-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/1200-38-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/1200-39-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/1200-40-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/1200-42-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/1200-43-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/1200-57-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/1200-59-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/1200-60-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/1200-62-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/1200-76-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/1200-79-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/1200-81-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/1200-82-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/1200-83-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/1200-84-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/1200-86-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/1200-94-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/1200-96-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/1200-100-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/4700-128-0x0000000000B50000-0x0000000001C0A000-memory.dmp upx behavioral2/memory/4700-141-0x0000000000B50000-0x0000000001C0A000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57349d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57349d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57322c.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57322c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57349d.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57349d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57322c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57322c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57322c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57322c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57322c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57349d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57349d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57349d.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57322c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57349d.exe - Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: e57322c.exe File opened (read-only) \??\K: e57322c.exe File opened (read-only) \??\G: e57322c.exe File opened (read-only) \??\H: e57322c.exe File opened (read-only) \??\J: e57322c.exe File opened (read-only) \??\P: e57322c.exe File opened (read-only) \??\R: e57322c.exe File opened (read-only) \??\L: e57322c.exe File opened (read-only) \??\M: e57322c.exe File opened (read-only) \??\Q: e57322c.exe File opened (read-only) \??\S: e57322c.exe File opened (read-only) \??\E: e57322c.exe File opened (read-only) \??\N: e57322c.exe File opened (read-only) \??\O: e57322c.exe - Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7zG.exe e57322c.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe e57322c.exe File opened for modification C:\Program Files\7-Zip\7z.exe e57322c.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e57322c.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e573289 e57322c.exe File opened for modification C:\Windows\SYSTEM.INI e57322c.exe File created C:\Windows\e57833a e57349d.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1200 e57322c.exe 1200 e57322c.exe 1200 e57322c.exe 1200 e57322c.exe 4700 e57349d.exe 4700 e57349d.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe Token: SeDebugPrivilege 1200 e57322c.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2444 wrote to memory of 4800 2444 rundll32.exe 82 PID 2444 wrote to memory of 4800 2444 rundll32.exe 82 PID 2444 wrote to memory of 4800 2444 rundll32.exe 82 PID 4800 wrote to memory of 1200 4800 rundll32.exe 83 PID 4800 wrote to memory of 1200 4800 rundll32.exe 83 PID 4800 wrote to memory of 1200 4800 rundll32.exe 83 PID 1200 wrote to memory of 756 1200 e57322c.exe 8 PID 1200 wrote to memory of 764 1200 e57322c.exe 9 PID 1200 wrote to memory of 336 1200 e57322c.exe 13 PID 1200 wrote to memory of 2912 1200 e57322c.exe 50 PID 1200 wrote to memory of 2984 1200 e57322c.exe 51 PID 1200 wrote to memory of 2848 1200 e57322c.exe 53 PID 1200 wrote to memory of 3432 1200 e57322c.exe 56 PID 1200 wrote to memory of 3576 1200 e57322c.exe 57 PID 1200 wrote to memory of 3756 1200 e57322c.exe 58 PID 1200 wrote to memory of 3856 1200 e57322c.exe 59 PID 1200 wrote to memory of 3920 1200 e57322c.exe 60 PID 1200 wrote to memory of 4004 1200 e57322c.exe 61 PID 1200 wrote to memory of 3692 1200 e57322c.exe 62 PID 1200 wrote to memory of 1904 1200 e57322c.exe 73 PID 1200 wrote to memory of 4280 1200 e57322c.exe 74 PID 1200 wrote to memory of 708 1200 e57322c.exe 79 PID 1200 wrote to memory of 4172 1200 e57322c.exe 80 PID 1200 wrote to memory of 2444 1200 e57322c.exe 81 PID 1200 wrote to memory of 4800 1200 e57322c.exe 82 PID 1200 wrote to memory of 4800 1200 e57322c.exe 82 PID 4800 wrote to memory of 4700 4800 rundll32.exe 84 PID 4800 wrote to memory of 4700 4800 rundll32.exe 84 PID 4800 wrote to memory of 4700 4800 rundll32.exe 84 PID 4800 wrote to memory of 444 4800 rundll32.exe 96 PID 4800 wrote to memory of 444 4800 rundll32.exe 96 PID 4800 wrote to memory of 444 4800 rundll32.exe 96 PID 4800 wrote to memory of 2184 4800 rundll32.exe 97 PID 4800 wrote to memory of 2184 4800 rundll32.exe 97 PID 4800 wrote to memory of 2184 4800 rundll32.exe 97 PID 1200 wrote to memory of 756 1200 e57322c.exe 8 PID 1200 wrote to memory of 764 1200 e57322c.exe 9 PID 1200 wrote to memory of 336 1200 e57322c.exe 13 PID 1200 wrote to memory of 2912 1200 e57322c.exe 50 PID 1200 wrote to memory of 2984 1200 e57322c.exe 51 PID 1200 wrote to memory of 2848 1200 e57322c.exe 53 PID 1200 wrote to memory of 3432 1200 e57322c.exe 56 PID 1200 wrote to memory of 3576 1200 e57322c.exe 57 PID 1200 wrote to memory of 3756 1200 e57322c.exe 58 PID 1200 wrote to memory of 3856 1200 e57322c.exe 59 PID 1200 wrote to memory of 3920 1200 e57322c.exe 60 PID 1200 wrote to memory of 4004 1200 e57322c.exe 61 PID 1200 wrote to memory of 3692 1200 e57322c.exe 62 PID 1200 wrote to memory of 1904 1200 e57322c.exe 73 PID 1200 wrote to memory of 4280 1200 e57322c.exe 74 PID 1200 wrote to memory of 708 1200 e57322c.exe 79 PID 1200 wrote to memory of 4700 1200 e57322c.exe 84 PID 1200 wrote to memory of 4700 1200 e57322c.exe 84 PID 1200 wrote to memory of 2352 1200 e57322c.exe 86 PID 1200 wrote to memory of 316 1200 e57322c.exe 87 PID 1200 wrote to memory of 444 1200 e57322c.exe 96 PID 1200 wrote to memory of 444 1200 e57322c.exe 96 PID 1200 wrote to memory of 2184 1200 e57322c.exe 97 PID 1200 wrote to memory of 2184 1200 e57322c.exe 97 PID 4700 wrote to memory of 756 4700 e57349d.exe 8 PID 4700 wrote to memory of 764 4700 e57349d.exe 9 PID 4700 wrote to memory of 336 4700 e57349d.exe 13 PID 4700 wrote to memory of 2912 4700 e57349d.exe 50 PID 4700 wrote to memory of 2984 4700 e57349d.exe 51 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57322c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57349d.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:756
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:764
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:336
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2912
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2984
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2848
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3432
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\faad7ef1bc441fd7f8a5bea8728d8d491a71cd02fd10f170220b350beb002f3c.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\faad7ef1bc441fd7f8a5bea8728d8d491a71cd02fd10f170220b350beb002f3c.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\e57322c.exeC:\Users\Admin\AppData\Local\Temp\e57322c.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1200
-
-
C:\Users\Admin\AppData\Local\Temp\e57349d.exeC:\Users\Admin\AppData\Local\Temp\e57349d.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4700
-
-
C:\Users\Admin\AppData\Local\Temp\e574e01.exeC:\Users\Admin\AppData\Local\Temp\e574e01.exe4⤵
- Executes dropped EXE
PID:444
-
-
C:\Users\Admin\AppData\Local\Temp\e574e10.exeC:\Users\Admin\AppData\Local\Temp\e574e10.exe4⤵
- Executes dropped EXE
PID:2184
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3576
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3756
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3856
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3920
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4004
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3692
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:1904
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4280
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:708
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:4172
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2352
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:316
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\e57322c.exe
- Size 97KB
- SHA256 d9c1de4d036a333112f9f74a767231e98157742b4ee2ff91555704e0eabed233
- MD5 f17ab6f33bd0018ab7261ac63453509d
- SHA1 03174fa580879f4bc1388dd1068290d6b58b54c5
- SHA512 b53ed786e0e4746b27a182a9e5a89638fa515f9ee35b8f465ca5f2146e7564e13692ca1edf9926655a140705a36fe9d5ec3b294426dc5d1cb765deef58f07e02
- SSDEEP 1536:W3UXQELZ3A6LsLZ96QevjSGM0sYf6EBU4BX4AaUXBCSQIDZ/n8k:u5uA6LsLZ9QLSPYf6EjX4HUx8I
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SYSTEM.INI
- Size 257B
- SHA256 b6b3291534dc81c6dd09e6c17cc7ce6ca0b2a5c0da5c97e34f84b3f9a4839127
- MD5 917eb2eef87263e49b21ea6bb8136f0e
- SHA1 2311b54ac50ecaf8cb2ff7ef253e6785cd3fb58b
- SHA512 876d15d52af3dc32912b450c32ca3bcf0ababd7b2bdf60dadd36c33e172631fb645b596edc97612871555f42983ade068822ecc7935f44eadcd2441101dad961
- MD5 SHA1 SHA512