Analysis
- max time kernel
148s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
29/05/2024, 01:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c15d052d14f86e0a1dfe2ca42d683e263249f9769be3d6fef7623ab41ceb4908.dll
Resource
win7-20240508-en
windows7-x64
17 signatures
150 seconds
General
- Target c15d052d14f86e0a1dfe2ca42d683e263249f9769be3d6fef7623ab41ceb4908.dll
- Size 120KB
- Sample240529-cda24aeg53
- SHA256 c15d052d14f86e0a1dfe2ca42d683e263249f9769be3d6fef7623ab41ceb4908
- MD5 e09c66983d05f9d460fd5a9a32e19912
- SHA1 5043ed21fce7db57ed056deaa26d8443fb75ab13
- SHA512 4f7b6b184b60f48ee215b338153ad26d4ad4363f5e82167e94eee39e7e855c36065620e3fe141a4202e9e7030f625005597140bfbd43df32efab269314a57029
- SSDEEP 3072:7c36f6pGHKHiUvhqilrx72+cI562WAgl:Y36ypGHlUvBlrn55a
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57609e.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57609e.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e575ac2.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e575ac2.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e575ac2.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57609e.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e575ac2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57609e.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57609e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e575ac2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e575ac2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57609e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57609e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57609e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57609e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57609e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e575ac2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e575ac2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e575ac2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e575ac2.exe - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 33 IoCs
resource yara_rule behavioral2/memory/4996-6-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-8-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-15-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-17-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-21-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-23-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-24-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-22-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-18-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-10-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-9-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-37-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-36-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-38-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-39-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-40-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-42-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-51-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-52-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-54-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-63-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-65-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-67-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-70-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-72-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-73-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-74-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-75-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-77-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-80-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-87-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4668-112-0x0000000000B30000-0x0000000001BEA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4668-130-0x0000000000B30000-0x0000000001BEA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 39 IoCs
resource yara_rule behavioral2/memory/4996-5-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4996-6-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4996-8-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4996-15-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4996-17-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4996-21-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4996-23-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4996-24-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4996-22-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4996-18-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4996-10-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4996-9-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4668-35-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4996-37-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4996-36-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4996-38-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4996-39-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4996-40-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4996-42-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/2348-50-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4996-51-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4996-52-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4996-54-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4996-63-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4996-65-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4996-67-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4996-70-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4996-72-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4996-73-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4996-74-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4996-75-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4996-77-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4996-80-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4996-100-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4996-87-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4668-112-0x0000000000B30000-0x0000000001BEA000-memory.dmp UPX behavioral2/memory/4668-131-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4668-130-0x0000000000B30000-0x0000000001BEA000-memory.dmp UPX behavioral2/memory/2348-135-0x0000000000400000-0x0000000000412000-memory.dmp UPX - Executes dropped EXE 3 IoCs
pid Process 4996 e575ac2.exe 4668 e57609e.exe 2348 e5776a7.exe -
resource yara_rule behavioral2/memory/4996-6-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4996-8-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4996-15-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4996-17-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4996-21-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4996-23-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4996-24-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4996-22-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4996-18-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4996-10-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4996-9-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4996-37-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4996-36-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4996-38-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4996-39-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4996-40-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4996-42-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4996-51-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4996-52-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4996-54-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4996-63-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4996-65-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4996-67-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4996-70-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4996-72-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4996-73-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4996-74-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4996-75-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4996-77-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4996-80-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4996-87-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4668-112-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx behavioral2/memory/4668-130-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e575ac2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57609e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57609e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57609e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57609e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57609e.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57609e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e575ac2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e575ac2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e575ac2.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e575ac2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e575ac2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57609e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e575ac2.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57609e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e575ac2.exe - Enumerates connected drives 3 TTPs 13 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: e575ac2.exe File opened (read-only) \??\M: e575ac2.exe File opened (read-only) \??\N: e575ac2.exe File opened (read-only) \??\P: e575ac2.exe File opened (read-only) \??\Q: e575ac2.exe File opened (read-only) \??\R: e575ac2.exe File opened (read-only) \??\E: e575ac2.exe File opened (read-only) \??\G: e575ac2.exe File opened (read-only) \??\I: e575ac2.exe File opened (read-only) \??\J: e575ac2.exe File opened (read-only) \??\K: e575ac2.exe File opened (read-only) \??\O: e575ac2.exe File opened (read-only) \??\L: e575ac2.exe - Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Uninstall.exe e575ac2.exe File opened for modification C:\Program Files\7-Zip\7z.exe e575ac2.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e575ac2.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e575ac2.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e575b20 e575ac2.exe File opened for modification C:\Windows\SYSTEM.INI e575ac2.exe File created C:\Windows\e57ac0f e57609e.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4996 e575ac2.exe 4996 e575ac2.exe 4996 e575ac2.exe 4996 e575ac2.exe 4668 e57609e.exe 4668 e57609e.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe Token: SeDebugPrivilege 4996 e575ac2.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2744 wrote to memory of 1076 2744 rundll32.exe 82 PID 2744 wrote to memory of 1076 2744 rundll32.exe 82 PID 2744 wrote to memory of 1076 2744 rundll32.exe 82 PID 1076 wrote to memory of 4996 1076 rundll32.exe 83 PID 1076 wrote to memory of 4996 1076 rundll32.exe 83 PID 1076 wrote to memory of 4996 1076 rundll32.exe 83 PID 4996 wrote to memory of 792 4996 e575ac2.exe 8 PID 4996 wrote to memory of 796 4996 e575ac2.exe 9 PID 4996 wrote to memory of 316 4996 e575ac2.exe 13 PID 4996 wrote to memory of 2664 4996 e575ac2.exe 44 PID 4996 wrote to memory of 2672 4996 e575ac2.exe 45 PID 4996 wrote to memory of 2792 4996 e575ac2.exe 47 PID 4996 wrote to memory of 3500 4996 e575ac2.exe 55 PID 4996 wrote to memory of 3684 4996 e575ac2.exe 57 PID 4996 wrote to memory of 3864 4996 e575ac2.exe 58 PID 4996 wrote to memory of 3960 4996 e575ac2.exe 59 PID 4996 wrote to memory of 4024 4996 e575ac2.exe 60 PID 4996 wrote to memory of 692 4996 e575ac2.exe 61 PID 4996 wrote to memory of 744 4996 e575ac2.exe 62 PID 4996 wrote to memory of 4280 4996 e575ac2.exe 64 PID 4996 wrote to memory of 1944 4996 e575ac2.exe 75 PID 4996 wrote to memory of 4868 4996 e575ac2.exe 80 PID 4996 wrote to memory of 2744 4996 e575ac2.exe 81 PID 4996 wrote to memory of 1076 4996 e575ac2.exe 82 PID 4996 wrote to memory of 1076 4996 e575ac2.exe 82 PID 1076 wrote to memory of 4668 1076 rundll32.exe 84 PID 1076 wrote to memory of 4668 1076 rundll32.exe 84 PID 1076 wrote to memory of 4668 1076 rundll32.exe 84 PID 1076 wrote to memory of 2348 1076 rundll32.exe 92 PID 1076 wrote to memory of 2348 1076 rundll32.exe 92 PID 1076 wrote to memory of 2348 1076 rundll32.exe 92 PID 4996 wrote to memory of 792 4996 e575ac2.exe 8 PID 4996 wrote to memory of 796 4996 e575ac2.exe 9 PID 4996 wrote to memory of 316 4996 e575ac2.exe 13 PID 4996 wrote to memory of 2664 4996 e575ac2.exe 44 PID 4996 wrote to memory of 2672 4996 e575ac2.exe 45 PID 4996 wrote to memory of 2792 4996 e575ac2.exe 47 PID 4996 wrote to memory of 3500 4996 e575ac2.exe 55 PID 4996 wrote to memory of 3684 4996 e575ac2.exe 57 PID 4996 wrote to memory of 3864 4996 e575ac2.exe 58 PID 4996 wrote to memory of 3960 4996 e575ac2.exe 59 PID 4996 wrote to memory of 4024 4996 e575ac2.exe 60 PID 4996 wrote to memory of 692 4996 e575ac2.exe 61 PID 4996 wrote to memory of 744 4996 e575ac2.exe 62 PID 4996 wrote to memory of 4280 4996 e575ac2.exe 64 PID 4996 wrote to memory of 1944 4996 e575ac2.exe 75 PID 4996 wrote to memory of 4668 4996 e575ac2.exe 84 PID 4996 wrote to memory of 4668 4996 e575ac2.exe 84 PID 4996 wrote to memory of 2628 4996 e575ac2.exe 86 PID 4996 wrote to memory of 4900 4996 e575ac2.exe 87 PID 4996 wrote to memory of 2348 4996 e575ac2.exe 92 PID 4996 wrote to memory of 2348 4996 e575ac2.exe 92 PID 4668 wrote to memory of 792 4668 e57609e.exe 8 PID 4668 wrote to memory of 796 4668 e57609e.exe 9 PID 4668 wrote to memory of 316 4668 e57609e.exe 13 PID 4668 wrote to memory of 2664 4668 e57609e.exe 44 PID 4668 wrote to memory of 2672 4668 e57609e.exe 45 PID 4668 wrote to memory of 2792 4668 e57609e.exe 47 PID 4668 wrote to memory of 3500 4668 e57609e.exe 55 PID 4668 wrote to memory of 3684 4668 e57609e.exe 57 PID 4668 wrote to memory of 3864 4668 e57609e.exe 58 PID 4668 wrote to memory of 3960 4668 e57609e.exe 59 PID 4668 wrote to memory of 4024 4668 e57609e.exe 60 PID 4668 wrote to memory of 692 4668 e57609e.exe 61 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e575ac2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57609e.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:792
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:796
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:316
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2664
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2672
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2792
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3500
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c15d052d14f86e0a1dfe2ca42d683e263249f9769be3d6fef7623ab41ceb4908.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c15d052d14f86e0a1dfe2ca42d683e263249f9769be3d6fef7623ab41ceb4908.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\e575ac2.exeC:\Users\Admin\AppData\Local\Temp\e575ac2.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4996
-
-
C:\Users\Admin\AppData\Local\Temp\e57609e.exeC:\Users\Admin\AppData\Local\Temp\e57609e.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4668
-
-
C:\Users\Admin\AppData\Local\Temp\e5776a7.exeC:\Users\Admin\AppData\Local\Temp\e5776a7.exe4⤵
- Executes dropped EXE
PID:2348
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3684
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3864
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3960
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4024
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:692
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:744
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4280
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:1944
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:4868
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2628
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4900
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\e575ac2.exe
- Size 97KB
- SHA256 d3528a5f6d33e51b5d8f86b71c83f26d21cfc448ad4a51e6347c47443c7762fc
- MD5 be4f049a475cdbde83341bd393629470
- SHA1 92a37712f3a2f3193d04b257864df75100c9c5aa
- SHA512 566c36f6b3a66016735f8207b8ae43d9b85da6cc97e54ab732206f219250afe6d433e1c678816948a090aba60e35c14342c3c79f5ff3ebc50a844cf2e007ac03
- SSDEEP 3072:TS5aLeoklBcNivXyn62keNTyvTP+VAZH4Rm:2ULedks9WTmr9ZHQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SYSTEM.INI
- Size 257B
- SHA256 3907d683a0d613b7c991f9ceff6ac5d0f100abf9d39235cb19ed03d64a60cac7
- MD5 3ef1f159befd84f84c608225f2b0f024
- SHA1 c125d5df6e70cada95d9e6b881e90de03a56bb57
- SHA512 e78f937af850911d88e6b2def2ea6a119381a284e83ab7e5c5f83dfe2584e0d94a79cf417d96230c98d3c7410cf2c2a8904988c76973a4871a163871ca741fd6
- MD5 SHA1 SHA512