Analysis
- max time kernel
121s - max time network
119s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
31/05/2024, 19:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe
Resource
win7-20240215-en
windows7-x64
20 signatures
150 seconds
General
- Target 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe
- Size 888KB
- Sample240531-ye866sbf82
- SHA256 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210
- MD5 089595a683bbd93298336f88a9adcbb7
- SHA1 13aa6e9830caec6542102c33eb5d228e006a51bc
- SHA512 e0ad0f44b62b4abc7b3830a0309097cfb6319f350bc427ff444501854603b895e155fa30515bd146382d8f3246cd1a44afd803129b666ddf7e6140b7b4c6862d
- SSDEEP 12288:BwCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4khozEY888888888888W88888888:FNzCtUpQ9WWPBSSRMTEpFNXFG3ny
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 40 IoCs
resource yara_rule behavioral2/memory/1616-1-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-6-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-4-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-18-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-19-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-10-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-5-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-22-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-21-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-9-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-3-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-23-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-24-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-29-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-442-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-443-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-446-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-448-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-450-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-451-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-453-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-454-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-457-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-460-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-463-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-464-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-474-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-475-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-481-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-483-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-488-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-491-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-492-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-495-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-496-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-497-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-499-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-502-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-503-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1616-505-0x0000000002350000-0x000000000340A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 41 IoCs
resource yara_rule behavioral2/memory/1616-1-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/1616-6-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/1616-4-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/1616-18-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/1616-19-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/1616-10-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/1616-5-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/1616-22-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/1616-21-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/1616-9-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/1616-3-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/1616-23-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/1616-24-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/1616-29-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/1616-442-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/1616-443-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/1616-446-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/1616-447-0x0000000000400000-0x00000000004EB000-memory.dmp UPX behavioral2/memory/1616-448-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/1616-450-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/1616-451-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/1616-453-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/1616-454-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/1616-457-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/1616-460-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/1616-463-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/1616-464-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/1616-474-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/1616-475-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/1616-481-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/1616-483-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/1616-488-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/1616-491-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/1616-492-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/1616-495-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/1616-496-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/1616-497-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/1616-499-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/1616-502-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/1616-503-0x0000000002350000-0x000000000340A000-memory.dmp UPX behavioral2/memory/1616-505-0x0000000002350000-0x000000000340A000-memory.dmp UPX - Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Paint.lnk 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe -
resource yara_rule behavioral2/memory/1616-1-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/1616-6-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/1616-4-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/1616-18-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/1616-19-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/1616-10-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/1616-5-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/1616-22-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/1616-21-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/1616-9-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/1616-3-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/1616-23-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/1616-24-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/1616-29-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/1616-442-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/1616-443-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/1616-446-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/1616-448-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/1616-450-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/1616-451-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/1616-453-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/1616-454-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/1616-457-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/1616-460-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/1616-463-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/1616-464-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/1616-474-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/1616-475-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/1616-481-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/1616-483-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/1616-488-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/1616-491-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/1616-492-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/1616-495-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/1616-496-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/1616-497-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/1616-499-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/1616-502-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/1616-503-0x0000000002350000-0x000000000340A000-memory.dmp upx behavioral2/memory/1616-505-0x0000000002350000-0x000000000340A000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened (read-only) \??\H: 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened (read-only) \??\P: 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened (read-only) \??\Q: 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened (read-only) \??\X: 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened (read-only) \??\Z: 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened (read-only) \??\J: 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened (read-only) \??\L: 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened (read-only) \??\N: 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened (read-only) \??\R: 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened (read-only) \??\U: 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened (read-only) \??\V: 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened (read-only) \??\M: 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened (read-only) \??\W: 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened (read-only) \??\Y: 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened (read-only) \??\E: 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened (read-only) \??\I: 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened (read-only) \??\K: 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened (read-only) \??\O: 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened (read-only) \??\S: 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened (read-only) \??\T: 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened for modification F:\autorun.inf 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\vUninstall.ico 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened for modification C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\vjhat.exe 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\RCX5216.tmp 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File created C:\Program Files\7-Zip\v7zFM.ico 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\RCX5236.tmp 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\RCX5336.tmp 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\vcreatedump.exe 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\vcreatedump.exe 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\vchrmstp.ico 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened for modification C:\Program Files\dotnet\RCX4F6E.tmp 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File created C:\Program Files\Java\jdk-1.8\bin\vjarsigner.ico 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\vFLTLDR.ico 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\vAppSharingHookController.ico 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\msinfo32.exe.mui 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\vjdb.exe 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\veqnedt32.ico 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\vjabswitch.exe 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File created C:\Program Files\Java\jdk-1.8\bin\vjavadoc.ico 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened for modification C:\Program Files\Windows Defender\uk-UA\OfflineScannerShell.exe.mui 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\de-DE\ShapeCollector.exe.mui 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\it-IT\InputPersonalization.exe.mui 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\vOSE.ico 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome.exe.sig 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\vchrome.exe.ico 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File created C:\Program Files\Java\jdk-1.8\bin\vjavap.ico 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\vIntegrator.exe 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened for modification C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened for modification C:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\vjar.exe 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\vjarsigner.exe 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\veqnedt32.exe 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\vmisc.ico 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened for modification C:\Program Files\Internet Explorer\uk-UA\ieinstal.exe.mui 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\vjavap.exe 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\vjavapackager.exe 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\vOSE.EXE 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File created C:\Program Files\Google\Chrome\Application\vchrome.ico 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\vjavah.exe 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\vOSE.ico 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e573b53 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened for modification C:\Windows\SYSTEM.INI 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe File opened for modification C:\Windows\bfsvc.exe 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe Token: SeDebugPrivilege 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1616 wrote to memory of 776 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 8 PID 1616 wrote to memory of 780 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 9 PID 1616 wrote to memory of 316 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 13 PID 1616 wrote to memory of 2696 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 45 PID 1616 wrote to memory of 2716 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 46 PID 1616 wrote to memory of 3028 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 52 PID 1616 wrote to memory of 3508 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 56 PID 1616 wrote to memory of 3668 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 57 PID 1616 wrote to memory of 3864 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 58 PID 1616 wrote to memory of 3956 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 59 PID 1616 wrote to memory of 4020 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 60 PID 1616 wrote to memory of 732 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 61 PID 1616 wrote to memory of 3920 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 62 PID 1616 wrote to memory of 4728 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 74 PID 1616 wrote to memory of 4836 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 75 PID 1616 wrote to memory of 2980 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 80 PID 1616 wrote to memory of 4380 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 81 PID 1616 wrote to memory of 776 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 8 PID 1616 wrote to memory of 780 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 9 PID 1616 wrote to memory of 316 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 13 PID 1616 wrote to memory of 2696 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 45 PID 1616 wrote to memory of 2716 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 46 PID 1616 wrote to memory of 3028 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 52 PID 1616 wrote to memory of 3508 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 56 PID 1616 wrote to memory of 3668 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 57 PID 1616 wrote to memory of 3864 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 58 PID 1616 wrote to memory of 3956 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 59 PID 1616 wrote to memory of 4020 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 60 PID 1616 wrote to memory of 732 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 61 PID 1616 wrote to memory of 3920 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 62 PID 1616 wrote to memory of 4728 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 74 PID 1616 wrote to memory of 4836 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 75 PID 1616 wrote to memory of 2980 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 80 PID 1616 wrote to memory of 4380 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 81 PID 1616 wrote to memory of 776 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 8 PID 1616 wrote to memory of 780 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 9 PID 1616 wrote to memory of 316 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 13 PID 1616 wrote to memory of 2696 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 45 PID 1616 wrote to memory of 2716 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 46 PID 1616 wrote to memory of 3028 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 52 PID 1616 wrote to memory of 3508 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 56 PID 1616 wrote to memory of 3668 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 57 PID 1616 wrote to memory of 3864 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 58 PID 1616 wrote to memory of 3956 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 59 PID 1616 wrote to memory of 4020 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 60 PID 1616 wrote to memory of 732 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 61 PID 1616 wrote to memory of 3920 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 62 PID 1616 wrote to memory of 4728 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 74 PID 1616 wrote to memory of 4836 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 75 PID 1616 wrote to memory of 2980 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 80 PID 1616 wrote to memory of 4648 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 84 PID 1616 wrote to memory of 3020 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 85 PID 1616 wrote to memory of 776 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 8 PID 1616 wrote to memory of 780 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 9 PID 1616 wrote to memory of 316 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 13 PID 1616 wrote to memory of 2696 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 45 PID 1616 wrote to memory of 2716 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 46 PID 1616 wrote to memory of 3028 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 52 PID 1616 wrote to memory of 3508 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 56 PID 1616 wrote to memory of 3668 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 57 PID 1616 wrote to memory of 3864 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 58 PID 1616 wrote to memory of 3956 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 59 PID 1616 wrote to memory of 4020 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 60 PID 1616 wrote to memory of 732 1616 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe 61 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:776
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:316
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2696
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2716
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:3028
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe"C:\Users\Admin\AppData\Local\Temp\2504b17fd083e873064fc7ee9ce9d012bd0e46db80fa35ee75cbda519b311210.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Drops startup file
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1616
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3668
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3864
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3956
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4020
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:732
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3920
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4728
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4836
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:2980
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:4380
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4648
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3020
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Java\jdk-1.8\bin\vjavaws.ico
- Size 4KB
- SHA256 611f2cb2e03bd8dbcb584cd0a1c48accfba072dd3fc4e6d3144e2062553637f5
- MD5 38b41d03e9dfcbbd08210c5f0b50ba71
- SHA1 2fbfde75ce9fe8423d8e7720bf7408cedcb57a70
- SHA512 ec97556b6ff6023d9e6302ba586ef27b1b54fbf7e8ac04ff318aa4694f13ad343049210ef17b7b603963984c1340589665d67d9c65fec0f91053ff43b1401ba9
- SSDEEP 96:GxZnQuikS0jj8KJy9QhT8PB5CXMaTFgL3n:GxZQuiQjruQ65wXMWA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Microsoft Office 15\ClientX64\vIntegratedOffice.ico
- Size 4KB
- SHA256 a058bfd185fe714927e15642004866449bce425d34292a08af56d66cf03ebe6c
- MD5 3ea9bcbc01e1a652de5a6fc291a66d1a
- SHA1 aee490d53ee201879dff37503a0796c77642a792
- SHA512 7c740132f026341770b6a20575786da581d8a31850d0d680978a00cc4dfca1e848ef9cdc32e51bae680ea13f6cc0d7324c38765cb4e26dcb2e423aced7da0501
- SSDEEP 48:r2pe4sdnY/3XXXXXXXXXXcDD3V+yD3/6k0vucpb:r6bsdnY/XXXXXXXXXXcDD3Vr/6Jvu6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\vmisc.ico
- Size 4KB
- SHA256 3cc5043caa157e5f9b1870527b8c323850bdae1e58d6760e4e895d2ab8a35a05
- MD5 fc27f73816c9f640d800cdc1c9294751
- SHA1 e6c3d8835d1de4e9606e5588e741cd1be27398f6
- SHA512 9e36b96acc97bc7cd45e67a47f1ae7ab7d3818cc2fdaad147524ce9e4baedfaac9cd012923ec65db763bfd850c65b497376bb0694508bee59747f97bf1591fd4
- SSDEEP 12:GFXAOAO9XAkXRABEXAOAOANXAO6qOyvOyYvOy44o4v44PQ91pnSqu:GiB7GABbBBa1qlvlYvl44o4v44PQP/u
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Paint.exe
- Size 824KB
- SHA256 bb3d9b3011b5451318c57033d93c4a6027bf07361740a196939e7d68e5e6cffb
- MD5 a11215f9df502968eea3e67caf9c7458
- SHA1 761fcb90b137ed1ebcdacaa4a0a5247132dfded2
- SHA512 8dadfc1825197e290a31144832367541fa142acb2299d9c1f1adcd6dad0660574a0922ef39d148f3dbe0aeef5d5d8e0ca7a68a1c7c1c05a189134ebb100436f7
- SSDEEP 12288:bwCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozEY888888888888W8888888J:nNzCtUpQ9WWPBSSRMTEpXNy
- MD5 SHA1 SHA512 SSDEEP
- Path F:\autorun.inf
- Size 102B
- SHA256 94e323bd9071db7369ade16f45454e7a0dbfb6a39efddc1234c4719d1f7ee4c2
- MD5 5513829683bff23161ca7d8595c25c72
- SHA1 9961b65bbd3bac109dddd3a161fc30650e8a7096
- SHA512 308c84446106cda0a71e37b0de46aaf4b7361f9ddcc3c4c29f8e87da8acb606525dce8a42caf9d74e708c56b31c524f9535a2f5f4757c6c357401da1c495ddb6
- MD5 SHA1 SHA512
- Path F:\nuyrpq.pif
- Size 97KB
- SHA256 43927efeba1d7381f8f417cbbe52fe3e252eafb744746817e3a4e74ec13aa71c
- MD5 b36b0b916c1875e2955cc57a76050b32
- SHA1 2dce73327a121de32963fa59f7ec4c8ed5f342bd
- SHA512 ccdf8ae63a11027adc5b8c7e9f6be2fb25be6f3e02379a1f3036bb9465cc27e1cebfd0128246b5e07d17b99811bcba893147c32eb1e52d8f3372f17e50b201c6
- SSDEEP 1536:AzJBglL+M70E7f4BAQj5tawkom0kfSBQEvqe4wws0zmv:AzJB7M7n7S19nm0CuQESehT0zm
- MD5 SHA1 SHA512 SSDEEP