Analysis
- max time kernel
142s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
29/05/2024, 03:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
eeeaafb4640cbb1536e7f446bac3d938d720b07e80157d72ad7ca4bc4cce64b8.dll
Resource
win7-20240221-en
windows7-x64
17 signatures
150 seconds
General
- Target eeeaafb4640cbb1536e7f446bac3d938d720b07e80157d72ad7ca4bc4cce64b8.dll
- Size 120KB
- Sample240529-ee82mahe51
- SHA256 eeeaafb4640cbb1536e7f446bac3d938d720b07e80157d72ad7ca4bc4cce64b8
- MD5 95d04a4981aaee982d5e59d3e28b17f8
- SHA1 236e39073d2ba5a27e180d1264a88e29c8386c4e
- SHA512 0b9a231207f31205d5447fb50cbc21462da5cd3a5c9dbd1a668185950ff93dffc7a663ee16cbf451a352cc2f81f19ca718020d344593c4fa804ac7c90f9c7dea
- SSDEEP 1536:bKdezYtJky738STOBzaFCXtgj3A/Z7qGSo63IVHk/R4+ECI9:bKdeMtz7LTGzaFCXtGQ/oZzYVH629C
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e581587.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57ffad.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57ffad.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57ffad.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e581587.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e581587.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57ffad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e581587.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e581587.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e581587.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57ffad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57ffad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57ffad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57ffad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e581587.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e581587.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57ffad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57ffad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e581587.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e581587.exe - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 29 IoCs
resource yara_rule behavioral2/memory/4996-6-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-10-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-11-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-15-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-16-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-14-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-13-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-12-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-8-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-9-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-37-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-36-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-38-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-39-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-40-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-50-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-51-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-53-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-54-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-58-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-66-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-70-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-73-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-75-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-76-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-78-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4996-99-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5388-109-0x0000000000B50000-0x0000000001C0A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5388-133-0x0000000000B50000-0x0000000001C0A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 32 IoCs
resource yara_rule behavioral2/memory/4996-6-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4996-10-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4996-11-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4996-15-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4996-16-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4996-14-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4996-13-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4996-12-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4996-8-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4996-9-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4996-37-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4996-36-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4996-38-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4996-39-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4996-40-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4996-50-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4996-51-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4996-53-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4996-54-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4996-58-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4996-66-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4996-70-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4996-73-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4996-75-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4996-76-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4996-78-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4996-98-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4996-99-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4176-104-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/5388-109-0x0000000000B50000-0x0000000001C0A000-memory.dmp UPX behavioral2/memory/5388-134-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/5388-133-0x0000000000B50000-0x0000000001C0A000-memory.dmp UPX - Executes dropped EXE 3 IoCs
pid Process 4996 e57ffad.exe 4176 e5805a8.exe 5388 e581587.exe -
resource yara_rule behavioral2/memory/4996-6-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4996-10-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4996-11-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4996-15-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4996-16-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4996-14-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4996-13-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4996-12-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4996-8-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4996-9-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4996-37-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4996-36-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4996-38-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4996-39-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4996-40-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4996-50-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4996-51-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4996-53-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4996-54-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4996-58-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4996-66-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4996-70-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4996-73-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4996-75-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4996-76-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4996-78-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4996-99-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/5388-109-0x0000000000B50000-0x0000000001C0A000-memory.dmp upx behavioral2/memory/5388-133-0x0000000000B50000-0x0000000001C0A000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e581587.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e581587.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57ffad.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57ffad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e581587.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e581587.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57ffad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e581587.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e581587.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e581587.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57ffad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57ffad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57ffad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57ffad.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57ffad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e581587.exe - Enumerates connected drives 3 TTPs 11 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: e57ffad.exe File opened (read-only) \??\J: e57ffad.exe File opened (read-only) \??\L: e57ffad.exe File opened (read-only) \??\M: e57ffad.exe File opened (read-only) \??\N: e57ffad.exe File opened (read-only) \??\E: e57ffad.exe File opened (read-only) \??\I: e57ffad.exe File opened (read-only) \??\K: e57ffad.exe File opened (read-only) \??\O: e57ffad.exe File opened (read-only) \??\P: e57ffad.exe File opened (read-only) \??\G: e57ffad.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e58026c e57ffad.exe File opened for modification C:\Windows\SYSTEM.INI e57ffad.exe File created C:\Windows\e586099 e581587.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4996 e57ffad.exe 4996 e57ffad.exe 4996 e57ffad.exe 4996 e57ffad.exe 5388 e581587.exe 5388 e581587.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe Token: SeDebugPrivilege 4996 e57ffad.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3812 wrote to memory of 656 3812 rundll32.exe 93 PID 3812 wrote to memory of 656 3812 rundll32.exe 93 PID 3812 wrote to memory of 656 3812 rundll32.exe 93 PID 656 wrote to memory of 4996 656 rundll32.exe 94 PID 656 wrote to memory of 4996 656 rundll32.exe 94 PID 656 wrote to memory of 4996 656 rundll32.exe 94 PID 4996 wrote to memory of 800 4996 e57ffad.exe 9 PID 4996 wrote to memory of 804 4996 e57ffad.exe 10 PID 4996 wrote to memory of 384 4996 e57ffad.exe 13 PID 4996 wrote to memory of 2432 4996 e57ffad.exe 41 PID 4996 wrote to memory of 2444 4996 e57ffad.exe 42 PID 4996 wrote to memory of 2572 4996 e57ffad.exe 45 PID 4996 wrote to memory of 3196 4996 e57ffad.exe 56 PID 4996 wrote to memory of 3484 4996 e57ffad.exe 57 PID 4996 wrote to memory of 3736 4996 e57ffad.exe 58 PID 4996 wrote to memory of 3828 4996 e57ffad.exe 59 PID 4996 wrote to memory of 3928 4996 e57ffad.exe 60 PID 4996 wrote to memory of 4028 4996 e57ffad.exe 61 PID 4996 wrote to memory of 3612 4996 e57ffad.exe 62 PID 4996 wrote to memory of 4624 4996 e57ffad.exe 64 PID 4996 wrote to memory of 3668 4996 e57ffad.exe 74 PID 4996 wrote to memory of 2868 4996 e57ffad.exe 75 PID 4996 wrote to memory of 1592 4996 e57ffad.exe 77 PID 4996 wrote to memory of 4604 4996 e57ffad.exe 78 PID 4996 wrote to memory of 3172 4996 e57ffad.exe 79 PID 4996 wrote to memory of 3580 4996 e57ffad.exe 80 PID 4996 wrote to memory of 920 4996 e57ffad.exe 81 PID 4996 wrote to memory of 5620 4996 e57ffad.exe 83 PID 4996 wrote to memory of 5636 4996 e57ffad.exe 84 PID 4996 wrote to memory of 3812 4996 e57ffad.exe 92 PID 4996 wrote to memory of 656 4996 e57ffad.exe 93 PID 4996 wrote to memory of 656 4996 e57ffad.exe 93 PID 656 wrote to memory of 4176 656 rundll32.exe 95 PID 656 wrote to memory of 4176 656 rundll32.exe 95 PID 656 wrote to memory of 4176 656 rundll32.exe 95 PID 656 wrote to memory of 5388 656 rundll32.exe 96 PID 656 wrote to memory of 5388 656 rundll32.exe 96 PID 656 wrote to memory of 5388 656 rundll32.exe 96 PID 4996 wrote to memory of 800 4996 e57ffad.exe 9 PID 4996 wrote to memory of 804 4996 e57ffad.exe 10 PID 4996 wrote to memory of 384 4996 e57ffad.exe 13 PID 4996 wrote to memory of 2432 4996 e57ffad.exe 41 PID 4996 wrote to memory of 2444 4996 e57ffad.exe 42 PID 4996 wrote to memory of 2572 4996 e57ffad.exe 45 PID 4996 wrote to memory of 3196 4996 e57ffad.exe 56 PID 4996 wrote to memory of 3484 4996 e57ffad.exe 57 PID 4996 wrote to memory of 3736 4996 e57ffad.exe 58 PID 4996 wrote to memory of 3828 4996 e57ffad.exe 59 PID 4996 wrote to memory of 3928 4996 e57ffad.exe 60 PID 4996 wrote to memory of 4028 4996 e57ffad.exe 61 PID 4996 wrote to memory of 3612 4996 e57ffad.exe 62 PID 4996 wrote to memory of 4624 4996 e57ffad.exe 64 PID 4996 wrote to memory of 3668 4996 e57ffad.exe 74 PID 4996 wrote to memory of 2868 4996 e57ffad.exe 75 PID 4996 wrote to memory of 1592 4996 e57ffad.exe 77 PID 4996 wrote to memory of 4604 4996 e57ffad.exe 78 PID 4996 wrote to memory of 3172 4996 e57ffad.exe 79 PID 4996 wrote to memory of 3580 4996 e57ffad.exe 80 PID 4996 wrote to memory of 920 4996 e57ffad.exe 81 PID 4996 wrote to memory of 5620 4996 e57ffad.exe 83 PID 4996 wrote to memory of 5636 4996 e57ffad.exe 84 PID 4996 wrote to memory of 4176 4996 e57ffad.exe 95 PID 4996 wrote to memory of 4176 4996 e57ffad.exe 95 PID 4996 wrote to memory of 5388 4996 e57ffad.exe 96 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57ffad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e581587.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:800
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:804
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:384
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2432
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2444
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2572
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3196
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\eeeaafb4640cbb1536e7f446bac3d938d720b07e80157d72ad7ca4bc4cce64b8.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\eeeaafb4640cbb1536e7f446bac3d938d720b07e80157d72ad7ca4bc4cce64b8.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Users\Admin\AppData\Local\Temp\e57ffad.exeC:\Users\Admin\AppData\Local\Temp\e57ffad.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4996
-
-
C:\Users\Admin\AppData\Local\Temp\e5805a8.exeC:\Users\Admin\AppData\Local\Temp\e5805a8.exe4⤵
- Executes dropped EXE
PID:4176
-
-
C:\Users\Admin\AppData\Local\Temp\e581587.exeC:\Users\Admin\AppData\Local\Temp\e581587.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- System policy modification
PID:5388
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3484
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3736
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3828
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3928
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4028
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3612
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4624
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:3668
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2868
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window1⤵PID:1592
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffd7c282e98,0x7ffd7c282ea4,0x7ffd7c282eb02⤵PID:4604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2276 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:22⤵PID:3172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2340 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:32⤵PID:3580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2520 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:82⤵PID:920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --mojo-platform-channel-handle=5312 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:12⤵PID:5620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=5568 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:12⤵PID:5636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3908 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:82⤵PID:5052
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\e57ffad.exe
- Size 97KB
- SHA256 9f2686d8b037d820bcb8c225fbb3309d89884d5a33d8ade0770bbd081d78d3cb
- MD5 37885a70323011352c3372aa26be1adf
- SHA1 ec004f36320ae98f8fbf699a30752aac232e9485
- SHA512 e38c188e21c58ef4fa3db68750e30f1c4435f54c7d32c9a07f7316632a97d9f6b305dbdc3f57c86feae9b57f77b8f910b675b9ebca1191db66cf5508f6787a44
- SSDEEP 1536:xgCFkLDJe0ugUacNkMLuEDp2PCSvkyTKAt1ihz+gn0RvU8UPXZ5Cj0wv:jkLD7hD0uiIqSvkai9F0lUdfCjtv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SYSTEM.INI
- Size 255B
- SHA256 f36233fe1513eff38a519dd4f858d1c610508bb0da8bf66c29fa03391aacc888
- MD5 d2a0d637400995176b4ee05363af9d56
- SHA1 c759bbe669499604e3a660488149b2b55af9a959
- SHA512 75ad99036bf4f1c46bc1530f396f9d00dbde2bb397185d47e7a127805f317ed39e63360294b4a50107a0c37f86994b30d603845cbc0681edccd1306e11bb8a23
- MD5 SHA1 SHA512