Analysis
- max time kernel
122s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
24/05/2024, 10:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe
Resource
win7-20240221-en
windows7-x64
23 signatures
150 seconds
General
- Target 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe
- Size 244KB
- Sample240524-ma4kcade75
- SHA256 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8
- MD5 6db6d12e5dbc839b9c6858444a165bd4
- SHA1 d17c5d289b884ea452d9cf0ca921ce6e4f498831
- SHA512 643f6f8a6b0e8509e43d1346102c028eda7df8275ee63975de71bc0a9ee93730c53b893fd799989f6c11cd44ab705e596b23a94af2281f8818d8700a1818868a
- SSDEEP 3072:JmdrXoGCHt4JTKkZfLTuvfFo2mP1HniQdnAAMMoNH+TQYb8rbtXIGxsDSZLbRhG+:JmdZOi5gu9Pl8FHmQLrbJzSDaLFYoZW
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
-
http://www.klkjwre9fqwieluoi.info/
-
http://kukutrustnet777888.info/
Signatures
- Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe -
resource yara_rule behavioral2/files/0x0008000000023421-13.dat aspack_v212_v242 - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation LRmZyy.exe - Executes dropped EXE 2 IoCs
pid Process 3512 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8mgr.exe 3304 LRmZyy.exe -
resource yara_rule behavioral2/memory/3512-5-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral2/files/0x0007000000023298-4.dat upx behavioral2/memory/4472-8-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-14-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-9-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-15-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-24-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-25-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-16-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-34-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-21-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-43-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-42-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-44-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-47-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-48-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-51-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-52-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-53-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-55-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-56-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-60-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-62-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-69-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-72-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-73-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-75-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-78-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-79-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-83-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-84-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-93-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-98-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-99-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-102-0x0000000002790000-0x000000000381E000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened (read-only) \??\M: 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened (read-only) \??\T: 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened (read-only) \??\X: 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened (read-only) \??\Y: 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened (read-only) \??\G: 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened (read-only) \??\Q: 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened (read-only) \??\L: 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened (read-only) \??\K: 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened (read-only) \??\O: 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened (read-only) \??\P: 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened (read-only) \??\I: 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened (read-only) \??\J: 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened (read-only) \??\N: 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened (read-only) \??\R: 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened (read-only) \??\S: 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened (read-only) \??\U: 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened (read-only) \??\V: 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened (read-only) \??\W: 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened (read-only) \??\E: 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened (read-only) \??\Z: 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification F:\autorun.inf 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe LRmZyy.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe LRmZyy.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe LRmZyy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Time.exe LRmZyy.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe LRmZyy.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe LRmZyy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe LRmZyy.exe File created C:\Program Files\Cacrk\TXlogin.dll 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe LRmZyy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe LRmZyy.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe LRmZyy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE LRmZyy.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe LRmZyy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE LRmZyy.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe LRmZyy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe LRmZyy.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe LRmZyy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe LRmZyy.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe LRmZyy.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe LRmZyy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe LRmZyy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe LRmZyy.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe LRmZyy.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe LRmZyy.exe File opened for modification C:\Program Files\Internet Explorer\it-IT\ieinstal.exe.mui 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe LRmZyy.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe LRmZyy.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome.exe.sig 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe LRmZyy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE LRmZyy.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe LRmZyy.exe File opened for modification C:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe LRmZyy.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe LRmZyy.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe LRmZyy.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe LRmZyy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe LRmZyy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe LRmZyy.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe LRmZyy.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe LRmZyy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe LRmZyy.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe LRmZyy.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
pid pid_target Process procid_target 1368 3512 WerFault.exe 83 - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4472 wrote to memory of 3512 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 83 PID 4472 wrote to memory of 3512 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 83 PID 4472 wrote to memory of 3512 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 83 PID 4472 wrote to memory of 3304 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 85 PID 4472 wrote to memory of 3304 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 85 PID 4472 wrote to memory of 3304 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 85 PID 4472 wrote to memory of 764 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 8 PID 4472 wrote to memory of 772 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 9 PID 4472 wrote to memory of 336 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 13 PID 4472 wrote to memory of 2524 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 42 PID 4472 wrote to memory of 2556 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 43 PID 4472 wrote to memory of 2660 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 46 PID 4472 wrote to memory of 3344 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 55 PID 4472 wrote to memory of 3580 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 57 PID 4472 wrote to memory of 3772 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 58 PID 4472 wrote to memory of 3916 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 59 PID 4472 wrote to memory of 3980 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 60 PID 4472 wrote to memory of 4076 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 61 PID 4472 wrote to memory of 4044 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 62 PID 4472 wrote to memory of 4440 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 64 PID 4472 wrote to memory of 3004 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 75 PID 4472 wrote to memory of 4000 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 80 PID 4472 wrote to memory of 1400 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 81 PID 4472 wrote to memory of 3512 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 83 PID 4472 wrote to memory of 3512 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 83 PID 4472 wrote to memory of 3304 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 85 PID 4472 wrote to memory of 3304 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 85 PID 4472 wrote to memory of 764 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 8 PID 4472 wrote to memory of 772 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 9 PID 4472 wrote to memory of 336 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 13 PID 4472 wrote to memory of 2524 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 42 PID 4472 wrote to memory of 2556 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 43 PID 4472 wrote to memory of 2660 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 46 PID 4472 wrote to memory of 3344 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 55 PID 4472 wrote to memory of 3580 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 57 PID 4472 wrote to memory of 3772 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 58 PID 4472 wrote to memory of 3916 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 59 PID 4472 wrote to memory of 3980 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 60 PID 4472 wrote to memory of 4076 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 61 PID 4472 wrote to memory of 4044 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 62 PID 4472 wrote to memory of 4440 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 64 PID 4472 wrote to memory of 3004 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 75 PID 4472 wrote to memory of 4000 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 80 PID 4472 wrote to memory of 1212 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 90 PID 4472 wrote to memory of 3456 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 91 PID 4472 wrote to memory of 764 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 8 PID 4472 wrote to memory of 772 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 9 PID 4472 wrote to memory of 336 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 13 PID 4472 wrote to memory of 2524 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 42 PID 4472 wrote to memory of 2556 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 43 PID 4472 wrote to memory of 2660 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 46 PID 4472 wrote to memory of 3344 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 55 PID 4472 wrote to memory of 3580 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 57 PID 4472 wrote to memory of 3772 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 58 PID 4472 wrote to memory of 3916 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 59 PID 4472 wrote to memory of 3980 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 60 PID 4472 wrote to memory of 4076 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 61 PID 4472 wrote to memory of 4044 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 62 PID 4472 wrote to memory of 4440 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 64 PID 4472 wrote to memory of 3004 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 75 PID 4472 wrote to memory of 4000 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 80 PID 4472 wrote to memory of 1212 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 90 PID 4472 wrote to memory of 3456 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 91 PID 4472 wrote to memory of 764 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 8 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:764
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:772
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:336
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2524
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2556
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2660
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe"C:\Users\Admin\AppData\Local\Temp\0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8mgr.exeC:\Users\Admin\AppData\Local\Temp\0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8mgr.exe3⤵
- Executes dropped EXE
PID:3512 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3512 -s 2644⤵
- Program crash
PID:1368
-
-
-
C:\Users\Admin\AppData\Local\Temp\LRmZyy.exeC:\Users\Admin\AppData\Local\Temp\LRmZyy.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
PID:3304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\220a15d7.bat" "4⤵PID:4976
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3580
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3772
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3916
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3980
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4076
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4044
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4440
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:3004
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:4000
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:1400
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3512 -ip 35121⤵PID:3452
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1212
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3456
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 36KB
- SHA256 fa4851bdaef97811954b872730481d8cf12b983254fdb9439dfcc8e268326139
- MD5 a783c5594a28eaf98e28027513455272
- SHA1 cf249a488ac741c4ccd2459c7123696d4d46e971
- SHA512 ed89c40fef3813e985b5f8ad109ea33d6f4d9bf753a538db08f3dff76cfe1cc9c663d73f2608ba1869d2fef6e8e9701f9c8e5a6996981068ce92d71de4c5f79c
- SSDEEP 768:NWQ3655Kv1X/qY1MSda+QGPL4vzZq2o9W7GsxBbPr7zUJ:NHqaNrFdaFGCq2iW7zrU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GO42234Z\k2[1].rar
- Size 4B
- SHA256 b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
- MD5 d3b07384d113edec49eaa6238ad5ff00
- SHA1 f1d2d2f924e986ac86fdf7b36c94bcdf32beec15
- SHA512 0cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8mgr.exe
- Size 105KB
- SHA256 54282ec29d4993ed6e9972122cfbb70bba4898a21d527bd9e72a166d7ec2fdc0
- MD5 dfb5daabb95dcfad1a5faf9ab1437076
- SHA1 4a199569a9b52911bee7fb19ab80570cc5ff9ed1
- SHA512 5d31c34403ab5f8db4a6d84f2b5579d4ea18673914b626d78e458a648ac20ddd8e342818e807331036d7bb064f596a02b9737acac42fbead29260343a30717e8
- SSDEEP 1536:MOC0FvV4OguHxjhpA4Bm7uW0vSUsghQevBFkutIbgTuFqKRr0aF5frleGhd9TfBi:MwV4OgSzBmh04eZFkz3Rr0gwGj9Tf8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\15223A1D.exe
- Size 4B
- SHA256 9f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31
- MD5 20879c987e2f9a916e578386d499f629
- SHA1 c7b33ddcc42361fdb847036fc07e880b81935d5d
- SHA512 bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\220a15d7.bat
- Size 187B
- SHA256 eefe647306afa73f3b3ea015a2a9adda6b795da6cb3e548e1261f28ea7dba877
- MD5 df741305859584f29b2c7966c4b245ed
- SHA1 4f341e102438871bf1078a8688ac34fee44a3648
- SHA512 7480a4ef62ba23abe1c29b419a73ead7f3ceedc4a017d29e5858b4ad5a7626f0b78ec40ff7b57a4a57fd7db6afbc7b6e39e55714d1178d2c9b506c11737e465d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\LRmZyy.exe
- Size 15KB
- SHA256 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
- MD5 56b2c3810dba2e939a8bb9fa36d3cf96
- SHA1 99ee31cd4b0d6a4b62779da36e0eeecdd80589fc
- SHA512 27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
- SSDEEP 384:7XZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:1QGPL4vzZq2o9W7GsxBbPr
- MD5 SHA1 SHA512 SSDEEP
- Path F:\cymqm.pif
- Size 100KB
- SHA256 15e0f8b2209cfd7515b0cdf942467dac01556775b13985c99cb7def13ce41eb3
- MD5 eed031c9c7fa7ac7ca2b7f82d4437ca7
- SHA1 3b815449b1545e1ec7fb313fb3ea9c31813b3636
- SHA512 e87eab813fdb7528e3d42d1ec5057789036efd680c400c9692fd2adf8ab44aa5743b277a054693f62d8305da92ef2146fc2592e8679d39cde96a79e676952f6e
- SSDEEP 1536:btgxPkARYUFiv3UBaJqWrFXUcLqNg0WsSynac2D2LthJY9Rt5j:abRYUgv3UBa3rZUcQsxynr1y
- MD5 SHA1 SHA512 SSDEEP