Analysis
-
max time kernel
119s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 18:22
Static task
static1
Behavioral task
behavioral1
Sample
0808f9fb3cdb3932e3b4de7aeba8ea30853256d971775b4f53b5e44ecc71ae72.dll
Resource
win7-20240221-en
General
-
Target
0808f9fb3cdb3932e3b4de7aeba8ea30853256d971775b4f53b5e44ecc71ae72.dll
-
Size
120KB
-
MD5
9e2848acb03242935eb9d5f43a262003
-
SHA1
5f04922e3c4faa54a02fc90da2b090f91140a678
-
SHA256
0808f9fb3cdb3932e3b4de7aeba8ea30853256d971775b4f53b5e44ecc71ae72
-
SHA512
d301925ba2d4579c6e166cd1613adb3150f184869f3bc4fff4bfaccbcd0b0c58a55063c1419e41539c875c97fb65258495142a97214866850b7af293db1082f4
-
SSDEEP
3072:cmUgU+05Had14JkBBqQneW0UEAtmwZGErb:vUgUDHyogeKhZdn
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
f767acb.exef76783c.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f767acb.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f767acb.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76783c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76783c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76783c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f767acb.exe -
Processes:
f76783c.exef767acb.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76783c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f767acb.exe -
Processes:
f76783c.exef767acb.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76783c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f767acb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f767acb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f767acb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76783c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76783c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76783c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f767acb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f767acb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f767acb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76783c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76783c.exe -
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 24 IoCs
Processes:
resource yara_rule behavioral1/memory/2052-15-0x0000000000560000-0x000000000161A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2052-20-0x0000000000560000-0x000000000161A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2052-22-0x0000000000560000-0x000000000161A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2052-40-0x0000000000560000-0x000000000161A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2052-21-0x0000000000560000-0x000000000161A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2052-19-0x0000000000560000-0x000000000161A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2052-18-0x0000000000560000-0x000000000161A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2052-17-0x0000000000560000-0x000000000161A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2052-14-0x0000000000560000-0x000000000161A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2052-16-0x0000000000560000-0x000000000161A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2052-62-0x0000000000560000-0x000000000161A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2052-61-0x0000000000560000-0x000000000161A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2052-63-0x0000000000560000-0x000000000161A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2052-65-0x0000000000560000-0x000000000161A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2052-64-0x0000000000560000-0x000000000161A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2052-67-0x0000000000560000-0x000000000161A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2052-81-0x0000000000560000-0x000000000161A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2052-82-0x0000000000560000-0x000000000161A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2052-83-0x0000000000560000-0x000000000161A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2052-86-0x0000000000560000-0x000000000161A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2052-106-0x0000000000560000-0x000000000161A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2052-151-0x0000000000560000-0x000000000161A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2516-167-0x0000000000920000-0x00000000019DA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2516-175-0x0000000000920000-0x00000000019DA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine -
UPX dump on OEP (original entry point) 29 IoCs
Processes:
resource yara_rule behavioral1/memory/2052-11-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/2516-53-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/2052-15-0x0000000000560000-0x000000000161A000-memory.dmp UPX behavioral1/memory/2052-20-0x0000000000560000-0x000000000161A000-memory.dmp UPX behavioral1/memory/2052-22-0x0000000000560000-0x000000000161A000-memory.dmp UPX behavioral1/memory/2052-40-0x0000000000560000-0x000000000161A000-memory.dmp UPX behavioral1/memory/2052-21-0x0000000000560000-0x000000000161A000-memory.dmp UPX behavioral1/memory/2052-19-0x0000000000560000-0x000000000161A000-memory.dmp UPX behavioral1/memory/2052-18-0x0000000000560000-0x000000000161A000-memory.dmp UPX behavioral1/memory/2052-17-0x0000000000560000-0x000000000161A000-memory.dmp UPX behavioral1/memory/2052-14-0x0000000000560000-0x000000000161A000-memory.dmp UPX behavioral1/memory/2052-16-0x0000000000560000-0x000000000161A000-memory.dmp UPX behavioral1/memory/2052-62-0x0000000000560000-0x000000000161A000-memory.dmp UPX behavioral1/memory/2052-61-0x0000000000560000-0x000000000161A000-memory.dmp UPX behavioral1/memory/2052-63-0x0000000000560000-0x000000000161A000-memory.dmp UPX behavioral1/memory/2052-65-0x0000000000560000-0x000000000161A000-memory.dmp UPX behavioral1/memory/2052-64-0x0000000000560000-0x000000000161A000-memory.dmp UPX behavioral1/memory/2052-67-0x0000000000560000-0x000000000161A000-memory.dmp UPX behavioral1/memory/2052-81-0x0000000000560000-0x000000000161A000-memory.dmp UPX behavioral1/memory/2052-82-0x0000000000560000-0x000000000161A000-memory.dmp UPX behavioral1/memory/2052-83-0x0000000000560000-0x000000000161A000-memory.dmp UPX behavioral1/memory/2052-86-0x0000000000560000-0x000000000161A000-memory.dmp UPX behavioral1/memory/2052-106-0x0000000000560000-0x000000000161A000-memory.dmp UPX behavioral1/memory/2052-152-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/2052-151-0x0000000000560000-0x000000000161A000-memory.dmp UPX behavioral1/memory/2516-167-0x0000000000920000-0x00000000019DA000-memory.dmp UPX behavioral1/memory/2516-176-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/2516-175-0x0000000000920000-0x00000000019DA000-memory.dmp UPX behavioral1/memory/2776-180-0x0000000000400000-0x0000000000412000-memory.dmp UPX -
Executes dropped EXE 3 IoCs
Processes:
f76783c.exef767acb.exef76935a.exepid process 2052 f76783c.exe 2516 f767acb.exe 2776 f76935a.exe -
Loads dropped DLL 6 IoCs
Processes:
rundll32.exepid process 2036 rundll32.exe 2036 rundll32.exe 2036 rundll32.exe 2036 rundll32.exe 2036 rundll32.exe 2036 rundll32.exe -
Processes:
resource yara_rule behavioral1/memory/2052-15-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2052-20-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2052-22-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2052-40-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2052-21-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2052-19-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2052-18-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2052-17-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2052-14-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2052-16-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2052-62-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2052-61-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2052-63-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2052-65-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2052-64-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2052-67-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2052-81-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2052-82-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2052-83-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2052-86-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2052-106-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2052-151-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2516-167-0x0000000000920000-0x00000000019DA000-memory.dmp upx behavioral1/memory/2516-175-0x0000000000920000-0x00000000019DA000-memory.dmp upx -
Processes:
f767acb.exef76783c.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f767acb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f767acb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76783c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76783c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76783c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f767acb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76783c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f767acb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76783c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76783c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f767acb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f767acb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76783c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f767acb.exe -
Processes:
f76783c.exef767acb.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76783c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f767acb.exe -
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
f76783c.exedescription ioc process File opened (read-only) \??\N: f76783c.exe File opened (read-only) \??\R: f76783c.exe File opened (read-only) \??\S: f76783c.exe File opened (read-only) \??\E: f76783c.exe File opened (read-only) \??\G: f76783c.exe File opened (read-only) \??\H: f76783c.exe File opened (read-only) \??\K: f76783c.exe File opened (read-only) \??\M: f76783c.exe File opened (read-only) \??\P: f76783c.exe File opened (read-only) \??\I: f76783c.exe File opened (read-only) \??\J: f76783c.exe File opened (read-only) \??\L: f76783c.exe File opened (read-only) \??\O: f76783c.exe File opened (read-only) \??\Q: f76783c.exe -
Drops file in Windows directory 3 IoCs
Processes:
f76783c.exef767acb.exedescription ioc process File created C:\Windows\f767907 f76783c.exe File opened for modification C:\Windows\SYSTEM.INI f76783c.exe File created C:\Windows\f76c996 f767acb.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
f76783c.exepid process 2052 f76783c.exe 2052 f76783c.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
Processes:
f76783c.exedescription pid process Token: SeDebugPrivilege 2052 f76783c.exe Token: SeDebugPrivilege 2052 f76783c.exe Token: SeDebugPrivilege 2052 f76783c.exe Token: SeDebugPrivilege 2052 f76783c.exe Token: SeDebugPrivilege 2052 f76783c.exe Token: SeDebugPrivilege 2052 f76783c.exe Token: SeDebugPrivilege 2052 f76783c.exe Token: SeDebugPrivilege 2052 f76783c.exe Token: SeDebugPrivilege 2052 f76783c.exe Token: SeDebugPrivilege 2052 f76783c.exe Token: SeDebugPrivilege 2052 f76783c.exe Token: SeDebugPrivilege 2052 f76783c.exe Token: SeDebugPrivilege 2052 f76783c.exe Token: SeDebugPrivilege 2052 f76783c.exe Token: SeDebugPrivilege 2052 f76783c.exe Token: SeDebugPrivilege 2052 f76783c.exe Token: SeDebugPrivilege 2052 f76783c.exe Token: SeDebugPrivilege 2052 f76783c.exe Token: SeDebugPrivilege 2052 f76783c.exe Token: SeDebugPrivilege 2052 f76783c.exe Token: SeDebugPrivilege 2052 f76783c.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
rundll32.exerundll32.exef76783c.exedescription pid process target process PID 2804 wrote to memory of 2036 2804 rundll32.exe rundll32.exe PID 2804 wrote to memory of 2036 2804 rundll32.exe rundll32.exe PID 2804 wrote to memory of 2036 2804 rundll32.exe rundll32.exe PID 2804 wrote to memory of 2036 2804 rundll32.exe rundll32.exe PID 2804 wrote to memory of 2036 2804 rundll32.exe rundll32.exe PID 2804 wrote to memory of 2036 2804 rundll32.exe rundll32.exe PID 2804 wrote to memory of 2036 2804 rundll32.exe rundll32.exe PID 2036 wrote to memory of 2052 2036 rundll32.exe f76783c.exe PID 2036 wrote to memory of 2052 2036 rundll32.exe f76783c.exe PID 2036 wrote to memory of 2052 2036 rundll32.exe f76783c.exe PID 2036 wrote to memory of 2052 2036 rundll32.exe f76783c.exe PID 2052 wrote to memory of 1256 2052 f76783c.exe taskhost.exe PID 2052 wrote to memory of 1352 2052 f76783c.exe Dwm.exe PID 2052 wrote to memory of 1396 2052 f76783c.exe Explorer.EXE PID 2052 wrote to memory of 2180 2052 f76783c.exe DllHost.exe PID 2052 wrote to memory of 2804 2052 f76783c.exe rundll32.exe PID 2052 wrote to memory of 2036 2052 f76783c.exe rundll32.exe PID 2052 wrote to memory of 2036 2052 f76783c.exe rundll32.exe PID 2036 wrote to memory of 2516 2036 rundll32.exe f767acb.exe PID 2036 wrote to memory of 2516 2036 rundll32.exe f767acb.exe PID 2036 wrote to memory of 2516 2036 rundll32.exe f767acb.exe PID 2036 wrote to memory of 2516 2036 rundll32.exe f767acb.exe PID 2036 wrote to memory of 2776 2036 rundll32.exe f76935a.exe PID 2036 wrote to memory of 2776 2036 rundll32.exe f76935a.exe PID 2036 wrote to memory of 2776 2036 rundll32.exe f76935a.exe PID 2036 wrote to memory of 2776 2036 rundll32.exe f76935a.exe PID 2052 wrote to memory of 1256 2052 f76783c.exe taskhost.exe PID 2052 wrote to memory of 1352 2052 f76783c.exe Dwm.exe PID 2052 wrote to memory of 1396 2052 f76783c.exe Explorer.EXE PID 2052 wrote to memory of 2516 2052 f76783c.exe f767acb.exe PID 2052 wrote to memory of 2516 2052 f76783c.exe f767acb.exe PID 2052 wrote to memory of 2776 2052 f76783c.exe f76935a.exe PID 2052 wrote to memory of 2776 2052 f76783c.exe f76935a.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
f76783c.exef767acb.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76783c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f767acb.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0808f9fb3cdb3932e3b4de7aeba8ea30853256d971775b4f53b5e44ecc71ae72.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0808f9fb3cdb3932e3b4de7aeba8ea30853256d971775b4f53b5e44ecc71ae72.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f76783c.exeC:\Users\Admin\AppData\Local\Temp\f76783c.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\f767acb.exeC:\Users\Admin\AppData\Local\Temp\f767acb.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\f76935a.exeC:\Users\Admin\AppData\Local\Temp\f76935a.exe4⤵
- Executes dropped EXE
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SYSTEM.INIFilesize
257B
MD56c75ee7e224a7972a4d8da274b4ffb4e
SHA12b71f5e3a91463d77ff2c6f640a2f71925fe772d
SHA256c3770a397632ca7799cc89f428a202583e32aad6b3f24dd7415ef531d2226bea
SHA512a642a1a2263e796909c9d28b244fac6facd57dc132243eccbd745520dcbd2446cdc4de40c221fc0e6f92c17765181c8199da27c218f99670d7412c4fd94fab60
-
\Users\Admin\AppData\Local\Temp\f76783c.exeFilesize
97KB
MD5ec80423a5bbcba53b0ec513b4eff2fa1
SHA1948f79e8fa3896c47beb7a50337c2047de445509
SHA256492de8f9053fa33ab0b0a4647a058361b62c189e396c007bc4d70425f51b8e41
SHA5122b2c86aad86f06cecc63ac6ec49b33014415ccc103ff9260f49856388d0590f085f0f015ffcc851fadb1dd867bdfa4a080ceffc286fbd307d4fa9f119ad733bd
-
memory/1256-23-0x00000000000E0000-0x00000000000E2000-memory.dmpFilesize
8KB
-
memory/2036-75-0x00000000001C0000-0x00000000001C2000-memory.dmpFilesize
8KB
-
memory/2036-10-0x0000000000130000-0x0000000000142000-memory.dmpFilesize
72KB
-
memory/2036-49-0x00000000001C0000-0x00000000001C2000-memory.dmpFilesize
8KB
-
memory/2036-31-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/2036-51-0x00000000001C0000-0x00000000001C2000-memory.dmpFilesize
8KB
-
memory/2036-50-0x00000000001E0000-0x00000000001F2000-memory.dmpFilesize
72KB
-
memory/2036-78-0x0000000000130000-0x0000000000136000-memory.dmpFilesize
24KB
-
memory/2036-1-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/2036-5-0x0000000000130000-0x0000000000142000-memory.dmpFilesize
72KB
-
memory/2036-41-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/2036-30-0x00000000001C0000-0x00000000001C2000-memory.dmpFilesize
8KB
-
memory/2052-62-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2052-15-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2052-40-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2052-22-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2052-21-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2052-19-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2052-18-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2052-17-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2052-14-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2052-16-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2052-55-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/2052-60-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/2052-20-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2052-61-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2052-63-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2052-65-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2052-64-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2052-67-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2052-11-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2052-39-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/2052-151-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2052-81-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2052-82-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2052-83-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2052-152-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2052-106-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2052-86-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2516-104-0x0000000000360000-0x0000000000362000-memory.dmpFilesize
8KB
-
memory/2516-102-0x0000000000360000-0x0000000000362000-memory.dmpFilesize
8KB
-
memory/2516-95-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/2516-53-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2516-167-0x0000000000920000-0x00000000019DA000-memory.dmpFilesize
16.7MB
-
memory/2516-176-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2516-175-0x0000000000920000-0x00000000019DA000-memory.dmpFilesize
16.7MB
-
memory/2776-105-0x0000000000270000-0x0000000000272000-memory.dmpFilesize
8KB
-
memory/2776-103-0x0000000000270000-0x0000000000272000-memory.dmpFilesize
8KB
-
memory/2776-101-0x0000000000280000-0x0000000000281000-memory.dmpFilesize
4KB
-
memory/2776-80-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2776-180-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB