Analysis
- max time kernel
148s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 23:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
81f2ce42c37bb7a73bbe5c2ae61f78ab5803e9be0b6542681f684b0b0ac9904e.dll
Resource
win7-20240508-en
windows7-x64
17 signatures
150 seconds
General
- Target 81f2ce42c37bb7a73bbe5c2ae61f78ab5803e9be0b6542681f684b0b0ac9904e.dll
- Size 120KB
- Sample240603-3msxdaeb66
- SHA256 81f2ce42c37bb7a73bbe5c2ae61f78ab5803e9be0b6542681f684b0b0ac9904e
- MD5 fcc85f7baded18f4fa1f61b61025f522
- SHA1 47f63e5020f12104eda760148aa97a1a2825c6cd
- SHA512 72bd999f05765c36af99e6cc090491eb91d29f5c3eb1d0fd61a280acbf6fca90398ddcf43f7f014736509af4c2ebdf610698bfb16cce94387196f525bad1e813
- SSDEEP 1536:J/Ehqn5GoJjNcfghtnNIE8u2FHbPIoZuJhAmHGcRCc4FMDv1rDWQDp0Wass6w/ow:Ghqn53kfwne5lbPjUyWROYrKQ6Wakz6
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57494d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57494d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57494d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57707d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57707d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57707d.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57494d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57707d.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57707d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57707d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57494d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57494d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57494d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57494d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57707d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57707d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57494d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57494d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57707d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57707d.exe - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 26 IoCs
resource yara_rule behavioral2/memory/2844-6-0x00000000008F0000-0x00000000019AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2844-8-0x00000000008F0000-0x00000000019AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2844-9-0x00000000008F0000-0x00000000019AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2844-10-0x00000000008F0000-0x00000000019AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2844-11-0x00000000008F0000-0x00000000019AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2844-18-0x00000000008F0000-0x00000000019AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2844-31-0x00000000008F0000-0x00000000019AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2844-32-0x00000000008F0000-0x00000000019AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2844-34-0x00000000008F0000-0x00000000019AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2844-17-0x00000000008F0000-0x00000000019AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2844-35-0x00000000008F0000-0x00000000019AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2844-37-0x00000000008F0000-0x00000000019AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2844-36-0x00000000008F0000-0x00000000019AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2844-38-0x00000000008F0000-0x00000000019AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2844-55-0x00000000008F0000-0x00000000019AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2844-56-0x00000000008F0000-0x00000000019AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2844-58-0x00000000008F0000-0x00000000019AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2844-59-0x00000000008F0000-0x00000000019AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2844-60-0x00000000008F0000-0x00000000019AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2844-61-0x00000000008F0000-0x00000000019AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2844-63-0x00000000008F0000-0x00000000019AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2844-65-0x00000000008F0000-0x00000000019AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2844-67-0x00000000008F0000-0x00000000019AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4896-91-0x0000000000B40000-0x0000000001BFA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4896-99-0x0000000000B40000-0x0000000001BFA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4896-120-0x0000000000B40000-0x0000000001BFA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 32 IoCs
resource yara_rule behavioral2/memory/2844-5-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/2844-6-0x00000000008F0000-0x00000000019AA000-memory.dmp UPX behavioral2/memory/2844-8-0x00000000008F0000-0x00000000019AA000-memory.dmp UPX behavioral2/memory/2844-9-0x00000000008F0000-0x00000000019AA000-memory.dmp UPX behavioral2/memory/2844-10-0x00000000008F0000-0x00000000019AA000-memory.dmp UPX behavioral2/memory/2844-11-0x00000000008F0000-0x00000000019AA000-memory.dmp UPX behavioral2/memory/2844-18-0x00000000008F0000-0x00000000019AA000-memory.dmp UPX behavioral2/memory/2844-31-0x00000000008F0000-0x00000000019AA000-memory.dmp UPX behavioral2/memory/2536-23-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/2844-32-0x00000000008F0000-0x00000000019AA000-memory.dmp UPX behavioral2/memory/2844-34-0x00000000008F0000-0x00000000019AA000-memory.dmp UPX behavioral2/memory/2844-17-0x00000000008F0000-0x00000000019AA000-memory.dmp UPX behavioral2/memory/2844-35-0x00000000008F0000-0x00000000019AA000-memory.dmp UPX behavioral2/memory/2844-37-0x00000000008F0000-0x00000000019AA000-memory.dmp UPX behavioral2/memory/2844-36-0x00000000008F0000-0x00000000019AA000-memory.dmp UPX behavioral2/memory/2844-38-0x00000000008F0000-0x00000000019AA000-memory.dmp UPX behavioral2/memory/4896-46-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/2844-55-0x00000000008F0000-0x00000000019AA000-memory.dmp UPX behavioral2/memory/2844-56-0x00000000008F0000-0x00000000019AA000-memory.dmp UPX behavioral2/memory/2844-58-0x00000000008F0000-0x00000000019AA000-memory.dmp UPX behavioral2/memory/2844-59-0x00000000008F0000-0x00000000019AA000-memory.dmp UPX behavioral2/memory/2844-60-0x00000000008F0000-0x00000000019AA000-memory.dmp UPX behavioral2/memory/2844-61-0x00000000008F0000-0x00000000019AA000-memory.dmp UPX behavioral2/memory/2844-63-0x00000000008F0000-0x00000000019AA000-memory.dmp UPX behavioral2/memory/2844-65-0x00000000008F0000-0x00000000019AA000-memory.dmp UPX behavioral2/memory/2844-67-0x00000000008F0000-0x00000000019AA000-memory.dmp UPX behavioral2/memory/2844-86-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/2536-90-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4896-91-0x0000000000B40000-0x0000000001BFA000-memory.dmp UPX behavioral2/memory/4896-99-0x0000000000B40000-0x0000000001BFA000-memory.dmp UPX behavioral2/memory/4896-121-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4896-120-0x0000000000B40000-0x0000000001BFA000-memory.dmp UPX - Executes dropped EXE 3 IoCs
pid Process 2844 e57494d.exe 2536 e574ab5.exe 4896 e57707d.exe -
resource yara_rule behavioral2/memory/2844-6-0x00000000008F0000-0x00000000019AA000-memory.dmp upx behavioral2/memory/2844-8-0x00000000008F0000-0x00000000019AA000-memory.dmp upx behavioral2/memory/2844-9-0x00000000008F0000-0x00000000019AA000-memory.dmp upx behavioral2/memory/2844-10-0x00000000008F0000-0x00000000019AA000-memory.dmp upx behavioral2/memory/2844-11-0x00000000008F0000-0x00000000019AA000-memory.dmp upx behavioral2/memory/2844-18-0x00000000008F0000-0x00000000019AA000-memory.dmp upx behavioral2/memory/2844-31-0x00000000008F0000-0x00000000019AA000-memory.dmp upx behavioral2/memory/2844-32-0x00000000008F0000-0x00000000019AA000-memory.dmp upx behavioral2/memory/2844-34-0x00000000008F0000-0x00000000019AA000-memory.dmp upx behavioral2/memory/2844-17-0x00000000008F0000-0x00000000019AA000-memory.dmp upx behavioral2/memory/2844-35-0x00000000008F0000-0x00000000019AA000-memory.dmp upx behavioral2/memory/2844-37-0x00000000008F0000-0x00000000019AA000-memory.dmp upx behavioral2/memory/2844-36-0x00000000008F0000-0x00000000019AA000-memory.dmp upx behavioral2/memory/2844-38-0x00000000008F0000-0x00000000019AA000-memory.dmp upx behavioral2/memory/2844-55-0x00000000008F0000-0x00000000019AA000-memory.dmp upx behavioral2/memory/2844-56-0x00000000008F0000-0x00000000019AA000-memory.dmp upx behavioral2/memory/2844-58-0x00000000008F0000-0x00000000019AA000-memory.dmp upx behavioral2/memory/2844-59-0x00000000008F0000-0x00000000019AA000-memory.dmp upx behavioral2/memory/2844-60-0x00000000008F0000-0x00000000019AA000-memory.dmp upx behavioral2/memory/2844-61-0x00000000008F0000-0x00000000019AA000-memory.dmp upx behavioral2/memory/2844-63-0x00000000008F0000-0x00000000019AA000-memory.dmp upx behavioral2/memory/2844-65-0x00000000008F0000-0x00000000019AA000-memory.dmp upx behavioral2/memory/2844-67-0x00000000008F0000-0x00000000019AA000-memory.dmp upx behavioral2/memory/4896-91-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx behavioral2/memory/4896-99-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx behavioral2/memory/4896-120-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57494d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57494d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57707d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57707d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57494d.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57494d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57707d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57494d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57494d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57707d.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57707d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57494d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57707d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57707d.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57707d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57494d.exe - Enumerates connected drives 3 TTPs 6 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: e57494d.exe File opened (read-only) \??\I: e57494d.exe File opened (read-only) \??\J: e57494d.exe File opened (read-only) \??\K: e57494d.exe File opened (read-only) \??\E: e57494d.exe File opened (read-only) \??\G: e57494d.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e57499c e57494d.exe File opened for modification C:\Windows\SYSTEM.INI e57494d.exe File created C:\Windows\e579a8a e57707d.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2844 e57494d.exe 2844 e57494d.exe 2844 e57494d.exe 2844 e57494d.exe 4896 e57707d.exe 4896 e57707d.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe Token: SeDebugPrivilege 2844 e57494d.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3812 wrote to memory of 2660 3812 rundll32.exe 83 PID 3812 wrote to memory of 2660 3812 rundll32.exe 83 PID 3812 wrote to memory of 2660 3812 rundll32.exe 83 PID 2660 wrote to memory of 2844 2660 rundll32.exe 84 PID 2660 wrote to memory of 2844 2660 rundll32.exe 84 PID 2660 wrote to memory of 2844 2660 rundll32.exe 84 PID 2844 wrote to memory of 772 2844 e57494d.exe 8 PID 2844 wrote to memory of 780 2844 e57494d.exe 9 PID 2844 wrote to memory of 60 2844 e57494d.exe 13 PID 2844 wrote to memory of 2520 2844 e57494d.exe 42 PID 2844 wrote to memory of 2560 2844 e57494d.exe 43 PID 2844 wrote to memory of 2668 2844 e57494d.exe 44 PID 2844 wrote to memory of 3488 2844 e57494d.exe 56 PID 2844 wrote to memory of 3692 2844 e57494d.exe 57 PID 2844 wrote to memory of 3892 2844 e57494d.exe 58 PID 2844 wrote to memory of 3984 2844 e57494d.exe 59 PID 2844 wrote to memory of 4052 2844 e57494d.exe 60 PID 2844 wrote to memory of 764 2844 e57494d.exe 61 PID 2844 wrote to memory of 3048 2844 e57494d.exe 62 PID 2844 wrote to memory of 4092 2844 e57494d.exe 64 PID 2844 wrote to memory of 4520 2844 e57494d.exe 75 PID 2844 wrote to memory of 1936 2844 e57494d.exe 80 PID 2844 wrote to memory of 1548 2844 e57494d.exe 81 PID 2844 wrote to memory of 3812 2844 e57494d.exe 82 PID 2844 wrote to memory of 2660 2844 e57494d.exe 83 PID 2844 wrote to memory of 2660 2844 e57494d.exe 83 PID 2660 wrote to memory of 2536 2660 rundll32.exe 85 PID 2660 wrote to memory of 2536 2660 rundll32.exe 85 PID 2660 wrote to memory of 2536 2660 rundll32.exe 85 PID 2660 wrote to memory of 4896 2660 rundll32.exe 86 PID 2660 wrote to memory of 4896 2660 rundll32.exe 86 PID 2660 wrote to memory of 4896 2660 rundll32.exe 86 PID 2844 wrote to memory of 772 2844 e57494d.exe 8 PID 2844 wrote to memory of 780 2844 e57494d.exe 9 PID 2844 wrote to memory of 60 2844 e57494d.exe 13 PID 2844 wrote to memory of 2520 2844 e57494d.exe 42 PID 2844 wrote to memory of 2560 2844 e57494d.exe 43 PID 2844 wrote to memory of 2668 2844 e57494d.exe 44 PID 2844 wrote to memory of 3488 2844 e57494d.exe 56 PID 2844 wrote to memory of 3692 2844 e57494d.exe 57 PID 2844 wrote to memory of 3892 2844 e57494d.exe 58 PID 2844 wrote to memory of 3984 2844 e57494d.exe 59 PID 2844 wrote to memory of 4052 2844 e57494d.exe 60 PID 2844 wrote to memory of 764 2844 e57494d.exe 61 PID 2844 wrote to memory of 3048 2844 e57494d.exe 62 PID 2844 wrote to memory of 4092 2844 e57494d.exe 64 PID 2844 wrote to memory of 4520 2844 e57494d.exe 75 PID 2844 wrote to memory of 1936 2844 e57494d.exe 80 PID 2844 wrote to memory of 1548 2844 e57494d.exe 81 PID 2844 wrote to memory of 2536 2844 e57494d.exe 85 PID 2844 wrote to memory of 2536 2844 e57494d.exe 85 PID 2844 wrote to memory of 4896 2844 e57494d.exe 86 PID 2844 wrote to memory of 4896 2844 e57494d.exe 86 PID 4896 wrote to memory of 772 4896 e57707d.exe 8 PID 4896 wrote to memory of 780 4896 e57707d.exe 9 PID 4896 wrote to memory of 60 4896 e57707d.exe 13 PID 4896 wrote to memory of 2520 4896 e57707d.exe 42 PID 4896 wrote to memory of 2560 4896 e57707d.exe 43 PID 4896 wrote to memory of 2668 4896 e57707d.exe 44 PID 4896 wrote to memory of 3488 4896 e57707d.exe 56 PID 4896 wrote to memory of 3692 4896 e57707d.exe 57 PID 4896 wrote to memory of 3892 4896 e57707d.exe 58 PID 4896 wrote to memory of 3984 4896 e57707d.exe 59 PID 4896 wrote to memory of 4052 4896 e57707d.exe 60 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57494d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57707d.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:772
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:60
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2520
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2560
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2668
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3488
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\81f2ce42c37bb7a73bbe5c2ae61f78ab5803e9be0b6542681f684b0b0ac9904e.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\81f2ce42c37bb7a73bbe5c2ae61f78ab5803e9be0b6542681f684b0b0ac9904e.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\e57494d.exeC:\Users\Admin\AppData\Local\Temp\e57494d.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2844
-
-
C:\Users\Admin\AppData\Local\Temp\e574ab5.exeC:\Users\Admin\AppData\Local\Temp\e574ab5.exe4⤵
- Executes dropped EXE
PID:2536
-
-
C:\Users\Admin\AppData\Local\Temp\e57707d.exeC:\Users\Admin\AppData\Local\Temp\e57707d.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4896
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3692
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3892
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3984
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4052
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:764
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3048
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4092
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4520
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:1936
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:1548
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4040
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3432
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\e57494d.exe
- Size 97KB
- SHA256 9c7647e906d7b4f3889b5d1a97967fb2872e3ceeb8d15557fe3f5783626fa1b9
- MD5 10878fe539338ae85b10a24b2e809df4
- SHA1 90d72ea041031cf6d422b2632537c85f3ec6777c
- SHA512 98a21b9355b4aef6e14db6fc3b1a79679dcb80ea0a4f780e533ebd3e274c64a7bb4366948b67c71fcf466a87e6d03c590ebd2e9732abdfff9873e574bafed2d2
- SSDEEP 1536:Q8Xh0haQknTS58xvHJTGH7K3qgFn+1ElBwO4q:Qq0QQITeoQHU+1QQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SYSTEM.INI
- Size 257B
- SHA256 d970ba64ced8ea5ec0861305350513abcbc3031e779c5572aad26837be0f5785
- MD5 d0bc2451e7a4e759f288453d36e96d92
- SHA1 00574999e0e5a1a763413a031fb08dc3c516170f
- SHA512 4ef7e8c03ffcf77dc0d17bbd8142b3171a7c3fcc174fdba78e7a9cfabb7fd6588f90b84c8f1a5c821e4fee2483eab2692726559c25f347b71eb7091588c49ceb
- MD5 SHA1 SHA512