sality | 2acbf4c90d074db6004ae8b0d2250965e8a95f1f144d47196245256b21c1dc83

General

Target

2acbf4c90d074db6004ae8b0d2250965e8a95f1f144d47196245256b21c1dc83.dll
Size

120KB
MD5

149a1b5c4a45b9773e70f0d1160479a0
SHA1

7c2d9a5590929f26f7fbe1d577d855767107b4b5
SHA256

2acbf4c90d074db6004ae8b0d2250965e8a95f1f144d47196245256b21c1dc83
SHA512

d075f1921da508e857973fc6bcac36886285dcf29965772f3d3aedb766b3120272ac4c32a40724fe5476434b091565d3f10727dd775ddd9dec3f4d55ba43f854
SSDEEP

3072:bwDZYTlhrcjk8lxC4VD1uTy9u524jeHp4:bwDYhrek4pV5gyu5l6p

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 2 TTPs 3 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Processes:

e574fe5.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	e574fe5.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	e574fe5.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	e574fe5.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

e574fe5.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e574fe5.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e574fe5.exe

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

e574fe5.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e574fe5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e574fe5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e574fe5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e574fe5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e574fe5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e574fe5.exe

Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 27 IoCs

Processes:

resource	yara_rule
behavioral2/memory/668-6-0x0000000000800000-0x00000000018BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/668-8-0x0000000000800000-0x00000000018BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/668-10-0x0000000000800000-0x00000000018BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/668-11-0x0000000000800000-0x00000000018BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/668-33-0x0000000000800000-0x00000000018BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/668-24-0x0000000000800000-0x00000000018BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/668-34-0x0000000000800000-0x00000000018BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/668-36-0x0000000000800000-0x00000000018BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/668-35-0x0000000000800000-0x00000000018BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/668-28-0x0000000000800000-0x00000000018BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/668-37-0x0000000000800000-0x00000000018BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/668-38-0x0000000000800000-0x00000000018BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/668-39-0x0000000000800000-0x00000000018BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/668-40-0x0000000000800000-0x00000000018BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/668-41-0x0000000000800000-0x00000000018BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/668-59-0x0000000000800000-0x00000000018BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/668-60-0x0000000000800000-0x00000000018BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/668-61-0x0000000000800000-0x00000000018BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/668-62-0x0000000000800000-0x00000000018BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/668-64-0x0000000000800000-0x00000000018BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/668-66-0x0000000000800000-0x00000000018BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/668-68-0x0000000000800000-0x00000000018BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/668-71-0x0000000000800000-0x00000000018BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/668-72-0x0000000000800000-0x00000000018BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/668-73-0x0000000000800000-0x00000000018BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/668-74-0x0000000000800000-0x00000000018BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/668-81-0x0000000000800000-0x00000000018BA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine

UPX dump on OEP (original entry point) 32 IoCs

Processes:

resource	yara_rule
behavioral2/memory/668-5-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral2/memory/668-6-0x0000000000800000-0x00000000018BA000-memory.dmp	UPX
behavioral2/memory/668-8-0x0000000000800000-0x00000000018BA000-memory.dmp	UPX
behavioral2/memory/668-10-0x0000000000800000-0x00000000018BA000-memory.dmp	UPX
behavioral2/memory/668-11-0x0000000000800000-0x00000000018BA000-memory.dmp	UPX
behavioral2/memory/668-33-0x0000000000800000-0x00000000018BA000-memory.dmp	UPX
behavioral2/memory/668-24-0x0000000000800000-0x00000000018BA000-memory.dmp	UPX
behavioral2/memory/668-34-0x0000000000800000-0x00000000018BA000-memory.dmp	UPX
behavioral2/memory/1164-31-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral2/memory/668-36-0x0000000000800000-0x00000000018BA000-memory.dmp	UPX
behavioral2/memory/668-35-0x0000000000800000-0x00000000018BA000-memory.dmp	UPX
behavioral2/memory/668-28-0x0000000000800000-0x00000000018BA000-memory.dmp	UPX
behavioral2/memory/668-37-0x0000000000800000-0x00000000018BA000-memory.dmp	UPX
behavioral2/memory/668-38-0x0000000000800000-0x00000000018BA000-memory.dmp	UPX
behavioral2/memory/668-39-0x0000000000800000-0x00000000018BA000-memory.dmp	UPX
behavioral2/memory/668-40-0x0000000000800000-0x00000000018BA000-memory.dmp	UPX
behavioral2/memory/668-41-0x0000000000800000-0x00000000018BA000-memory.dmp	UPX
behavioral2/memory/668-59-0x0000000000800000-0x00000000018BA000-memory.dmp	UPX
behavioral2/memory/668-60-0x0000000000800000-0x00000000018BA000-memory.dmp	UPX
behavioral2/memory/668-61-0x0000000000800000-0x00000000018BA000-memory.dmp	UPX
behavioral2/memory/668-62-0x0000000000800000-0x00000000018BA000-memory.dmp	UPX
behavioral2/memory/668-64-0x0000000000800000-0x00000000018BA000-memory.dmp	UPX
behavioral2/memory/668-66-0x0000000000800000-0x00000000018BA000-memory.dmp	UPX
behavioral2/memory/668-68-0x0000000000800000-0x00000000018BA000-memory.dmp	UPX
behavioral2/memory/668-71-0x0000000000800000-0x00000000018BA000-memory.dmp	UPX
behavioral2/memory/668-72-0x0000000000800000-0x00000000018BA000-memory.dmp	UPX
behavioral2/memory/668-73-0x0000000000800000-0x00000000018BA000-memory.dmp	UPX
behavioral2/memory/668-74-0x0000000000800000-0x00000000018BA000-memory.dmp	UPX
behavioral2/memory/668-97-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral2/memory/668-81-0x0000000000800000-0x00000000018BA000-memory.dmp	UPX
behavioral2/memory/1164-96-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral2/memory/2280-101-0x0000000000400000-0x0000000000412000-memory.dmp	UPX

Executes dropped EXE 3 IoCs

Processes:

e574fe5.exee5750df.exee57785c.exe

pid process

668 e574fe5.exe
1164 e5750df.exe
2280 e57785c.exe

pid	process
668	e574fe5.exe
1164	e5750df.exe
2280	e57785c.exe

UPX packed file 27 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/668-6-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/668-8-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/668-10-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/668-11-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/668-33-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/668-24-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/668-34-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/668-36-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/668-35-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/668-28-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/668-37-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/668-38-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/668-39-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/668-40-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/668-41-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/668-59-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/668-60-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/668-61-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/668-62-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/668-64-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/668-66-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/668-68-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/668-71-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/668-72-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/668-73-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/668-74-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/668-81-0x0000000000800000-0x00000000018BA000-memory.dmp	upx

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

e574fe5.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e574fe5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	e574fe5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e574fe5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e574fe5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e574fe5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e574fe5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e574fe5.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

e574fe5.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e574fe5.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e574fe5.exe

Enumerates connected drives 3 TTPs 9 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

e574fe5.exe

description	ioc	process
File opened (read-only)	\??\J:	e574fe5.exe
File opened (read-only)	\??\N:	e574fe5.exe
File opened (read-only)	\??\E:	e574fe5.exe
File opened (read-only)	\??\H:	e574fe5.exe
File opened (read-only)	\??\I:	e574fe5.exe
File opened (read-only)	\??\M:	e574fe5.exe
File opened (read-only)	\??\G:	e574fe5.exe
File opened (read-only)	\??\K:	e574fe5.exe
File opened (read-only)	\??\L:	e574fe5.exe

Drops file in Program Files directory 3 IoCs

Processes:

e574fe5.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\7z.exe	e574fe5.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	e574fe5.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	e574fe5.exe

Drops file in Windows directory 2 IoCs

Processes:

e574fe5.exe

description ioc process

File created C:\Windows\e575043 e574fe5.exe
File opened for modification C:\Windows\SYSTEM.INI e574fe5.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

e574fe5.exe

pid process

668 e574fe5.exe
668 e574fe5.exe
668 e574fe5.exe
668 e574fe5.exe

description	ioc	process
File created	C:\Windows\e575043	e574fe5.exe
File opened for modification	C:\Windows\SYSTEM.INI	e574fe5.exe

pid	process
668	e574fe5.exe
668	e574fe5.exe
668	e574fe5.exe
668	e574fe5.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

e574fe5.exe

description	pid	process
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe
Token: SeDebugPrivilege	668	e574fe5.exe

Suspicious use of WriteProcessMemory 56 IoCs

Processes:

rundll32.exerundll32.exee574fe5.exe

description	pid	process	target process
PID 3960 wrote to memory of 1048	3960	rundll32.exe	rundll32.exe
PID 3960 wrote to memory of 1048	3960	rundll32.exe	rundll32.exe
PID 3960 wrote to memory of 1048	3960	rundll32.exe	rundll32.exe
PID 1048 wrote to memory of 668	1048	rundll32.exe	e574fe5.exe
PID 1048 wrote to memory of 668	1048	rundll32.exe	e574fe5.exe
PID 1048 wrote to memory of 668	1048	rundll32.exe	e574fe5.exe
PID 668 wrote to memory of 776	668	e574fe5.exe	fontdrvhost.exe
PID 668 wrote to memory of 784	668	e574fe5.exe	fontdrvhost.exe
PID 668 wrote to memory of 384	668	e574fe5.exe	dwm.exe
PID 668 wrote to memory of 3060	668	e574fe5.exe	sihost.exe
PID 668 wrote to memory of 2204	668	e574fe5.exe	svchost.exe
PID 668 wrote to memory of 3084	668	e574fe5.exe	taskhostw.exe
PID 668 wrote to memory of 3444	668	e574fe5.exe	Explorer.EXE
PID 668 wrote to memory of 3584	668	e574fe5.exe	svchost.exe
PID 668 wrote to memory of 3768	668	e574fe5.exe	DllHost.exe
PID 668 wrote to memory of 3856	668	e574fe5.exe	StartMenuExperienceHost.exe
PID 668 wrote to memory of 3920	668	e574fe5.exe	RuntimeBroker.exe
PID 668 wrote to memory of 4052	668	e574fe5.exe	SearchApp.exe
PID 668 wrote to memory of 4020	668	e574fe5.exe	RuntimeBroker.exe
PID 668 wrote to memory of 4384	668	e574fe5.exe	RuntimeBroker.exe
PID 668 wrote to memory of 2164	668	e574fe5.exe	TextInputHost.exe
PID 668 wrote to memory of 4696	668	e574fe5.exe	backgroundTaskHost.exe
PID 668 wrote to memory of 2112	668	e574fe5.exe	backgroundTaskHost.exe
PID 668 wrote to memory of 3960	668	e574fe5.exe	rundll32.exe
PID 668 wrote to memory of 1048	668	e574fe5.exe	rundll32.exe
PID 668 wrote to memory of 1048	668	e574fe5.exe	rundll32.exe
PID 1048 wrote to memory of 1164	1048	rundll32.exe	e5750df.exe
PID 1048 wrote to memory of 1164	1048	rundll32.exe	e5750df.exe
PID 1048 wrote to memory of 1164	1048	rundll32.exe	e5750df.exe
PID 1048 wrote to memory of 2280	1048	rundll32.exe	e57785c.exe
PID 1048 wrote to memory of 2280	1048	rundll32.exe	e57785c.exe
PID 1048 wrote to memory of 2280	1048	rundll32.exe	e57785c.exe
PID 668 wrote to memory of 776	668	e574fe5.exe	fontdrvhost.exe
PID 668 wrote to memory of 784	668	e574fe5.exe	fontdrvhost.exe
PID 668 wrote to memory of 384	668	e574fe5.exe	dwm.exe
PID 668 wrote to memory of 3060	668	e574fe5.exe	sihost.exe
PID 668 wrote to memory of 2204	668	e574fe5.exe	svchost.exe
PID 668 wrote to memory of 3084	668	e574fe5.exe	taskhostw.exe
PID 668 wrote to memory of 3444	668	e574fe5.exe	Explorer.EXE
PID 668 wrote to memory of 3584	668	e574fe5.exe	svchost.exe
PID 668 wrote to memory of 3768	668	e574fe5.exe	DllHost.exe
PID 668 wrote to memory of 3856	668	e574fe5.exe	StartMenuExperienceHost.exe
PID 668 wrote to memory of 3920	668	e574fe5.exe	RuntimeBroker.exe
PID 668 wrote to memory of 4052	668	e574fe5.exe	SearchApp.exe
PID 668 wrote to memory of 4020	668	e574fe5.exe	RuntimeBroker.exe
PID 668 wrote to memory of 4384	668	e574fe5.exe	RuntimeBroker.exe
PID 668 wrote to memory of 2164	668	e574fe5.exe	TextInputHost.exe
PID 668 wrote to memory of 4696	668	e574fe5.exe	backgroundTaskHost.exe
PID 668 wrote to memory of 2112	668	e574fe5.exe	backgroundTaskHost.exe
PID 668 wrote to memory of 1164	668	e574fe5.exe	e5750df.exe
PID 668 wrote to memory of 1164	668	e574fe5.exe	e5750df.exe
PID 668 wrote to memory of 2012	668	e574fe5.exe	BackgroundTaskHost.exe
PID 668 wrote to memory of 1552	668	e574fe5.exe	RuntimeBroker.exe
PID 668 wrote to memory of 2280	668	e574fe5.exe	e57785c.exe
PID 668 wrote to memory of 2280	668	e574fe5.exe	e57785c.exe
PID 668 wrote to memory of 2108	668	e574fe5.exe	RuntimeBroker.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

e574fe5.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e574fe5.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e574fe5.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:776

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:784

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:384

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2204

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:3084

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3444

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2acbf4c90d074db6004ae8b0d2250965e8a95f1f144d47196245256b21c1dc83.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:3960

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2acbf4c90d074db6004ae8b0d2250965e8a95f1f144d47196245256b21c1dc83.dll,#1
3⤵
- Suspicious use of WriteProcessMemory
PID:1048

C:\Users\Admin\AppData\Local\Temp\e574fe5.exe
C:\Users\Admin\AppData\Local\Temp\e574fe5.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:668

C:\Users\Admin\AppData\Local\Temp\e5750df.exe
C:\Users\Admin\AppData\Local\Temp\e5750df.exe
4⤵
- Executes dropped EXE
PID:1164

C:\Users\Admin\AppData\Local\Temp\e57785c.exe
C:\Users\Admin\AppData\Local\Temp\e57785c.exe
4⤵
- Executes dropped EXE
PID:2280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3584

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3768

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3856

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3920

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4052

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4020

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4384

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:2164

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:4696

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:2112

C:\Windows\system32\BackgroundTaskHost.exe
"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
1⤵
PID:2012

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:1552

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

3

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e574fe5.exe
Filesize
97KB

MD5
d3fe956e33f2086342d97dc6ca39d8aa

SHA1
52a111cf63e57c7947db8fd245dff138ad91a863

SHA256
642932d20410d9ecc313c0593a80fd88f80b9dde9e3a79cbbdddd10975a4a8ec

SHA512
9d2fb17e32dc848c43dcf558d94cad56c81eb2803922e2dd4692cadfbeb7f75eecbc58a0a6eb9e89e8beb2d7b8e34d38f1172a34e77a77f1bc0112c8e86f1c8a

Download Submit
memory/668-97-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/668-59-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/668-8-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/668-10-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/668-11-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/668-33-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/668-66-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/668-34-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/668-36-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/668-35-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/668-30-0x00000000006F0000-0x00000000006F2000-memory.dmp

Filesize
8KB

Download
memory/668-64-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/668-62-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/668-61-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/668-28-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/668-25-0x00000000006F0000-0x00000000006F2000-memory.dmp

Filesize
8KB

Download
memory/668-60-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/668-37-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/668-24-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/668-6-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/668-15-0x0000000003D30000-0x0000000003D31000-memory.dmp

Filesize
4KB

Download
memory/668-38-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/668-39-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/668-40-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/668-41-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/668-5-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/668-81-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/668-71-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/668-76-0x00000000006F0000-0x00000000006F2000-memory.dmp

Filesize
8KB

Download
memory/668-68-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/668-74-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/668-73-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/668-72-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/1048-47-0x0000000003B00000-0x0000000003B02000-memory.dmp

Filesize
8KB

Download
memory/1048-12-0x0000000003B00000-0x0000000003B02000-memory.dmp

Filesize
8KB

Download
memory/1048-16-0x0000000003B00000-0x0000000003B02000-memory.dmp

Filesize
8KB

Download
memory/1048-29-0x0000000000800000-0x0000000000803000-memory.dmp

Filesize
12KB

Download
memory/1048-32-0x0000000003B00000-0x0000000003B02000-memory.dmp

Filesize
8KB

Download
memory/1048-1-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/1048-13-0x0000000003B50000-0x0000000003B51000-memory.dmp

Filesize
4KB

Download
memory/1164-31-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1164-57-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/1164-52-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/1164-55-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/1164-96-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1164-93-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/2280-56-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/2280-58-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/2280-54-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/2280-50-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2280-101-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads