Analysis
- max time kernel
93s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
29/05/2024, 02:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c48e1c16baf853b2b4c0fb81711f5eb2bcac9d5ee970376facfb4efb0d094e28.dll
Resource
win7-20240221-en
windows7-x64
17 signatures
150 seconds
General
- Target c48e1c16baf853b2b4c0fb81711f5eb2bcac9d5ee970376facfb4efb0d094e28.dll
- Size 120KB
- Sample240529-chpq2sfa78
- SHA256 c48e1c16baf853b2b4c0fb81711f5eb2bcac9d5ee970376facfb4efb0d094e28
- MD5 4ea451f141767fdcb54c553e43e8334e
- SHA1 eb947bdf0258435b1882277c8f490ab055f24ff9
- SHA512 c939489f875dc8114f0aad8caef8595d0d1d77113c89ad4be9c0848bb239db48288e98aa70bc467d20e7f3b2991586cac10ce4c2500b08ad097deab351066b03
- SSDEEP 3072:6daWzpyumPP7u8Q7ApWaDcn64LD/+1S31WAsGiq:6da8UK8QzsW6im1tfGiq
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57688d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57688d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57688d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e578414.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e578414.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e578414.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57688d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578414.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e578414.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e578414.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e578414.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57688d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57688d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57688d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e578414.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e578414.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e578414.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57688d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57688d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57688d.exe - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 34 IoCs
resource yara_rule behavioral2/memory/4296-6-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4296-9-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4296-8-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4296-11-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4296-17-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4296-21-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4296-20-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4296-19-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4296-18-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4296-10-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4296-31-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4296-37-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4296-38-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4296-39-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4296-40-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4296-41-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4296-43-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4296-44-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4296-53-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4296-55-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4296-56-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4296-64-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4296-68-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4296-71-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4296-73-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4296-75-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4296-77-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4296-78-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4296-85-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4296-84-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4296-86-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4296-87-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4296-94-0x0000000000780000-0x000000000183A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3460-154-0x0000000000B50000-0x0000000001C0A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 40 IoCs
resource yara_rule behavioral2/memory/4296-6-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/4296-9-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/4296-8-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/4296-11-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/4296-17-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/1560-36-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4296-21-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/4296-20-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/4296-19-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/4296-18-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/4296-10-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/4296-31-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/4296-37-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/4296-38-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/4296-39-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/4296-40-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/4296-41-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/4296-43-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/4296-44-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/3460-52-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4296-53-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/4296-55-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/4296-56-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/4296-64-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/4296-68-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/4296-71-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/4296-73-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/4296-75-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/4296-77-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/4296-78-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/4296-85-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/4296-84-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/4296-86-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/4296-87-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/4296-94-0x0000000000780000-0x000000000183A000-memory.dmp UPX behavioral2/memory/4296-108-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/1560-112-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/3460-115-0x0000000000B50000-0x0000000001C0A000-memory.dmp UPX behavioral2/memory/3460-154-0x0000000000B50000-0x0000000001C0A000-memory.dmp UPX behavioral2/memory/3460-155-0x0000000000400000-0x0000000000412000-memory.dmp UPX - Executes dropped EXE 3 IoCs
pid Process 4296 e57688d.exe 1560 e576a81.exe 3460 e578414.exe -
resource yara_rule behavioral2/memory/4296-6-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/4296-9-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/4296-8-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/4296-11-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/4296-17-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/4296-21-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/4296-20-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/4296-19-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/4296-18-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/4296-10-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/4296-31-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/4296-37-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/4296-38-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/4296-39-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/4296-40-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/4296-41-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/4296-43-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/4296-44-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/4296-53-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/4296-55-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/4296-56-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/4296-64-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/4296-68-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/4296-71-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/4296-73-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/4296-75-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/4296-77-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/4296-78-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/4296-85-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/4296-84-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/4296-86-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/4296-87-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/4296-94-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/3460-115-0x0000000000B50000-0x0000000001C0A000-memory.dmp upx behavioral2/memory/3460-154-0x0000000000B50000-0x0000000001C0A000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57688d.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57688d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57688d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e578414.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e578414.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e578414.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e578414.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e578414.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57688d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57688d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57688d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57688d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e578414.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e578414.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57688d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578414.exe - Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: e57688d.exe File opened (read-only) \??\K: e57688d.exe File opened (read-only) \??\M: e57688d.exe File opened (read-only) \??\S: e57688d.exe File opened (read-only) \??\H: e57688d.exe File opened (read-only) \??\L: e57688d.exe File opened (read-only) \??\N: e57688d.exe File opened (read-only) \??\P: e57688d.exe File opened (read-only) \??\Q: e57688d.exe File opened (read-only) \??\R: e57688d.exe File opened (read-only) \??\E: e57688d.exe File opened (read-only) \??\J: e57688d.exe File opened (read-only) \??\E: e578414.exe File opened (read-only) \??\G: e57688d.exe File opened (read-only) \??\O: e57688d.exe - Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7zFM.exe e57688d.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e57688d.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe e57688d.exe File opened for modification C:\Program Files\7-Zip\7z.exe e57688d.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e5768dc e57688d.exe File opened for modification C:\Windows\SYSTEM.INI e57688d.exe File created C:\Windows\e57b9ca e578414.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4296 e57688d.exe 4296 e57688d.exe 4296 e57688d.exe 4296 e57688d.exe 3460 e578414.exe 3460 e578414.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe Token: SeDebugPrivilege 4296 e57688d.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4616 wrote to memory of 4464 4616 rundll32.exe 84 PID 4616 wrote to memory of 4464 4616 rundll32.exe 84 PID 4616 wrote to memory of 4464 4616 rundll32.exe 84 PID 4464 wrote to memory of 4296 4464 rundll32.exe 85 PID 4464 wrote to memory of 4296 4464 rundll32.exe 85 PID 4464 wrote to memory of 4296 4464 rundll32.exe 85 PID 4296 wrote to memory of 756 4296 e57688d.exe 8 PID 4296 wrote to memory of 764 4296 e57688d.exe 9 PID 4296 wrote to memory of 1020 4296 e57688d.exe 13 PID 4296 wrote to memory of 2784 4296 e57688d.exe 49 PID 4296 wrote to memory of 2876 4296 e57688d.exe 50 PID 4296 wrote to memory of 2708 4296 e57688d.exe 52 PID 4296 wrote to memory of 3316 4296 e57688d.exe 55 PID 4296 wrote to memory of 3568 4296 e57688d.exe 57 PID 4296 wrote to memory of 3756 4296 e57688d.exe 58 PID 4296 wrote to memory of 3856 4296 e57688d.exe 59 PID 4296 wrote to memory of 3920 4296 e57688d.exe 60 PID 4296 wrote to memory of 4008 4296 e57688d.exe 61 PID 4296 wrote to memory of 4124 4296 e57688d.exe 62 PID 4296 wrote to memory of 4392 4296 e57688d.exe 74 PID 4296 wrote to memory of 3012 4296 e57688d.exe 75 PID 4296 wrote to memory of 1600 4296 e57688d.exe 82 PID 4296 wrote to memory of 4616 4296 e57688d.exe 83 PID 4296 wrote to memory of 4464 4296 e57688d.exe 84 PID 4296 wrote to memory of 4464 4296 e57688d.exe 84 PID 4464 wrote to memory of 1560 4464 rundll32.exe 86 PID 4464 wrote to memory of 1560 4464 rundll32.exe 86 PID 4464 wrote to memory of 1560 4464 rundll32.exe 86 PID 4464 wrote to memory of 3460 4464 rundll32.exe 95 PID 4464 wrote to memory of 3460 4464 rundll32.exe 95 PID 4464 wrote to memory of 3460 4464 rundll32.exe 95 PID 4296 wrote to memory of 756 4296 e57688d.exe 8 PID 4296 wrote to memory of 764 4296 e57688d.exe 9 PID 4296 wrote to memory of 1020 4296 e57688d.exe 13 PID 4296 wrote to memory of 2784 4296 e57688d.exe 49 PID 4296 wrote to memory of 2876 4296 e57688d.exe 50 PID 4296 wrote to memory of 2708 4296 e57688d.exe 52 PID 4296 wrote to memory of 3316 4296 e57688d.exe 55 PID 4296 wrote to memory of 3568 4296 e57688d.exe 57 PID 4296 wrote to memory of 3756 4296 e57688d.exe 58 PID 4296 wrote to memory of 3856 4296 e57688d.exe 59 PID 4296 wrote to memory of 3920 4296 e57688d.exe 60 PID 4296 wrote to memory of 4008 4296 e57688d.exe 61 PID 4296 wrote to memory of 4124 4296 e57688d.exe 62 PID 4296 wrote to memory of 4392 4296 e57688d.exe 74 PID 4296 wrote to memory of 3012 4296 e57688d.exe 75 PID 4296 wrote to memory of 1560 4296 e57688d.exe 86 PID 4296 wrote to memory of 1560 4296 e57688d.exe 86 PID 4296 wrote to memory of 3936 4296 e57688d.exe 88 PID 4296 wrote to memory of 2004 4296 e57688d.exe 89 PID 4296 wrote to memory of 3460 4296 e57688d.exe 95 PID 4296 wrote to memory of 3460 4296 e57688d.exe 95 PID 3460 wrote to memory of 756 3460 e578414.exe 8 PID 3460 wrote to memory of 764 3460 e578414.exe 9 PID 3460 wrote to memory of 1020 3460 e578414.exe 13 PID 3460 wrote to memory of 2784 3460 e578414.exe 49 PID 3460 wrote to memory of 2876 3460 e578414.exe 50 PID 3460 wrote to memory of 2708 3460 e578414.exe 52 PID 3460 wrote to memory of 3316 3460 e578414.exe 55 PID 3460 wrote to memory of 3568 3460 e578414.exe 57 PID 3460 wrote to memory of 3756 3460 e578414.exe 58 PID 3460 wrote to memory of 3856 3460 e578414.exe 59 PID 3460 wrote to memory of 3920 3460 e578414.exe 60 PID 3460 wrote to memory of 4008 3460 e578414.exe 61 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57688d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578414.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:756
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:764
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1020
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2784
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2876
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2708
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3316
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c48e1c16baf853b2b4c0fb81711f5eb2bcac9d5ee970376facfb4efb0d094e28.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c48e1c16baf853b2b4c0fb81711f5eb2bcac9d5ee970376facfb4efb0d094e28.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\e57688d.exeC:\Users\Admin\AppData\Local\Temp\e57688d.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4296
-
-
C:\Users\Admin\AppData\Local\Temp\e576a81.exeC:\Users\Admin\AppData\Local\Temp\e576a81.exe4⤵
- Executes dropped EXE
PID:1560
-
-
C:\Users\Admin\AppData\Local\Temp\e578414.exeC:\Users\Admin\AppData\Local\Temp\e578414.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3460
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3568
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3756
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3856
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3920
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4008
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4124
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4392
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3012
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:1600
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3936
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2004
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\e57688d.exe
- Size 97KB
- SHA256 bdd1c11e3f9953598057367301cc33ccbb080846f8851a127a60b9417306ca38
- MD5 b1ba97b6047d9c2548b063bad821f165
- SHA1 a55d510a548bcdcd80c33aefb80061391b46295d
- SHA512 2a40ad1269c8843f8ec0d303713f703de8fe6d84101ff8afb8b99f67938531893d7bf7c765a1ad7de328ed998995d37af8bb6053c18108cd021ef3d2a643bc57
- SSDEEP 1536:ezKPTwX1HvchUKMglfFOonIgy6E5/tVHOEvzvu0qLAP3:ezKPTQ1Hv0UKMglDI/HOEvbwAP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SYSTEM.INI
- Size 257B
- SHA256 79b0f19d5b28a7185617d0e5365a126551afa6ec5958046e1b6f0a927234b983
- MD5 949ec57c446b086de87ebcf7be8ab5a1
- SHA1 b87d3095606d45445ddd389d88200a916ebd7360
- SHA512 972ac3d1627ec59b850415904a2d753385481b8b8157b60dab494e89bd0e5aced91a41cadd20fd4326f8005289b6aa4f5f39d1a9c09c2a77467dacad8791a7dc
- MD5 SHA1 SHA512