Analysis
- max time kernel
147s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
29/05/2024, 00:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
995a699798a8ec5e8d005826b34cf87d1746c8ecd1bf0d59b01ca6a9d25a5590.dll
Resource
win7-20240220-en
windows7-x64
17 signatures
150 seconds
General
- Target 995a699798a8ec5e8d005826b34cf87d1746c8ecd1bf0d59b01ca6a9d25a5590.dll
- Size 120KB
- Sample240529-amt58abe26
- SHA256 995a699798a8ec5e8d005826b34cf87d1746c8ecd1bf0d59b01ca6a9d25a5590
- MD5 dd470f7499da1c4fafc591e40c762598
- SHA1 b1d3ab6732de08d4dca4e0167e066ac449049545
- SHA512 68c4ae7e5b03cf75664659a093c0668751acd1b55c0ef74355bf2cd9bd5a7e0a6aaeb16c64bdd97b68794a9c898d738c870d5ca41cde119baeaa22c37dd3f8a0
- SSDEEP 1536:Xa6vbzxVztOQpTodgGdzynnPYF09xL9sZYB1tTClZn2WQP9POhXy+:Xakf5pGdzIrHYOTmZ/2WD
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e575d52.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e575d52.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e575d52.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e5788c7.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e5788c7.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e5788c7.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e575d52.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5788c7.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5788c7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e575d52.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e575d52.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5788c7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5788c7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5788c7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5788c7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e575d52.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e575d52.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e575d52.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e575d52.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5788c7.exe - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 29 IoCs
resource yara_rule behavioral2/memory/1608-8-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1608-11-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1608-10-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1608-9-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1608-6-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1608-27-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1608-31-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1608-33-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1608-32-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1608-34-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1608-35-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1608-36-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1608-37-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1608-38-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1608-39-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1608-53-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1608-54-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1608-55-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1608-57-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1608-58-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1608-60-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1608-62-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1608-64-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1608-70-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1608-71-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1608-73-0x0000000000810000-0x00000000018CA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4804-95-0x0000000000800000-0x00000000018BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4804-104-0x0000000000800000-0x00000000018BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4804-147-0x0000000000800000-0x00000000018BA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 34 IoCs
resource yara_rule behavioral2/memory/1608-8-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/1608-11-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/1528-29-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/1608-10-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/1608-9-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/1608-6-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/1608-27-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/1608-31-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/1608-33-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/1608-32-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/1608-34-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/1608-35-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/1608-36-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/1608-37-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/1608-38-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/1608-39-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/4804-52-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/1608-53-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/1608-54-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/1608-55-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/1608-57-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/1608-58-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/1608-60-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/1608-62-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/1608-64-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/1608-70-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/1608-71-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/1608-90-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/1528-94-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/1608-73-0x0000000000810000-0x00000000018CA000-memory.dmp UPX behavioral2/memory/4804-95-0x0000000000800000-0x00000000018BA000-memory.dmp UPX behavioral2/memory/4804-104-0x0000000000800000-0x00000000018BA000-memory.dmp UPX behavioral2/memory/4804-147-0x0000000000800000-0x00000000018BA000-memory.dmp UPX behavioral2/memory/4804-148-0x0000000000400000-0x0000000000412000-memory.dmp UPX - Executes dropped EXE 3 IoCs
pid Process 1608 e575d52.exe 1528 e575e9b.exe 4804 e5788c7.exe -
resource yara_rule behavioral2/memory/1608-8-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/1608-11-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/1608-10-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/1608-9-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/1608-6-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/1608-27-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/1608-31-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/1608-33-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/1608-32-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/1608-34-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/1608-35-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/1608-36-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/1608-37-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/1608-38-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/1608-39-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/1608-53-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/1608-54-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/1608-55-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/1608-57-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/1608-58-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/1608-60-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/1608-62-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/1608-64-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/1608-70-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/1608-71-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/1608-73-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/4804-95-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/4804-104-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/4804-147-0x0000000000800000-0x00000000018BA000-memory.dmp upx -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e5788c7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e575d52.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e575d52.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e575d52.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5788c7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e575d52.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e575d52.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e575d52.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5788c7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5788c7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5788c7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e575d52.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5788c7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5788c7.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e575d52.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5788c7.exe - Enumerates connected drives 3 TTPs 12 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: e575d52.exe File opened (read-only) \??\G: e575d52.exe File opened (read-only) \??\I: e575d52.exe File opened (read-only) \??\J: e575d52.exe File opened (read-only) \??\K: e575d52.exe File opened (read-only) \??\G: e5788c7.exe File opened (read-only) \??\H: e5788c7.exe File opened (read-only) \??\I: e5788c7.exe File opened (read-only) \??\E: e575d52.exe File opened (read-only) \??\H: e575d52.exe File opened (read-only) \??\M: e575d52.exe File opened (read-only) \??\E: e5788c7.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e575dcf e575d52.exe File opened for modification C:\Windows\SYSTEM.INI e575d52.exe File created C:\Windows\e57b120 e5788c7.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1608 e575d52.exe 1608 e575d52.exe 1608 e575d52.exe 1608 e575d52.exe 4804 e5788c7.exe 4804 e5788c7.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe Token: SeDebugPrivilege 1608 e575d52.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1616 wrote to memory of 4228 1616 rundll32.exe 83 PID 1616 wrote to memory of 4228 1616 rundll32.exe 83 PID 1616 wrote to memory of 4228 1616 rundll32.exe 83 PID 4228 wrote to memory of 1608 4228 rundll32.exe 84 PID 4228 wrote to memory of 1608 4228 rundll32.exe 84 PID 4228 wrote to memory of 1608 4228 rundll32.exe 84 PID 1608 wrote to memory of 788 1608 e575d52.exe 9 PID 1608 wrote to memory of 796 1608 e575d52.exe 10 PID 1608 wrote to memory of 1016 1608 e575d52.exe 13 PID 1608 wrote to memory of 2556 1608 e575d52.exe 42 PID 1608 wrote to memory of 2588 1608 e575d52.exe 43 PID 1608 wrote to memory of 2688 1608 e575d52.exe 47 PID 1608 wrote to memory of 3480 1608 e575d52.exe 56 PID 1608 wrote to memory of 3644 1608 e575d52.exe 57 PID 1608 wrote to memory of 3848 1608 e575d52.exe 58 PID 1608 wrote to memory of 3976 1608 e575d52.exe 59 PID 1608 wrote to memory of 4064 1608 e575d52.exe 60 PID 1608 wrote to memory of 1512 1608 e575d52.exe 61 PID 1608 wrote to memory of 4204 1608 e575d52.exe 62 PID 1608 wrote to memory of 4536 1608 e575d52.exe 64 PID 1608 wrote to memory of 4616 1608 e575d52.exe 75 PID 1608 wrote to memory of 4348 1608 e575d52.exe 80 PID 1608 wrote to memory of 2632 1608 e575d52.exe 81 PID 1608 wrote to memory of 1616 1608 e575d52.exe 82 PID 1608 wrote to memory of 4228 1608 e575d52.exe 83 PID 1608 wrote to memory of 4228 1608 e575d52.exe 83 PID 4228 wrote to memory of 1528 4228 rundll32.exe 85 PID 4228 wrote to memory of 1528 4228 rundll32.exe 85 PID 4228 wrote to memory of 1528 4228 rundll32.exe 85 PID 1608 wrote to memory of 788 1608 e575d52.exe 9 PID 1608 wrote to memory of 796 1608 e575d52.exe 10 PID 1608 wrote to memory of 1016 1608 e575d52.exe 13 PID 1608 wrote to memory of 2556 1608 e575d52.exe 42 PID 1608 wrote to memory of 2588 1608 e575d52.exe 43 PID 1608 wrote to memory of 2688 1608 e575d52.exe 47 PID 1608 wrote to memory of 3480 1608 e575d52.exe 56 PID 1608 wrote to memory of 3644 1608 e575d52.exe 57 PID 1608 wrote to memory of 3848 1608 e575d52.exe 58 PID 1608 wrote to memory of 3976 1608 e575d52.exe 59 PID 1608 wrote to memory of 4064 1608 e575d52.exe 60 PID 1608 wrote to memory of 1512 1608 e575d52.exe 61 PID 1608 wrote to memory of 4204 1608 e575d52.exe 62 PID 1608 wrote to memory of 4536 1608 e575d52.exe 64 PID 1608 wrote to memory of 4616 1608 e575d52.exe 75 PID 1608 wrote to memory of 4348 1608 e575d52.exe 80 PID 1608 wrote to memory of 2632 1608 e575d52.exe 81 PID 1608 wrote to memory of 1616 1608 e575d52.exe 82 PID 1608 wrote to memory of 1528 1608 e575d52.exe 85 PID 1608 wrote to memory of 1528 1608 e575d52.exe 85 PID 4228 wrote to memory of 4804 4228 rundll32.exe 89 PID 4228 wrote to memory of 4804 4228 rundll32.exe 89 PID 4228 wrote to memory of 4804 4228 rundll32.exe 89 PID 4804 wrote to memory of 788 4804 e5788c7.exe 9 PID 4804 wrote to memory of 796 4804 e5788c7.exe 10 PID 4804 wrote to memory of 1016 4804 e5788c7.exe 13 PID 4804 wrote to memory of 2556 4804 e5788c7.exe 42 PID 4804 wrote to memory of 2588 4804 e5788c7.exe 43 PID 4804 wrote to memory of 2688 4804 e5788c7.exe 47 PID 4804 wrote to memory of 3480 4804 e5788c7.exe 56 PID 4804 wrote to memory of 3644 4804 e5788c7.exe 57 PID 4804 wrote to memory of 3848 4804 e5788c7.exe 58 PID 4804 wrote to memory of 3976 4804 e5788c7.exe 59 PID 4804 wrote to memory of 4064 4804 e5788c7.exe 60 PID 4804 wrote to memory of 1512 4804 e5788c7.exe 61 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e575d52.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5788c7.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:796
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1016
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2556
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2588
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2688
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3480
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\995a699798a8ec5e8d005826b34cf87d1746c8ecd1bf0d59b01ca6a9d25a5590.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\995a699798a8ec5e8d005826b34cf87d1746c8ecd1bf0d59b01ca6a9d25a5590.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\e575d52.exeC:\Users\Admin\AppData\Local\Temp\e575d52.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1608
-
-
C:\Users\Admin\AppData\Local\Temp\e575e9b.exeC:\Users\Admin\AppData\Local\Temp\e575e9b.exe4⤵
- Executes dropped EXE
PID:1528
-
-
C:\Users\Admin\AppData\Local\Temp\e5788c7.exeC:\Users\Admin\AppData\Local\Temp\e5788c7.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4804
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3644
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3848
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3976
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4064
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1512
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4204
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4536
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4616
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:4348
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:2632
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4640
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:808
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\e575d52.exe
- Size 97KB
- SHA256 6ef3a53f44cba3d536923fdcd988619cacf9b373d091041cf192b7e74c76fa91
- MD5 3cba93e4a539c94eb00f97ae8aeeeb21
- SHA1 68794f6115a3bf263aad7938fb921dd143100113
- SHA512 ecc4072e0398f7bfd1c74943df7917e622569f9feb4695e91d54588dc856cd2c5293d9fc710934a4f8fbef9de4480e1c6f48c03d094b6104f3841e806fc58d1d
- SSDEEP 1536:CdpBGhE7hBXhx8OafnAwCee2X35n+vMZyCPIrl9G7x/u:C36E7hBwfnAAes5n+nWIZk
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SYSTEM.INI
- Size 257B
- SHA256 615d794a9973276f6c92ba1a2f04f9007132d19181cbcca9ced716a6b14f851c
- MD5 f29500eb2365c39977d03e8317e86013
- SHA1 36c5ad000bf0b364b8e1d48e34942d0c206c8261
- SHA512 fcea48c7c09491bde7aeb621e4982c2c62196c82b670da8b4e3f045f786cc9250a34cd9d18df577874843ef5e7f0fe87c016c174aee16827141bc9579324df86
- MD5 SHA1 SHA512