Analysis
- max time kernel
147s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
25/05/2024, 19:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1afe51849d2b4caf0d73648eee3a5bc9191c9b30b27076cc2f55de08ae2aa4dd.dll
Resource
win7-20240221-en
windows7-x64
17 signatures
150 seconds
General
- Target 1afe51849d2b4caf0d73648eee3a5bc9191c9b30b27076cc2f55de08ae2aa4dd.dll
- Size 120KB
- Sample240525-xvmgnsfc76
- SHA256 1afe51849d2b4caf0d73648eee3a5bc9191c9b30b27076cc2f55de08ae2aa4dd
- MD5 a2f3e5495a3e63d7a6c4ec9a5e1ea3fa
- SHA1 68ff880f1b463b4557b051f5369253fc9d97f574
- SHA512 0ec9022568dc0e60677fcf0b54bc46d72b228750305adc084614892bd7363552ecbeb4c38698f021a269598fdbfc9a3f509f5920a75438b5b8fde14c16641918
- SSDEEP 1536:pWXl0zrZ97nnNIxzqEha5PHvEUuzQ39iwsftKbrQED1HH7t+y5nL20N15a:pLbnNszqN5PHJnowsVSrQEp7tPn
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 2 TTPs 9 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e5828a1.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e583350.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e583350.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e587b65.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e587b65.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e5828a1.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e5828a1.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e583350.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e587b65.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5828a1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e583350.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e587b65.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5828a1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5828a1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e583350.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e583350.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e587b65.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e587b65.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e587b65.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5828a1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5828a1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e583350.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e583350.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e583350.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e587b65.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5828a1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e587b65.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e587b65.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5828a1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e583350.exe - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 27 IoCs
resource yara_rule behavioral2/memory/3892-6-0x0000000000880000-0x000000000193A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3892-11-0x0000000000880000-0x000000000193A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3892-9-0x0000000000880000-0x000000000193A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3892-15-0x0000000000880000-0x000000000193A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3892-14-0x0000000000880000-0x000000000193A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3892-12-0x0000000000880000-0x000000000193A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3892-10-0x0000000000880000-0x000000000193A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3892-8-0x0000000000880000-0x000000000193A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3892-17-0x0000000000880000-0x000000000193A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3892-16-0x0000000000880000-0x000000000193A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3892-30-0x0000000000880000-0x000000000193A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3892-31-0x0000000000880000-0x000000000193A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3892-36-0x0000000000880000-0x000000000193A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3892-40-0x0000000000880000-0x000000000193A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3892-41-0x0000000000880000-0x000000000193A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3892-56-0x0000000000880000-0x000000000193A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/416-79-0x0000000000B40000-0x0000000001BFA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/416-87-0x0000000000B40000-0x0000000001BFA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/416-78-0x0000000000B40000-0x0000000001BFA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/416-76-0x0000000000B40000-0x0000000001BFA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/416-90-0x0000000000B40000-0x0000000001BFA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/416-91-0x0000000000B40000-0x0000000001BFA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/416-88-0x0000000000B40000-0x0000000001BFA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/416-89-0x0000000000B40000-0x0000000001BFA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/416-81-0x0000000000B40000-0x0000000001BFA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/416-80-0x0000000000B40000-0x0000000001BFA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/416-115-0x0000000000B40000-0x0000000001BFA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 32 IoCs
resource yara_rule behavioral2/memory/3892-6-0x0000000000880000-0x000000000193A000-memory.dmp UPX behavioral2/memory/3892-11-0x0000000000880000-0x000000000193A000-memory.dmp UPX behavioral2/memory/3892-9-0x0000000000880000-0x000000000193A000-memory.dmp UPX behavioral2/memory/3892-15-0x0000000000880000-0x000000000193A000-memory.dmp UPX behavioral2/memory/3892-14-0x0000000000880000-0x000000000193A000-memory.dmp UPX behavioral2/memory/3892-12-0x0000000000880000-0x000000000193A000-memory.dmp UPX behavioral2/memory/3892-10-0x0000000000880000-0x000000000193A000-memory.dmp UPX behavioral2/memory/3892-8-0x0000000000880000-0x000000000193A000-memory.dmp UPX behavioral2/memory/3892-17-0x0000000000880000-0x000000000193A000-memory.dmp UPX behavioral2/memory/3892-16-0x0000000000880000-0x000000000193A000-memory.dmp UPX behavioral2/memory/3892-30-0x0000000000880000-0x000000000193A000-memory.dmp UPX behavioral2/memory/3892-31-0x0000000000880000-0x000000000193A000-memory.dmp UPX behavioral2/memory/3892-36-0x0000000000880000-0x000000000193A000-memory.dmp UPX behavioral2/memory/3892-40-0x0000000000880000-0x000000000193A000-memory.dmp UPX behavioral2/memory/3892-41-0x0000000000880000-0x000000000193A000-memory.dmp UPX behavioral2/memory/3892-56-0x0000000000880000-0x000000000193A000-memory.dmp UPX behavioral2/memory/3892-72-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4732-68-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/416-79-0x0000000000B40000-0x0000000001BFA000-memory.dmp UPX behavioral2/memory/416-87-0x0000000000B40000-0x0000000001BFA000-memory.dmp UPX behavioral2/memory/416-78-0x0000000000B40000-0x0000000001BFA000-memory.dmp UPX behavioral2/memory/416-76-0x0000000000B40000-0x0000000001BFA000-memory.dmp UPX behavioral2/memory/416-90-0x0000000000B40000-0x0000000001BFA000-memory.dmp UPX behavioral2/memory/416-91-0x0000000000B40000-0x0000000001BFA000-memory.dmp UPX behavioral2/memory/416-88-0x0000000000B40000-0x0000000001BFA000-memory.dmp UPX behavioral2/memory/416-89-0x0000000000B40000-0x0000000001BFA000-memory.dmp UPX behavioral2/memory/416-81-0x0000000000B40000-0x0000000001BFA000-memory.dmp UPX behavioral2/memory/416-80-0x0000000000B40000-0x0000000001BFA000-memory.dmp UPX behavioral2/memory/416-114-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/416-115-0x0000000000B40000-0x0000000001BFA000-memory.dmp UPX behavioral2/memory/4732-142-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/2212-163-0x0000000000400000-0x0000000000412000-memory.dmp UPX - Executes dropped EXE 4 IoCs
pid Process 3892 e5828a1.exe 416 e583350.exe 4732 e587923.exe 2212 e587b65.exe -
resource yara_rule behavioral2/memory/3892-6-0x0000000000880000-0x000000000193A000-memory.dmp upx behavioral2/memory/3892-11-0x0000000000880000-0x000000000193A000-memory.dmp upx behavioral2/memory/3892-9-0x0000000000880000-0x000000000193A000-memory.dmp upx behavioral2/memory/3892-15-0x0000000000880000-0x000000000193A000-memory.dmp upx behavioral2/memory/3892-14-0x0000000000880000-0x000000000193A000-memory.dmp upx behavioral2/memory/3892-12-0x0000000000880000-0x000000000193A000-memory.dmp upx behavioral2/memory/3892-10-0x0000000000880000-0x000000000193A000-memory.dmp upx behavioral2/memory/3892-8-0x0000000000880000-0x000000000193A000-memory.dmp upx behavioral2/memory/3892-17-0x0000000000880000-0x000000000193A000-memory.dmp upx behavioral2/memory/3892-16-0x0000000000880000-0x000000000193A000-memory.dmp upx behavioral2/memory/3892-30-0x0000000000880000-0x000000000193A000-memory.dmp upx behavioral2/memory/3892-31-0x0000000000880000-0x000000000193A000-memory.dmp upx behavioral2/memory/3892-36-0x0000000000880000-0x000000000193A000-memory.dmp upx behavioral2/memory/3892-40-0x0000000000880000-0x000000000193A000-memory.dmp upx behavioral2/memory/3892-41-0x0000000000880000-0x000000000193A000-memory.dmp upx behavioral2/memory/3892-56-0x0000000000880000-0x000000000193A000-memory.dmp upx behavioral2/memory/416-79-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx behavioral2/memory/416-87-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx behavioral2/memory/416-78-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx behavioral2/memory/416-76-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx behavioral2/memory/416-90-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx behavioral2/memory/416-91-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx behavioral2/memory/416-88-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx behavioral2/memory/416-89-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx behavioral2/memory/416-81-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx behavioral2/memory/416-80-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx behavioral2/memory/416-115-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e583350.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e583350.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e587b65.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e587b65.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5828a1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5828a1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e5828a1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e587b65.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5828a1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5828a1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e583350.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e587b65.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5828a1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e583350.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e583350.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e587b65.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e587b65.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e587b65.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5828a1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e583350.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e583350.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5828a1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e583350.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e587b65.exe - Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: e587b65.exe File opened (read-only) \??\G: e587b65.exe File opened (read-only) \??\H: e587b65.exe File opened (read-only) \??\E: e5828a1.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\e583023 e5828a1.exe File opened for modification C:\Windows\SYSTEM.INI e5828a1.exe File created C:\Windows\e588d08 e583350.exe File created C:\Windows\e58a8be e587b65.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3892 e5828a1.exe 3892 e5828a1.exe 3892 e5828a1.exe 3892 e5828a1.exe 416 e583350.exe 416 e583350.exe 2212 e587b65.exe 2212 e587b65.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe Token: SeDebugPrivilege 3892 e5828a1.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 224 wrote to memory of 2208 224 rundll32.exe 90 PID 224 wrote to memory of 2208 224 rundll32.exe 90 PID 224 wrote to memory of 2208 224 rundll32.exe 90 PID 2208 wrote to memory of 3892 2208 rundll32.exe 91 PID 2208 wrote to memory of 3892 2208 rundll32.exe 91 PID 2208 wrote to memory of 3892 2208 rundll32.exe 91 PID 3892 wrote to memory of 800 3892 e5828a1.exe 9 PID 3892 wrote to memory of 808 3892 e5828a1.exe 10 PID 3892 wrote to memory of 376 3892 e5828a1.exe 13 PID 3892 wrote to memory of 2548 3892 e5828a1.exe 45 PID 3892 wrote to memory of 2668 3892 e5828a1.exe 49 PID 3892 wrote to memory of 2936 3892 e5828a1.exe 52 PID 3892 wrote to memory of 3372 3892 e5828a1.exe 57 PID 3892 wrote to memory of 3572 3892 e5828a1.exe 58 PID 3892 wrote to memory of 3764 3892 e5828a1.exe 59 PID 3892 wrote to memory of 3884 3892 e5828a1.exe 60 PID 3892 wrote to memory of 3976 3892 e5828a1.exe 61 PID 3892 wrote to memory of 4068 3892 e5828a1.exe 62 PID 3892 wrote to memory of 4152 3892 e5828a1.exe 63 PID 3892 wrote to memory of 4868 3892 e5828a1.exe 65 PID 3892 wrote to memory of 4444 3892 e5828a1.exe 75 PID 3892 wrote to memory of 2328 3892 e5828a1.exe 77 PID 3892 wrote to memory of 4692 3892 e5828a1.exe 78 PID 3892 wrote to memory of 5092 3892 e5828a1.exe 79 PID 3892 wrote to memory of 3936 3892 e5828a1.exe 80 PID 3892 wrote to memory of 2696 3892 e5828a1.exe 81 PID 3892 wrote to memory of 2724 3892 e5828a1.exe 83 PID 3892 wrote to memory of 4532 3892 e5828a1.exe 84 PID 3892 wrote to memory of 224 3892 e5828a1.exe 89 PID 3892 wrote to memory of 2208 3892 e5828a1.exe 90 PID 3892 wrote to memory of 2208 3892 e5828a1.exe 90 PID 2208 wrote to memory of 416 2208 rundll32.exe 92 PID 2208 wrote to memory of 416 2208 rundll32.exe 92 PID 2208 wrote to memory of 416 2208 rundll32.exe 92 PID 3892 wrote to memory of 800 3892 e5828a1.exe 9 PID 3892 wrote to memory of 808 3892 e5828a1.exe 10 PID 3892 wrote to memory of 376 3892 e5828a1.exe 13 PID 3892 wrote to memory of 2548 3892 e5828a1.exe 45 PID 3892 wrote to memory of 2668 3892 e5828a1.exe 49 PID 3892 wrote to memory of 2936 3892 e5828a1.exe 52 PID 3892 wrote to memory of 3372 3892 e5828a1.exe 57 PID 3892 wrote to memory of 3572 3892 e5828a1.exe 58 PID 3892 wrote to memory of 3764 3892 e5828a1.exe 59 PID 3892 wrote to memory of 3884 3892 e5828a1.exe 60 PID 3892 wrote to memory of 3976 3892 e5828a1.exe 61 PID 3892 wrote to memory of 4068 3892 e5828a1.exe 62 PID 3892 wrote to memory of 4152 3892 e5828a1.exe 63 PID 3892 wrote to memory of 4868 3892 e5828a1.exe 65 PID 3892 wrote to memory of 4444 3892 e5828a1.exe 75 PID 3892 wrote to memory of 2328 3892 e5828a1.exe 77 PID 3892 wrote to memory of 4692 3892 e5828a1.exe 78 PID 3892 wrote to memory of 5092 3892 e5828a1.exe 79 PID 3892 wrote to memory of 3936 3892 e5828a1.exe 80 PID 3892 wrote to memory of 2696 3892 e5828a1.exe 81 PID 3892 wrote to memory of 2724 3892 e5828a1.exe 83 PID 3892 wrote to memory of 4532 3892 e5828a1.exe 84 PID 3892 wrote to memory of 224 3892 e5828a1.exe 89 PID 3892 wrote to memory of 416 3892 e5828a1.exe 92 PID 3892 wrote to memory of 416 3892 e5828a1.exe 92 PID 2208 wrote to memory of 4732 2208 rundll32.exe 95 PID 2208 wrote to memory of 4732 2208 rundll32.exe 95 PID 2208 wrote to memory of 4732 2208 rundll32.exe 95 PID 2208 wrote to memory of 2212 2208 rundll32.exe 96 PID 2208 wrote to memory of 2212 2208 rundll32.exe 96 - System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5828a1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e583350.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e587b65.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:800
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:808
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:376
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2548
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2668
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2936
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3372
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1afe51849d2b4caf0d73648eee3a5bc9191c9b30b27076cc2f55de08ae2aa4dd.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1afe51849d2b4caf0d73648eee3a5bc9191c9b30b27076cc2f55de08ae2aa4dd.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\e5828a1.exeC:\Users\Admin\AppData\Local\Temp\e5828a1.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3892
-
-
C:\Users\Admin\AppData\Local\Temp\e583350.exeC:\Users\Admin\AppData\Local\Temp\e583350.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- System policy modification
PID:416
-
-
C:\Users\Admin\AppData\Local\Temp\e587923.exeC:\Users\Admin\AppData\Local\Temp\e587923.exe4⤵
- Executes dropped EXE
PID:4732
-
-
C:\Users\Admin\AppData\Local\Temp\e587b65.exeC:\Users\Admin\AppData\Local\Temp\e587b65.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- System policy modification
PID:2212
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3572
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3764
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3884
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3976
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4068
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4152
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4868
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4444
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window1⤵PID:2328
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffc38392e98,0x7ffc38392ea4,0x7ffc38392eb02⤵PID:4692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2300 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:22⤵PID:5092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3248 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:32⤵PID:3936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3348 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:82⤵PID:2696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --mojo-platform-channel-handle=5340 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:12⤵PID:2724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=5452 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:12⤵PID:4532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4160 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:82⤵PID:3644
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\e5828a1.exe
- Size 97KB
- SHA256 2c1fe4935f5810d3e1fa06d11bc04dda722dae311fb6a1fdcb8a9b17a9ad480a
- MD5 bac03327555012e68211eb8b15dc2e21
- SHA1 2f544091891d8af07f2dc08838811e9ead81bee9
- SHA512 6eac7333dbbba3f4ab3986c983ebee48118c786302f19b6835251882dd4e5168dfd31189c806c4d1ded45e70ea40e7b790ca73864c1334d78a45acb1c4a9adb2
- SSDEEP 3072:kLvLZrr7rg7NT7R76M6p8hjadoh9OQc8Dl8:21rw7NPR76M6pKooFcu+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SYSTEM.INI
- Size 257B
- SHA256 14819a5d295a1f90fdd895bfe0417f8c1754889791780a5f4f1df89ff24cfc29
- MD5 fa7089fcbc65c62aad5ad66774262e95
- SHA1 297b9f1d346a68bc3113c6f437ad3f529db796d9
- SHA512 bed16cf776d418cb16b353cc91c41cff6afbe72a7c720c227d5566c5a6304447d4b3fbb4fefea157dd08a9fab277633312ef4032d7e332358f68cb857b96b0a1
- MD5 SHA1 SHA512