Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
01/06/2024, 01:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b0ff65e921b93f0b9b21eeee6ca7f1cad897f510c98b877e52eefaf1a83b6d3f.dll
Resource
win7-20240221-en
windows7-x64
17 signatures
150 seconds
General
- Target b0ff65e921b93f0b9b21eeee6ca7f1cad897f510c98b877e52eefaf1a83b6d3f.dll
- Size 120KB
- Sample240601-cecmbaef84
- SHA256 b0ff65e921b93f0b9b21eeee6ca7f1cad897f510c98b877e52eefaf1a83b6d3f
- MD5 fc8b60eb02f187547849b9c7e443937d
- SHA1 6296253fc619d7391741637f75a6c67405d1710d
- SHA512 ad8e148d7e44f84fb76aa29b613bf8bc76c2aeb3c06290b2106d9dc2e55b261901df614fa9554e3b4c70f26ded9248136a04339d60b52cb403816c705e0a0876
- SSDEEP 3072:n8mRnpOlOwNKoEqgcEbhda+URPhSIVYx8V3:8kpOlZNKoJoYYmV3
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e577261.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e574cc8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e574cc8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e574cc8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e577261.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e577261.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e574cc8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e577261.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e574cc8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e574cc8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e574cc8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e577261.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e577261.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e577261.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e574cc8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e574cc8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e577261.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e577261.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e577261.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e574cc8.exe - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 31 IoCs
resource yara_rule behavioral2/memory/4384-8-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4384-10-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4384-9-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4384-6-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4384-15-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4384-27-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4384-28-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4384-14-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4384-13-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4384-11-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4384-32-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4384-38-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4384-37-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4384-39-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4384-40-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4384-41-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4384-43-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4384-44-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4384-52-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4384-62-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4384-63-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4384-66-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4384-67-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4384-71-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4384-77-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4384-79-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4384-80-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4384-83-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4384-84-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2300-123-0x0000000000B50000-0x0000000001C0A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2300-155-0x0000000000B50000-0x0000000001C0A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 35 IoCs
resource yara_rule behavioral2/memory/4384-8-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4384-10-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4384-9-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4384-6-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4384-15-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4384-27-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/2620-36-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4384-28-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4384-14-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4384-13-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4384-11-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4384-32-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4384-38-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4384-37-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4384-39-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4384-40-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4384-41-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4384-43-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4384-44-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4384-52-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4384-62-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4384-63-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4384-66-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4384-67-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4384-71-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4384-77-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4384-79-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4384-80-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4384-83-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4384-84-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/4384-102-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/2620-120-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/2300-123-0x0000000000B50000-0x0000000001C0A000-memory.dmp UPX behavioral2/memory/2300-154-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/2300-155-0x0000000000B50000-0x0000000001C0A000-memory.dmp UPX - Executes dropped EXE 3 IoCs
pid Process 4384 e574cc8.exe 2620 e574e20.exe 2300 e577261.exe -
resource yara_rule behavioral2/memory/4384-8-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4384-10-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4384-9-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4384-6-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4384-15-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4384-27-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4384-28-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4384-14-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4384-13-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4384-11-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4384-32-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4384-38-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4384-37-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4384-39-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4384-40-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4384-41-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4384-43-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4384-44-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4384-52-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4384-62-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4384-63-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4384-66-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4384-67-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4384-71-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4384-77-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4384-79-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4384-80-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4384-83-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4384-84-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/2300-123-0x0000000000B50000-0x0000000001C0A000-memory.dmp upx behavioral2/memory/2300-155-0x0000000000B50000-0x0000000001C0A000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e574cc8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e577261.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e577261.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e574cc8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e577261.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e577261.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e577261.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e574cc8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e574cc8.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e574cc8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e577261.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e577261.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e574cc8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e574cc8.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e574cc8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e577261.exe - Enumerates connected drives 3 TTPs 16 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: e574cc8.exe File opened (read-only) \??\H: e574cc8.exe File opened (read-only) \??\M: e574cc8.exe File opened (read-only) \??\O: e574cc8.exe File opened (read-only) \??\H: e577261.exe File opened (read-only) \??\L: e574cc8.exe File opened (read-only) \??\N: e574cc8.exe File opened (read-only) \??\Q: e574cc8.exe File opened (read-only) \??\E: e577261.exe File opened (read-only) \??\J: e574cc8.exe File opened (read-only) \??\G: e577261.exe File opened (read-only) \??\E: e574cc8.exe File opened (read-only) \??\I: e574cc8.exe File opened (read-only) \??\K: e574cc8.exe File opened (read-only) \??\P: e574cc8.exe File opened (read-only) \??\I: e577261.exe - Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe e574cc8.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e574cc8.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e574cc8.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e574d16 e574cc8.exe File opened for modification C:\Windows\SYSTEM.INI e574cc8.exe File created C:\Windows\e579d98 e577261.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4384 e574cc8.exe 4384 e574cc8.exe 4384 e574cc8.exe 4384 e574cc8.exe 2300 e577261.exe 2300 e577261.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe Token: SeDebugPrivilege 4384 e574cc8.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4832 wrote to memory of 4512 4832 rundll32.exe 82 PID 4832 wrote to memory of 4512 4832 rundll32.exe 82 PID 4832 wrote to memory of 4512 4832 rundll32.exe 82 PID 4512 wrote to memory of 4384 4512 rundll32.exe 83 PID 4512 wrote to memory of 4384 4512 rundll32.exe 83 PID 4512 wrote to memory of 4384 4512 rundll32.exe 83 PID 4384 wrote to memory of 800 4384 e574cc8.exe 9 PID 4384 wrote to memory of 804 4384 e574cc8.exe 10 PID 4384 wrote to memory of 1020 4384 e574cc8.exe 13 PID 4384 wrote to memory of 688 4384 e574cc8.exe 51 PID 4384 wrote to memory of 3092 4384 e574cc8.exe 52 PID 4384 wrote to memory of 3116 4384 e574cc8.exe 53 PID 4384 wrote to memory of 3380 4384 e574cc8.exe 55 PID 4384 wrote to memory of 3540 4384 e574cc8.exe 57 PID 4384 wrote to memory of 3744 4384 e574cc8.exe 58 PID 4384 wrote to memory of 3840 4384 e574cc8.exe 59 PID 4384 wrote to memory of 3908 4384 e574cc8.exe 60 PID 4384 wrote to memory of 4028 4384 e574cc8.exe 61 PID 4384 wrote to memory of 4000 4384 e574cc8.exe 62 PID 4384 wrote to memory of 4428 4384 e574cc8.exe 64 PID 4384 wrote to memory of 4484 4384 e574cc8.exe 75 PID 4384 wrote to memory of 1924 4384 e574cc8.exe 80 PID 4384 wrote to memory of 4832 4384 e574cc8.exe 81 PID 4384 wrote to memory of 4512 4384 e574cc8.exe 82 PID 4384 wrote to memory of 4512 4384 e574cc8.exe 82 PID 4512 wrote to memory of 2620 4512 rundll32.exe 84 PID 4512 wrote to memory of 2620 4512 rundll32.exe 84 PID 4512 wrote to memory of 2620 4512 rundll32.exe 84 PID 4512 wrote to memory of 2300 4512 rundll32.exe 92 PID 4512 wrote to memory of 2300 4512 rundll32.exe 92 PID 4512 wrote to memory of 2300 4512 rundll32.exe 92 PID 4384 wrote to memory of 800 4384 e574cc8.exe 9 PID 4384 wrote to memory of 804 4384 e574cc8.exe 10 PID 4384 wrote to memory of 1020 4384 e574cc8.exe 13 PID 4384 wrote to memory of 688 4384 e574cc8.exe 51 PID 4384 wrote to memory of 3092 4384 e574cc8.exe 52 PID 4384 wrote to memory of 3116 4384 e574cc8.exe 53 PID 4384 wrote to memory of 3380 4384 e574cc8.exe 55 PID 4384 wrote to memory of 3540 4384 e574cc8.exe 57 PID 4384 wrote to memory of 3744 4384 e574cc8.exe 58 PID 4384 wrote to memory of 3840 4384 e574cc8.exe 59 PID 4384 wrote to memory of 3908 4384 e574cc8.exe 60 PID 4384 wrote to memory of 4028 4384 e574cc8.exe 61 PID 4384 wrote to memory of 4000 4384 e574cc8.exe 62 PID 4384 wrote to memory of 4428 4384 e574cc8.exe 64 PID 4384 wrote to memory of 4484 4384 e574cc8.exe 75 PID 4384 wrote to memory of 1924 4384 e574cc8.exe 80 PID 4384 wrote to memory of 2620 4384 e574cc8.exe 84 PID 4384 wrote to memory of 2620 4384 e574cc8.exe 84 PID 4384 wrote to memory of 4816 4384 e574cc8.exe 86 PID 4384 wrote to memory of 3592 4384 e574cc8.exe 87 PID 4384 wrote to memory of 2300 4384 e574cc8.exe 92 PID 4384 wrote to memory of 2300 4384 e574cc8.exe 92 PID 2300 wrote to memory of 800 2300 e577261.exe 9 PID 2300 wrote to memory of 804 2300 e577261.exe 10 PID 2300 wrote to memory of 1020 2300 e577261.exe 13 PID 2300 wrote to memory of 688 2300 e577261.exe 51 PID 2300 wrote to memory of 3092 2300 e577261.exe 52 PID 2300 wrote to memory of 3116 2300 e577261.exe 53 PID 2300 wrote to memory of 3380 2300 e577261.exe 55 PID 2300 wrote to memory of 3540 2300 e577261.exe 57 PID 2300 wrote to memory of 3744 2300 e577261.exe 58 PID 2300 wrote to memory of 3840 2300 e577261.exe 59 PID 2300 wrote to memory of 3908 2300 e577261.exe 60 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e577261.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e574cc8.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:800
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:804
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1020
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:688
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:3092
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:3116
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3380
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b0ff65e921b93f0b9b21eeee6ca7f1cad897f510c98b877e52eefaf1a83b6d3f.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b0ff65e921b93f0b9b21eeee6ca7f1cad897f510c98b877e52eefaf1a83b6d3f.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\e574cc8.exeC:\Users\Admin\AppData\Local\Temp\e574cc8.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4384
-
-
C:\Users\Admin\AppData\Local\Temp\e574e20.exeC:\Users\Admin\AppData\Local\Temp\e574e20.exe4⤵
- Executes dropped EXE
PID:2620
-
-
C:\Users\Admin\AppData\Local\Temp\e577261.exeC:\Users\Admin\AppData\Local\Temp\e577261.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2300
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3540
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3744
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3840
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3908
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4028
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4000
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4428
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4484
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:1924
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4816
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3592
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\e574cc8.exe
- Size 97KB
- SHA256 5286aee2e7d3cd1179327ed3e67e03d1374766b58f7297eca4baaee228cf8b8a
- MD5 9fa30c3cdf4e62df078804292a619795
- SHA1 6d3590b3a17b1b402516a486646d501a714b1d7e
- SHA512 f4340bf8b8064118c65994d8da3c1708bbfbb1b930af405d9ee8aec858495c88002c4b51fa13f606047365d56eb1794104bd96372ef9781c94eead5b4c5aab7c
- SSDEEP 3072:N7wZLqwr+2uhQlcWaaWarN8q1MYbp+J7BQmeuOHc:CZWwr+2UQT/rN8q1Ma+NBPyc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SYSTEM.INI
- Size 256B
- SHA256 905faf87bdbaddea47b4a80a74aefa99d3f07b0cf84a79c43b982ba8245d51aa
- MD5 994f19a4112c30ec24c42562a206b40b
- SHA1 ea9d851c0c03c759ba19a7bdcc70bbe8d9dc4ad4
- SHA512 61ea576b2855d2464c4e8d0de93b88e4159dc0a20f6047f811981b75ea397b2366b9b7c2c3139806ce6aed9d3581d90e0e34242ca0f46e3ec9036ce72d360d08
- MD5 SHA1 SHA512