Analysis
-
max time kernel
123s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
30-05-2024 01:12
Static task
static1
Behavioral task
behavioral1
Sample
cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe
Resource
win7-20240221-en
General
-
Target
cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe
-
Size
4.0MB
-
MD5
bdab2b15593722adafd73ba2d26ae718
-
SHA1
27f4f056c95b461247f04deda34c6f03554df2a5
-
SHA256
cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a
-
SHA512
6cbb5bdc7075c11a3a19e465b1a74caefa4b90eb71e7d97ca37a3bd3f37a0c78e48530222372c14833dafddd7e4bf7f76d4886fe6c86bd7f826002bc16515c7e
-
SSDEEP
98304:rVZj1RH+mvYUhV6whv+L4pikdbHE9QXA/7Z:r7++YlWdXS9
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe -
Processes:
cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe -
Processes:
cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe -
Processes:
resource yara_rule behavioral1/memory/2252-3-0x0000000002230000-0x00000000032EA000-memory.dmp upx behavioral1/memory/2252-4-0x0000000002230000-0x00000000032EA000-memory.dmp upx behavioral1/memory/2252-7-0x0000000002230000-0x00000000032EA000-memory.dmp upx behavioral1/memory/2252-10-0x0000000002230000-0x00000000032EA000-memory.dmp upx behavioral1/memory/2252-12-0x0000000002230000-0x00000000032EA000-memory.dmp upx behavioral1/memory/2252-9-0x0000000002230000-0x00000000032EA000-memory.dmp upx behavioral1/memory/2252-8-0x0000000002230000-0x00000000032EA000-memory.dmp upx behavioral1/memory/2252-6-0x0000000002230000-0x00000000032EA000-memory.dmp upx behavioral1/memory/2252-5-0x0000000002230000-0x00000000032EA000-memory.dmp upx behavioral1/memory/2252-32-0x0000000002230000-0x00000000032EA000-memory.dmp upx behavioral1/memory/2252-33-0x0000000002230000-0x00000000032EA000-memory.dmp upx behavioral1/memory/2252-11-0x0000000002230000-0x00000000032EA000-memory.dmp upx behavioral1/memory/2252-34-0x0000000002230000-0x00000000032EA000-memory.dmp upx behavioral1/memory/2252-36-0x0000000002230000-0x00000000032EA000-memory.dmp upx behavioral1/memory/2252-35-0x0000000002230000-0x00000000032EA000-memory.dmp upx behavioral1/memory/2252-38-0x0000000002230000-0x00000000032EA000-memory.dmp upx behavioral1/memory/2252-39-0x0000000002230000-0x00000000032EA000-memory.dmp upx behavioral1/memory/2252-40-0x0000000002230000-0x00000000032EA000-memory.dmp upx behavioral1/memory/2252-41-0x0000000002230000-0x00000000032EA000-memory.dmp upx behavioral1/memory/2252-43-0x0000000002230000-0x00000000032EA000-memory.dmp upx behavioral1/memory/2252-45-0x0000000002230000-0x00000000032EA000-memory.dmp upx behavioral1/memory/2252-62-0x0000000002230000-0x00000000032EA000-memory.dmp upx behavioral1/memory/2252-64-0x0000000002230000-0x00000000032EA000-memory.dmp upx behavioral1/memory/2252-67-0x0000000002230000-0x00000000032EA000-memory.dmp upx behavioral1/memory/2252-70-0x0000000002230000-0x00000000032EA000-memory.dmp upx behavioral1/memory/2252-75-0x0000000002230000-0x00000000032EA000-memory.dmp upx behavioral1/memory/2252-76-0x0000000002230000-0x00000000032EA000-memory.dmp upx behavioral1/memory/2252-84-0x0000000002230000-0x00000000032EA000-memory.dmp upx behavioral1/memory/2252-103-0x0000000002230000-0x00000000032EA000-memory.dmp upx -
Processes:
cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe -
Processes:
cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exedescription ioc process File opened (read-only) \??\G: cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe File opened (read-only) \??\L: cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe File opened (read-only) \??\N: cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe File opened (read-only) \??\T: cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe File opened (read-only) \??\U: cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe File opened (read-only) \??\W: cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe File opened (read-only) \??\I: cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe File opened (read-only) \??\O: cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe File opened (read-only) \??\K: cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe File opened (read-only) \??\M: cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe File opened (read-only) \??\P: cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe File opened (read-only) \??\S: cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe File opened (read-only) \??\Z: cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe File opened (read-only) \??\E: cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe File opened (read-only) \??\H: cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe File opened (read-only) \??\J: cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe File opened (read-only) \??\Q: cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe File opened (read-only) \??\R: cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe File opened (read-only) \??\V: cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe File opened (read-only) \??\X: cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe File opened (read-only) \??\Y: cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exedescription ioc process File opened for modification F:\autorun.inf cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe File opened for modification C:\autorun.inf cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe -
Drops file in Program Files directory 5 IoCs
Processes:
cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe File opened for modification C:\Program Files\7-Zip\7z.exe cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe File opened for modification C:\Program Files\7-Zip\7zG.exe cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe -
Drops file in Windows directory 2 IoCs
Processes:
cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exedescription ioc process File created C:\Windows\f762f2b cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe File opened for modification C:\Windows\SYSTEM.INI cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exepid process 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe -
Suspicious use of AdjustPrivilegeToken 32 IoCs
Processes:
cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exedescription pid process Token: SeDebugPrivilege 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Token: SeDebugPrivilege 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Token: SeDebugPrivilege 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Token: SeDebugPrivilege 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Token: SeDebugPrivilege 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Token: SeDebugPrivilege 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Token: SeDebugPrivilege 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Token: SeDebugPrivilege 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Token: SeDebugPrivilege 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Token: SeDebugPrivilege 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Token: SeDebugPrivilege 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Token: SeDebugPrivilege 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Token: SeDebugPrivilege 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Token: SeDebugPrivilege 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Token: SeDebugPrivilege 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Token: SeDebugPrivilege 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Token: SeDebugPrivilege 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Token: SeDebugPrivilege 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Token: SeDebugPrivilege 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Token: SeDebugPrivilege 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Token: SeDebugPrivilege 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Token: SeDebugPrivilege 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Token: SeDebugPrivilege 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Token: SeDebugPrivilege 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Token: SeDebugPrivilege 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Token: SeDebugPrivilege 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Token: SeDebugPrivilege 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Token: SeDebugPrivilege 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Token: SeDebugPrivilege 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Token: SeDebugPrivilege 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Token: SeDebugPrivilege 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Token: SeDebugPrivilege 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exedescription pid process target process PID 2252 wrote to memory of 1056 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe taskhost.exe PID 2252 wrote to memory of 1152 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Dwm.exe PID 2252 wrote to memory of 1188 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Explorer.EXE PID 2252 wrote to memory of 1732 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe DllHost.exe PID 2252 wrote to memory of 1056 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe taskhost.exe PID 2252 wrote to memory of 1152 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Dwm.exe PID 2252 wrote to memory of 1188 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Explorer.EXE PID 2252 wrote to memory of 1056 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe taskhost.exe PID 2252 wrote to memory of 1152 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Dwm.exe PID 2252 wrote to memory of 1188 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Explorer.EXE PID 2252 wrote to memory of 1056 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe taskhost.exe PID 2252 wrote to memory of 1152 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Dwm.exe PID 2252 wrote to memory of 1188 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Explorer.EXE PID 2252 wrote to memory of 1056 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe taskhost.exe PID 2252 wrote to memory of 1152 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Dwm.exe PID 2252 wrote to memory of 1188 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Explorer.EXE PID 2252 wrote to memory of 1056 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe taskhost.exe PID 2252 wrote to memory of 1152 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Dwm.exe PID 2252 wrote to memory of 1188 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Explorer.EXE PID 2252 wrote to memory of 1056 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe taskhost.exe PID 2252 wrote to memory of 1152 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Dwm.exe PID 2252 wrote to memory of 1188 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Explorer.EXE PID 2252 wrote to memory of 1056 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe taskhost.exe PID 2252 wrote to memory of 1152 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Dwm.exe PID 2252 wrote to memory of 1188 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Explorer.EXE PID 2252 wrote to memory of 1056 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe taskhost.exe PID 2252 wrote to memory of 1152 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Dwm.exe PID 2252 wrote to memory of 1188 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Explorer.EXE PID 2252 wrote to memory of 1056 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe taskhost.exe PID 2252 wrote to memory of 1152 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Dwm.exe PID 2252 wrote to memory of 1188 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Explorer.EXE PID 2252 wrote to memory of 1056 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe taskhost.exe PID 2252 wrote to memory of 1152 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Dwm.exe PID 2252 wrote to memory of 1188 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Explorer.EXE PID 2252 wrote to memory of 1056 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe taskhost.exe PID 2252 wrote to memory of 1152 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Dwm.exe PID 2252 wrote to memory of 1188 2252 cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe Explorer.EXE -
System policy modification 1 TTPs 1 IoCs
Processes:
cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1056
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1152
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe"C:\Users\Admin\AppData\Local\Temp\cbdda3f2127d70441f8828429648844a86d8fd7ba2d32d5cfe9f4d1344d17c9a.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2252
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1732
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
F:\ydqdy.exeFilesize
97KB
MD5e31df8fef7df0cd371e03ac8fed832af
SHA131dce204cdf76bc8f551b55c857de065b5ff955d
SHA256b2039120c51deb542710368262361865b33d7f0bea157ac59b7427fca5197483
SHA5121fa69e8cca024328cb8cc8ba33bb8b88666afb65e11e4f02b5dec73c6508233786138edb6fc095facf472d0220526f066d52bf7a69c3dcaed84a7e86a12f47d2
-
memory/1056-13-0x00000000002D0000-0x00000000002D2000-memory.dmpFilesize
8KB
-
memory/2252-35-0x0000000002230000-0x00000000032EA000-memory.dmpFilesize
16.7MB
-
memory/2252-23-0x0000000000210000-0x0000000000211000-memory.dmpFilesize
4KB
-
memory/2252-12-0x0000000002230000-0x00000000032EA000-memory.dmpFilesize
16.7MB
-
memory/2252-38-0x0000000002230000-0x00000000032EA000-memory.dmpFilesize
16.7MB
-
memory/2252-21-0x0000000000210000-0x0000000000211000-memory.dmpFilesize
4KB
-
memory/2252-20-0x0000000000200000-0x0000000000202000-memory.dmpFilesize
8KB
-
memory/2252-7-0x0000000002230000-0x00000000032EA000-memory.dmpFilesize
16.7MB
-
memory/2252-27-0x0000000000200000-0x0000000000202000-memory.dmpFilesize
8KB
-
memory/2252-26-0x00000000002E0000-0x00000000002E1000-memory.dmpFilesize
4KB
-
memory/2252-24-0x0000000000200000-0x0000000000202000-memory.dmpFilesize
8KB
-
memory/2252-9-0x0000000002230000-0x00000000032EA000-memory.dmpFilesize
16.7MB
-
memory/2252-8-0x0000000002230000-0x00000000032EA000-memory.dmpFilesize
16.7MB
-
memory/2252-6-0x0000000002230000-0x00000000032EA000-memory.dmpFilesize
16.7MB
-
memory/2252-5-0x0000000002230000-0x00000000032EA000-memory.dmpFilesize
16.7MB
-
memory/2252-1-0x0000000000400000-0x000000000080C000-memory.dmpFilesize
4.0MB
-
memory/2252-39-0x0000000002230000-0x00000000032EA000-memory.dmpFilesize
16.7MB
-
memory/2252-33-0x0000000002230000-0x00000000032EA000-memory.dmpFilesize
16.7MB
-
memory/2252-11-0x0000000002230000-0x00000000032EA000-memory.dmpFilesize
16.7MB
-
memory/2252-34-0x0000000002230000-0x00000000032EA000-memory.dmpFilesize
16.7MB
-
memory/2252-36-0x0000000002230000-0x00000000032EA000-memory.dmpFilesize
16.7MB
-
memory/2252-118-0x0000000005B50000-0x0000000005B52000-memory.dmpFilesize
8KB
-
memory/2252-10-0x0000000002230000-0x00000000032EA000-memory.dmpFilesize
16.7MB
-
memory/2252-32-0x0000000002230000-0x00000000032EA000-memory.dmpFilesize
16.7MB
-
memory/2252-40-0x0000000002230000-0x00000000032EA000-memory.dmpFilesize
16.7MB
-
memory/2252-41-0x0000000002230000-0x00000000032EA000-memory.dmpFilesize
16.7MB
-
memory/2252-43-0x0000000002230000-0x00000000032EA000-memory.dmpFilesize
16.7MB
-
memory/2252-45-0x0000000002230000-0x00000000032EA000-memory.dmpFilesize
16.7MB
-
memory/2252-57-0x0000000005B50000-0x0000000005B52000-memory.dmpFilesize
8KB
-
memory/2252-58-0x0000000000400000-0x000000000080C000-memory.dmpFilesize
4.0MB
-
memory/2252-59-0x0000000005B50000-0x0000000005B52000-memory.dmpFilesize
8KB
-
memory/2252-56-0x0000000005B60000-0x0000000005B61000-memory.dmpFilesize
4KB
-
memory/2252-62-0x0000000002230000-0x00000000032EA000-memory.dmpFilesize
16.7MB
-
memory/2252-64-0x0000000002230000-0x00000000032EA000-memory.dmpFilesize
16.7MB
-
memory/2252-67-0x0000000002230000-0x00000000032EA000-memory.dmpFilesize
16.7MB
-
memory/2252-70-0x0000000002230000-0x00000000032EA000-memory.dmpFilesize
16.7MB
-
memory/2252-75-0x0000000002230000-0x00000000032EA000-memory.dmpFilesize
16.7MB
-
memory/2252-76-0x0000000002230000-0x00000000032EA000-memory.dmpFilesize
16.7MB
-
memory/2252-84-0x0000000002230000-0x00000000032EA000-memory.dmpFilesize
16.7MB
-
memory/2252-103-0x0000000002230000-0x00000000032EA000-memory.dmpFilesize
16.7MB
-
memory/2252-110-0x0000000000200000-0x0000000000202000-memory.dmpFilesize
8KB
-
memory/2252-109-0x00000000002E0000-0x00000000002E1000-memory.dmpFilesize
4KB
-
memory/2252-3-0x0000000002230000-0x00000000032EA000-memory.dmpFilesize
16.7MB
-
memory/2252-4-0x0000000002230000-0x00000000032EA000-memory.dmpFilesize
16.7MB