Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
30-05-2024 01:20
Static task
static1
Behavioral task
behavioral1
Sample
a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe
Resource
win7-20240221-en
General
-
Target
a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe
-
Size
1.4MB
-
MD5
1bc1e1954201da6878f6346a96db23a5
-
SHA1
d6b573c42cfde3e65c3b13bad483a49542b9f334
-
SHA256
a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26
-
SHA512
fe29627c12470176f088c465daa1692e089c1309e4f393243f24b0b9941151a7ba934dddaf52d83cac2006f6fb36d5c53a7298408b6d993a9751e7a6141655cb
-
SSDEEP
24576:U5v0UtYJN3UAEny0oRwVZlCvQ3cRB7aBq3U9T3Ga2vRwXz9FnEQs4ZuaiMpHJJ8D:oj23d9DRwblCvQ3g7c39jsiX/ECZViE4
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe -
Processes:
a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe -
Processes:
a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe -
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 13 IoCs
Processes:
resource yara_rule behavioral1/memory/1928-27-0x0000000002130000-0x00000000031BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1928-18-0x0000000002130000-0x00000000031BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1928-19-0x0000000002130000-0x00000000031BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1928-51-0x0000000002130000-0x00000000031BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1928-22-0x0000000002130000-0x00000000031BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1928-20-0x0000000002130000-0x00000000031BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1928-50-0x0000000002130000-0x00000000031BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1928-25-0x0000000002130000-0x00000000031BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1928-23-0x0000000002130000-0x00000000031BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1928-21-0x0000000002130000-0x00000000031BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1928-12-0x0000000002130000-0x00000000031BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1928-24-0x0000000002130000-0x00000000031BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1928-81-0x0000000002130000-0x00000000031BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine -
UPX dump on OEP (original entry point) 20 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe UPX behavioral1/memory/2204-11-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral1/memory/2204-29-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral1/memory/1928-27-0x0000000002130000-0x00000000031BE000-memory.dmp UPX behavioral1/memory/1928-52-0x0000000000400000-0x0000000000569000-memory.dmp UPX behavioral1/memory/1928-18-0x0000000002130000-0x00000000031BE000-memory.dmp UPX behavioral1/memory/1928-65-0x0000000000400000-0x0000000000569000-memory.dmp UPX behavioral1/memory/1928-19-0x0000000002130000-0x00000000031BE000-memory.dmp UPX behavioral1/memory/1928-51-0x0000000002130000-0x00000000031BE000-memory.dmp UPX behavioral1/memory/1928-22-0x0000000002130000-0x00000000031BE000-memory.dmp UPX behavioral1/memory/1928-20-0x0000000002130000-0x00000000031BE000-memory.dmp UPX behavioral1/memory/1928-50-0x0000000002130000-0x00000000031BE000-memory.dmp UPX behavioral1/memory/1928-25-0x0000000002130000-0x00000000031BE000-memory.dmp UPX behavioral1/memory/1928-23-0x0000000002130000-0x00000000031BE000-memory.dmp UPX behavioral1/memory/1928-21-0x0000000002130000-0x00000000031BE000-memory.dmp UPX behavioral1/memory/1928-12-0x0000000002130000-0x00000000031BE000-memory.dmp UPX behavioral1/memory/2204-63-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral1/memory/1928-24-0x0000000002130000-0x00000000031BE000-memory.dmp UPX behavioral1/memory/1928-79-0x0000000000400000-0x0000000000569000-memory.dmp UPX behavioral1/memory/1928-81-0x0000000002130000-0x00000000031BE000-memory.dmp UPX -
Executes dropped EXE 1 IoCs
Processes:
a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exepid process 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe -
Loads dropped DLL 4 IoCs
Processes:
a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exea7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exepid process 1928 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe 1928 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe upx behavioral1/memory/2204-11-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2204-29-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/1928-27-0x0000000002130000-0x00000000031BE000-memory.dmp upx behavioral1/memory/1928-18-0x0000000002130000-0x00000000031BE000-memory.dmp upx behavioral1/memory/1928-19-0x0000000002130000-0x00000000031BE000-memory.dmp upx behavioral1/memory/1928-51-0x0000000002130000-0x00000000031BE000-memory.dmp upx behavioral1/memory/1928-22-0x0000000002130000-0x00000000031BE000-memory.dmp upx behavioral1/memory/1928-20-0x0000000002130000-0x00000000031BE000-memory.dmp upx behavioral1/memory/1928-50-0x0000000002130000-0x00000000031BE000-memory.dmp upx behavioral1/memory/1928-25-0x0000000002130000-0x00000000031BE000-memory.dmp upx behavioral1/memory/1928-23-0x0000000002130000-0x00000000031BE000-memory.dmp upx behavioral1/memory/1928-21-0x0000000002130000-0x00000000031BE000-memory.dmp upx behavioral1/memory/1928-12-0x0000000002130000-0x00000000031BE000-memory.dmp upx behavioral1/memory/2204-63-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/1928-24-0x0000000002130000-0x00000000031BE000-memory.dmp upx behavioral1/memory/1928-81-0x0000000002130000-0x00000000031BE000-memory.dmp upx -
Processes:
a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe -
Processes:
a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe -
Drops file in Windows directory 1 IoCs
Processes:
a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exea7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exepid process 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe 1928 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe -
Suspicious behavior: MapViewOfSection 23 IoCs
Processes:
a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exepid process 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe -
Suspicious use of AdjustPrivilegeToken 22 IoCs
Processes:
a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exea7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exedescription pid process Token: SeDebugPrivilege 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe Token: SeDebugPrivilege 1928 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe Token: SeDebugPrivilege 1928 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe Token: SeDebugPrivilege 1928 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe Token: SeDebugPrivilege 1928 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe Token: SeDebugPrivilege 1928 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe Token: SeDebugPrivilege 1928 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe Token: SeDebugPrivilege 1928 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe Token: SeDebugPrivilege 1928 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe Token: SeDebugPrivilege 1928 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe Token: SeDebugPrivilege 1928 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe Token: SeDebugPrivilege 1928 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe Token: SeDebugPrivilege 1928 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe Token: SeDebugPrivilege 1928 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe Token: SeDebugPrivilege 1928 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe Token: SeDebugPrivilege 1928 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe Token: SeDebugPrivilege 1928 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe Token: SeDebugPrivilege 1928 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe Token: SeDebugPrivilege 1928 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe Token: SeDebugPrivilege 1928 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe Token: SeDebugPrivilege 1928 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe Token: SeDebugPrivilege 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exea7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exedescription pid process target process PID 1928 wrote to memory of 2204 1928 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe PID 1928 wrote to memory of 2204 1928 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe PID 1928 wrote to memory of 2204 1928 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe PID 1928 wrote to memory of 2204 1928 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe PID 2204 wrote to memory of 376 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe wininit.exe PID 2204 wrote to memory of 376 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe wininit.exe PID 2204 wrote to memory of 376 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe wininit.exe PID 2204 wrote to memory of 376 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe wininit.exe PID 2204 wrote to memory of 376 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe wininit.exe PID 2204 wrote to memory of 376 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe wininit.exe PID 2204 wrote to memory of 376 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe wininit.exe PID 2204 wrote to memory of 384 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe csrss.exe PID 2204 wrote to memory of 384 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe csrss.exe PID 2204 wrote to memory of 384 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe csrss.exe PID 2204 wrote to memory of 384 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe csrss.exe PID 2204 wrote to memory of 384 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe csrss.exe PID 2204 wrote to memory of 384 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe csrss.exe PID 2204 wrote to memory of 384 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe csrss.exe PID 2204 wrote to memory of 424 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe winlogon.exe PID 2204 wrote to memory of 424 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe winlogon.exe PID 2204 wrote to memory of 424 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe winlogon.exe PID 2204 wrote to memory of 424 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe winlogon.exe PID 2204 wrote to memory of 424 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe winlogon.exe PID 2204 wrote to memory of 424 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe winlogon.exe PID 2204 wrote to memory of 424 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe winlogon.exe PID 2204 wrote to memory of 468 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe services.exe PID 2204 wrote to memory of 468 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe services.exe PID 2204 wrote to memory of 468 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe services.exe PID 2204 wrote to memory of 468 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe services.exe PID 2204 wrote to memory of 468 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe services.exe PID 2204 wrote to memory of 468 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe services.exe PID 2204 wrote to memory of 468 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe services.exe PID 2204 wrote to memory of 484 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe lsass.exe PID 2204 wrote to memory of 484 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe lsass.exe PID 2204 wrote to memory of 484 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe lsass.exe PID 2204 wrote to memory of 484 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe lsass.exe PID 2204 wrote to memory of 484 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe lsass.exe PID 2204 wrote to memory of 484 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe lsass.exe PID 2204 wrote to memory of 484 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe lsass.exe PID 2204 wrote to memory of 492 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe lsm.exe PID 2204 wrote to memory of 492 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe lsm.exe PID 2204 wrote to memory of 492 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe lsm.exe PID 2204 wrote to memory of 492 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe lsm.exe PID 2204 wrote to memory of 492 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe lsm.exe PID 2204 wrote to memory of 492 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe lsm.exe PID 2204 wrote to memory of 492 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe lsm.exe PID 2204 wrote to memory of 612 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe svchost.exe PID 2204 wrote to memory of 612 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe svchost.exe PID 2204 wrote to memory of 612 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe svchost.exe PID 2204 wrote to memory of 612 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe svchost.exe PID 2204 wrote to memory of 612 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe svchost.exe PID 2204 wrote to memory of 612 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe svchost.exe PID 2204 wrote to memory of 612 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe svchost.exe PID 2204 wrote to memory of 692 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe svchost.exe PID 2204 wrote to memory of 692 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe svchost.exe PID 2204 wrote to memory of 692 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe svchost.exe PID 2204 wrote to memory of 692 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe svchost.exe PID 2204 wrote to memory of 692 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe svchost.exe PID 2204 wrote to memory of 692 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe svchost.exe PID 2204 wrote to memory of 692 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe svchost.exe PID 2204 wrote to memory of 760 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe svchost.exe PID 2204 wrote to memory of 760 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe svchost.exe PID 2204 wrote to memory of 760 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe svchost.exe PID 2204 wrote to memory of 760 2204 a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe svchost.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe
Processes
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:376
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:468
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:612
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:1864
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:692
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:760
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:828
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1184
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:864
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:1004
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:388
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:296
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1084
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1128
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:3068
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:3000
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:484
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:492
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:384
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "229174585-454204638-1021589600-582455447-6952166392048597300-2020396222-1399813792"2⤵PID:1736
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:424
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe"C:\Users\Admin\AppData\Local\Temp\a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exeC:\Users\Admin\AppData\Local\Temp\a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2204
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\a7d614034ce4ee1e0ea4b1aa360f963ccbe1571e00dcd4a385775371bc4fbc26mgr.exeFilesize
544KB
MD56b8b94ae97f88bc135ee03f4ef564342
SHA13688ace742ab4b7fe09229f2fc0ef8f981d6fad3
SHA2569997199b5fc19b8c420cf7b04dc5377d7f20a7b6caf0c16a5dcaa553b68e2435
SHA512a69cb767318604b4f954bf357e18e78401601a2ecc7183a591e33e3af521c112d26168277be1c5669295a6f89c3bf073b65388465dbe9bfeba68f2374b7a3779
-
\Users\Admin\AppData\Local\Temp\~TM9A5C.tmpFilesize
1.2MB
MD5d124f55b9393c976963407dff51ffa79
SHA12c7bbedd79791bfb866898c85b504186db610b5d
SHA256ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef
SHA512278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06
-
\Users\Admin\AppData\Local\Temp\~TM9C12.tmpFilesize
1.1MB
MD59b98d47916ead4f69ef51b56b0c2323c
SHA1290a80b4ded0efc0fd00816f373fcea81a521330
SHA25696e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b
SHA51268b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94
-
memory/1128-30-0x0000000000160000-0x0000000000162000-memory.dmpFilesize
8KB
-
memory/1928-27-0x0000000002130000-0x00000000031BE000-memory.dmpFilesize
16.6MB
-
memory/1928-52-0x0000000000400000-0x0000000000569000-memory.dmpFilesize
1.4MB
-
memory/1928-79-0x0000000000400000-0x0000000000569000-memory.dmpFilesize
1.4MB
-
memory/1928-23-0x0000000002130000-0x00000000031BE000-memory.dmpFilesize
16.6MB
-
memory/1928-16-0x000000007EFA0000-0x000000007EFAC000-memory.dmpFilesize
48KB
-
memory/1928-72-0x00000000005B0000-0x00000000005B2000-memory.dmpFilesize
8KB
-
memory/1928-0-0x0000000000400000-0x0000000000569000-memory.dmpFilesize
1.4MB
-
memory/1928-41-0x00000000005C0000-0x00000000005C1000-memory.dmpFilesize
4KB
-
memory/1928-39-0x00000000005C0000-0x00000000005C1000-memory.dmpFilesize
4KB
-
memory/1928-38-0x00000000005B0000-0x00000000005B2000-memory.dmpFilesize
8KB
-
memory/1928-9-0x00000000006E0000-0x00000000007A2000-memory.dmpFilesize
776KB
-
memory/1928-24-0x0000000002130000-0x00000000031BE000-memory.dmpFilesize
16.6MB
-
memory/1928-12-0x0000000002130000-0x00000000031BE000-memory.dmpFilesize
16.6MB
-
memory/1928-80-0x000000007EFA0000-0x000000007EFAC000-memory.dmpFilesize
48KB
-
memory/1928-18-0x0000000002130000-0x00000000031BE000-memory.dmpFilesize
16.6MB
-
memory/1928-64-0x00000000005B0000-0x00000000005B2000-memory.dmpFilesize
8KB
-
memory/1928-21-0x0000000002130000-0x00000000031BE000-memory.dmpFilesize
16.6MB
-
memory/1928-65-0x0000000000400000-0x0000000000569000-memory.dmpFilesize
1.4MB
-
memory/1928-19-0x0000000002130000-0x00000000031BE000-memory.dmpFilesize
16.6MB
-
memory/1928-51-0x0000000002130000-0x00000000031BE000-memory.dmpFilesize
16.6MB
-
memory/1928-8-0x00000000006E0000-0x00000000007A2000-memory.dmpFilesize
776KB
-
memory/1928-22-0x0000000002130000-0x00000000031BE000-memory.dmpFilesize
16.6MB
-
memory/1928-81-0x0000000002130000-0x00000000031BE000-memory.dmpFilesize
16.6MB
-
memory/1928-20-0x0000000002130000-0x00000000031BE000-memory.dmpFilesize
16.6MB
-
memory/1928-50-0x0000000002130000-0x00000000031BE000-memory.dmpFilesize
16.6MB
-
memory/1928-25-0x0000000002130000-0x00000000031BE000-memory.dmpFilesize
16.6MB
-
memory/2204-49-0x00000000003E0000-0x00000000003E2000-memory.dmpFilesize
8KB
-
memory/2204-58-0x0000000002430000-0x0000000002431000-memory.dmpFilesize
4KB
-
memory/2204-59-0x00000000003E0000-0x00000000003E2000-memory.dmpFilesize
8KB
-
memory/2204-14-0x0000000076FEF000-0x0000000076FF0000-memory.dmpFilesize
4KB
-
memory/2204-63-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/2204-15-0x0000000076FF0000-0x0000000076FF1000-memory.dmpFilesize
4KB
-
memory/2204-48-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/2204-28-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2204-29-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/2204-11-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB