Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
27/05/2024, 01:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b68dcdfb2184b5a8050fb69a9db0c6ff8e85d7924aced564679b1dfb83eefdfd.dll
Resource
win7-20240221-en
windows7-x64
17 signatures
150 seconds
General
- Target b68dcdfb2184b5a8050fb69a9db0c6ff8e85d7924aced564679b1dfb83eefdfd.dll
- Size 120KB
- Sample240527-cbfjssda93
- SHA256 b68dcdfb2184b5a8050fb69a9db0c6ff8e85d7924aced564679b1dfb83eefdfd
- MD5 86d18e6b1175fe1a81d460da89c4517b
- SHA1 ed67c5ce16f77c41c329481b4ef9196b530fc559
- SHA512 07c3c1ffeb865a8c2c700327d1d11966d61bdf5b7d156a3e3a7b598b9d36a91388c3c32531319f7048df4df95a163ec78e2559f51d5fb10a6e136357869a91a6
- SSDEEP 3072:yPVj8NtkpT+5CQ01cvKgIJfQGJ5brPolkpqMF:ypct4qlNuJ5b3
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e575767.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e575767.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e575767.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e578760.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e578760.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e578760.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e575767.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578760.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e575767.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e575767.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e575767.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e578760.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e578760.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e578760.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e575767.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e575767.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e578760.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e578760.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e578760.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e575767.exe - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 29 IoCs
resource yara_rule behavioral2/memory/208-6-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/208-8-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/208-9-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/208-21-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/208-22-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/208-11-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/208-10-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/208-33-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/208-34-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/208-36-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/208-35-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/208-37-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/208-38-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/208-39-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/208-41-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/208-40-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/208-55-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/208-56-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/208-57-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/208-59-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/208-60-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/208-67-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/208-69-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/208-71-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4092-100-0x0000000000830000-0x00000000018EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4092-97-0x0000000000830000-0x00000000018EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4092-95-0x0000000000830000-0x00000000018EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4092-108-0x0000000000830000-0x00000000018EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4092-147-0x0000000000830000-0x00000000018EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 35 IoCs
resource yara_rule behavioral2/memory/208-5-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/208-6-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/208-8-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/208-9-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/208-21-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/208-22-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/208-11-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/5024-27-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/208-10-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/208-33-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/208-34-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/208-36-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/208-35-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/208-37-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/208-38-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/208-39-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/208-41-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/208-40-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/4092-51-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/208-55-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/208-56-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/208-57-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/208-59-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/208-60-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/208-67-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/208-69-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/208-71-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/208-90-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/5024-94-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4092-100-0x0000000000830000-0x00000000018EA000-memory.dmp UPX behavioral2/memory/4092-97-0x0000000000830000-0x00000000018EA000-memory.dmp UPX behavioral2/memory/4092-95-0x0000000000830000-0x00000000018EA000-memory.dmp UPX behavioral2/memory/4092-108-0x0000000000830000-0x00000000018EA000-memory.dmp UPX behavioral2/memory/4092-148-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4092-147-0x0000000000830000-0x00000000018EA000-memory.dmp UPX - Executes dropped EXE 3 IoCs
pid Process 208 e575767.exe 5024 e57590d.exe 4092 e578760.exe -
resource yara_rule behavioral2/memory/208-6-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/208-8-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/208-9-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/208-21-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/208-22-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/208-11-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/208-10-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/208-33-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/208-34-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/208-36-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/208-35-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/208-37-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/208-38-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/208-39-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/208-41-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/208-40-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/208-55-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/208-56-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/208-57-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/208-59-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/208-60-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/208-67-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/208-69-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/208-71-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/4092-100-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4092-97-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4092-95-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4092-108-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/4092-147-0x0000000000830000-0x00000000018EA000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e575767.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e578760.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e578760.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e575767.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e575767.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e575767.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e575767.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e578760.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e578760.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e578760.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e578760.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e578760.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e575767.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e575767.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e575767.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578760.exe - Enumerates connected drives 3 TTPs 11 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: e575767.exe File opened (read-only) \??\L: e575767.exe File opened (read-only) \??\E: e578760.exe File opened (read-only) \??\G: e578760.exe File opened (read-only) \??\I: e578760.exe File opened (read-only) \??\H: e575767.exe File opened (read-only) \??\I: e575767.exe File opened (read-only) \??\J: e575767.exe File opened (read-only) \??\H: e578760.exe File opened (read-only) \??\E: e575767.exe File opened (read-only) \??\G: e575767.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e5757c5 e575767.exe File opened for modification C:\Windows\SYSTEM.INI e575767.exe File created C:\Windows\e57afa9 e578760.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 208 e575767.exe 208 e575767.exe 208 e575767.exe 208 e575767.exe 4092 e578760.exe 4092 e578760.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe Token: SeDebugPrivilege 208 e575767.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 224 wrote to memory of 808 224 rundll32.exe 83 PID 224 wrote to memory of 808 224 rundll32.exe 83 PID 224 wrote to memory of 808 224 rundll32.exe 83 PID 808 wrote to memory of 208 808 rundll32.exe 84 PID 808 wrote to memory of 208 808 rundll32.exe 84 PID 808 wrote to memory of 208 808 rundll32.exe 84 PID 208 wrote to memory of 792 208 e575767.exe 9 PID 208 wrote to memory of 800 208 e575767.exe 10 PID 208 wrote to memory of 1020 208 e575767.exe 13 PID 208 wrote to memory of 2660 208 e575767.exe 44 PID 208 wrote to memory of 2676 208 e575767.exe 45 PID 208 wrote to memory of 2960 208 e575767.exe 51 PID 208 wrote to memory of 3420 208 e575767.exe 56 PID 208 wrote to memory of 3540 208 e575767.exe 57 PID 208 wrote to memory of 3732 208 e575767.exe 58 PID 208 wrote to memory of 3828 208 e575767.exe 59 PID 208 wrote to memory of 3924 208 e575767.exe 60 PID 208 wrote to memory of 4012 208 e575767.exe 61 PID 208 wrote to memory of 3860 208 e575767.exe 62 PID 208 wrote to memory of 4448 208 e575767.exe 64 PID 208 wrote to memory of 2440 208 e575767.exe 75 PID 208 wrote to memory of 3468 208 e575767.exe 80 PID 208 wrote to memory of 4240 208 e575767.exe 81 PID 208 wrote to memory of 224 208 e575767.exe 82 PID 208 wrote to memory of 808 208 e575767.exe 83 PID 208 wrote to memory of 808 208 e575767.exe 83 PID 808 wrote to memory of 5024 808 rundll32.exe 85 PID 808 wrote to memory of 5024 808 rundll32.exe 85 PID 808 wrote to memory of 5024 808 rundll32.exe 85 PID 208 wrote to memory of 792 208 e575767.exe 9 PID 208 wrote to memory of 800 208 e575767.exe 10 PID 208 wrote to memory of 1020 208 e575767.exe 13 PID 208 wrote to memory of 2660 208 e575767.exe 44 PID 208 wrote to memory of 2676 208 e575767.exe 45 PID 208 wrote to memory of 2960 208 e575767.exe 51 PID 208 wrote to memory of 3420 208 e575767.exe 56 PID 208 wrote to memory of 3540 208 e575767.exe 57 PID 208 wrote to memory of 3732 208 e575767.exe 58 PID 208 wrote to memory of 3828 208 e575767.exe 59 PID 208 wrote to memory of 3924 208 e575767.exe 60 PID 208 wrote to memory of 4012 208 e575767.exe 61 PID 208 wrote to memory of 3860 208 e575767.exe 62 PID 208 wrote to memory of 4448 208 e575767.exe 64 PID 208 wrote to memory of 2440 208 e575767.exe 75 PID 208 wrote to memory of 3468 208 e575767.exe 80 PID 208 wrote to memory of 4240 208 e575767.exe 81 PID 208 wrote to memory of 224 208 e575767.exe 82 PID 208 wrote to memory of 5024 208 e575767.exe 85 PID 208 wrote to memory of 5024 208 e575767.exe 85 PID 808 wrote to memory of 4092 808 rundll32.exe 86 PID 808 wrote to memory of 4092 808 rundll32.exe 86 PID 808 wrote to memory of 4092 808 rundll32.exe 86 PID 4092 wrote to memory of 792 4092 e578760.exe 9 PID 4092 wrote to memory of 800 4092 e578760.exe 10 PID 4092 wrote to memory of 1020 4092 e578760.exe 13 PID 4092 wrote to memory of 2660 4092 e578760.exe 44 PID 4092 wrote to memory of 2676 4092 e578760.exe 45 PID 4092 wrote to memory of 2960 4092 e578760.exe 51 PID 4092 wrote to memory of 3420 4092 e578760.exe 56 PID 4092 wrote to memory of 3540 4092 e578760.exe 57 PID 4092 wrote to memory of 3732 4092 e578760.exe 58 PID 4092 wrote to memory of 3828 4092 e578760.exe 59 PID 4092 wrote to memory of 3924 4092 e578760.exe 60 PID 4092 wrote to memory of 4012 4092 e578760.exe 61 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e575767.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578760.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:792
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:800
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1020
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2660
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2676
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2960
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3420
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b68dcdfb2184b5a8050fb69a9db0c6ff8e85d7924aced564679b1dfb83eefdfd.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b68dcdfb2184b5a8050fb69a9db0c6ff8e85d7924aced564679b1dfb83eefdfd.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Users\Admin\AppData\Local\Temp\e575767.exeC:\Users\Admin\AppData\Local\Temp\e575767.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:208
-
-
C:\Users\Admin\AppData\Local\Temp\e57590d.exeC:\Users\Admin\AppData\Local\Temp\e57590d.exe4⤵
- Executes dropped EXE
PID:5024
-
-
C:\Users\Admin\AppData\Local\Temp\e578760.exeC:\Users\Admin\AppData\Local\Temp\e578760.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4092
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3540
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3732
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3828
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3924
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4012
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3860
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4448
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:2440
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:3468
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:4240
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1064
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:664
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\e575767.exe
- Size 97KB
- SHA256 4ee0d7f2cc8c3f7252f78959f82a60911676fdf048166f9311d63e9ab800bce6
- MD5 ea1739ae7d7f98f4b1d5ef23217359ae
- SHA1 bd1d5907fdd8d3ead3d189ba6bd5e6a3bd613479
- SHA512 cfe0098727d81e914f131f1904f270c93a26389ac60b237fdf4580c47d291c81c53db19df55aa54d3c8a9e199504b4f25dd951528f5611c1e16836ef7cd42b6f
- SSDEEP 1536:XH/tdwtlegO8axYtngCEye0WD8LZGHYg+1kYLfhyKTcAO4Ijuqgc:PzqcgO8axEQvYsYv7tmAO4Ijuqg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SYSTEM.INI
- Size 257B
- SHA256 ac5bf7321e95b4e1bad54887aa91c564be807796c8e42e15c0a6f5d33eee009c
- MD5 d438465d41ea17f34edd7f1b84de466e
- SHA1 e52d19750110efed361ac5f54ae6c4a60249512f
- SHA512 05b2d53348e984d4f9fbf021d4150cbea6dff2f2bb4460ccce8eac32de53c5116bb7f1ee502d68508509a755dca3a135e69e2a39f822784213d1995498a9f523
- MD5 SHA1 SHA512