Analysis
- max time kernel
94s - max time network
102s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
05/06/2024, 23:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe
Resource
win7-20240220-en
windows7-x64
19 signatures
150 seconds
General
- Target 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe
- Size 229KB
- Sample240605-2zed3sbc8w
- SHA256 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee
- MD5 fbe68b4b3a364438b8d37ad71886fddd
- SHA1 b3bff5cd8b635afee7745bf0e2be705582b1b5dc
- SHA512 0f974f353170d67d81ba318d46efd94ebb15744823a6b6473663cf6edfa96dee49f02916fc75403876aff4e766c3146296bbc34deca6391bb026537a2e57623d
- SSDEEP 6144:U8U2qy6rRZb7jxb4EJmXg8x+1C0UY9ewAqDaJ1sGvjq4:yzy6rRxuxmCk9efqu9jf
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
-
http://www.klkjwre9fqwieluoi.info/
-
http://kukutrustnet777888.info/
Signatures
- Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 23 IoCs
resource yara_rule behavioral2/memory/3460-1-0x00000000022B0000-0x000000000333E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3460-8-0x00000000022B0000-0x000000000333E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3460-15-0x00000000022B0000-0x000000000333E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3460-18-0x00000000022B0000-0x000000000333E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3460-16-0x00000000022B0000-0x000000000333E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3460-12-0x00000000022B0000-0x000000000333E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3460-13-0x00000000022B0000-0x000000000333E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3460-9-0x00000000022B0000-0x000000000333E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3460-4-0x00000000022B0000-0x000000000333E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3460-31-0x00000000022B0000-0x000000000333E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3460-32-0x00000000022B0000-0x000000000333E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3460-46-0x00000000022B0000-0x000000000333E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3460-47-0x00000000022B0000-0x000000000333E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3460-48-0x00000000022B0000-0x000000000333E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3460-50-0x00000000022B0000-0x000000000333E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3460-51-0x00000000022B0000-0x000000000333E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3460-53-0x00000000022B0000-0x000000000333E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3460-54-0x00000000022B0000-0x000000000333E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3460-55-0x00000000022B0000-0x000000000333E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3460-62-0x00000000022B0000-0x000000000333E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3460-64-0x00000000022B0000-0x000000000333E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3460-66-0x00000000022B0000-0x000000000333E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3460-76-0x00000000022B0000-0x000000000333E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 26 IoCs
resource yara_rule behavioral2/memory/3460-0-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral2/memory/3460-1-0x00000000022B0000-0x000000000333E000-memory.dmp UPX behavioral2/memory/3460-8-0x00000000022B0000-0x000000000333E000-memory.dmp UPX behavioral2/memory/3460-15-0x00000000022B0000-0x000000000333E000-memory.dmp UPX behavioral2/memory/3460-18-0x00000000022B0000-0x000000000333E000-memory.dmp UPX behavioral2/memory/3460-16-0x00000000022B0000-0x000000000333E000-memory.dmp UPX behavioral2/memory/3460-12-0x00000000022B0000-0x000000000333E000-memory.dmp UPX behavioral2/memory/3460-13-0x00000000022B0000-0x000000000333E000-memory.dmp UPX behavioral2/memory/3460-9-0x00000000022B0000-0x000000000333E000-memory.dmp UPX behavioral2/memory/3460-4-0x00000000022B0000-0x000000000333E000-memory.dmp UPX behavioral2/memory/3460-31-0x00000000022B0000-0x000000000333E000-memory.dmp UPX behavioral2/memory/3460-32-0x00000000022B0000-0x000000000333E000-memory.dmp UPX behavioral2/memory/3460-46-0x00000000022B0000-0x000000000333E000-memory.dmp UPX behavioral2/memory/3460-47-0x00000000022B0000-0x000000000333E000-memory.dmp UPX behavioral2/memory/3460-48-0x00000000022B0000-0x000000000333E000-memory.dmp UPX behavioral2/memory/3460-50-0x00000000022B0000-0x000000000333E000-memory.dmp UPX behavioral2/memory/3460-51-0x00000000022B0000-0x000000000333E000-memory.dmp UPX behavioral2/memory/3460-53-0x00000000022B0000-0x000000000333E000-memory.dmp UPX behavioral2/memory/3460-54-0x00000000022B0000-0x000000000333E000-memory.dmp UPX behavioral2/memory/3460-55-0x00000000022B0000-0x000000000333E000-memory.dmp UPX behavioral2/memory/3460-57-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral2/memory/3460-62-0x00000000022B0000-0x000000000333E000-memory.dmp UPX behavioral2/memory/3460-64-0x00000000022B0000-0x000000000333E000-memory.dmp UPX behavioral2/memory/3460-66-0x00000000022B0000-0x000000000333E000-memory.dmp UPX behavioral2/memory/3460-76-0x00000000022B0000-0x000000000333E000-memory.dmp UPX behavioral2/memory/3460-91-0x0000000000400000-0x0000000000432000-memory.dmp UPX - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe - Executes dropped EXE 1 IoCs
pid Process 1012 PCICFG.exe - Loads dropped DLL 1 IoCs
pid Process 1012 PCICFG.exe -
resource yara_rule behavioral2/memory/3460-1-0x00000000022B0000-0x000000000333E000-memory.dmp upx behavioral2/memory/3460-8-0x00000000022B0000-0x000000000333E000-memory.dmp upx behavioral2/memory/3460-15-0x00000000022B0000-0x000000000333E000-memory.dmp upx behavioral2/memory/3460-18-0x00000000022B0000-0x000000000333E000-memory.dmp upx behavioral2/memory/3460-16-0x00000000022B0000-0x000000000333E000-memory.dmp upx behavioral2/memory/3460-12-0x00000000022B0000-0x000000000333E000-memory.dmp upx behavioral2/memory/3460-13-0x00000000022B0000-0x000000000333E000-memory.dmp upx behavioral2/memory/3460-9-0x00000000022B0000-0x000000000333E000-memory.dmp upx behavioral2/memory/3460-4-0x00000000022B0000-0x000000000333E000-memory.dmp upx behavioral2/memory/3460-31-0x00000000022B0000-0x000000000333E000-memory.dmp upx behavioral2/memory/3460-32-0x00000000022B0000-0x000000000333E000-memory.dmp upx behavioral2/memory/3460-46-0x00000000022B0000-0x000000000333E000-memory.dmp upx behavioral2/memory/3460-47-0x00000000022B0000-0x000000000333E000-memory.dmp upx behavioral2/memory/3460-48-0x00000000022B0000-0x000000000333E000-memory.dmp upx behavioral2/memory/3460-50-0x00000000022B0000-0x000000000333E000-memory.dmp upx behavioral2/memory/3460-51-0x00000000022B0000-0x000000000333E000-memory.dmp upx behavioral2/memory/3460-53-0x00000000022B0000-0x000000000333E000-memory.dmp upx behavioral2/memory/3460-54-0x00000000022B0000-0x000000000333E000-memory.dmp upx behavioral2/memory/3460-55-0x00000000022B0000-0x000000000333E000-memory.dmp upx behavioral2/memory/3460-62-0x00000000022B0000-0x000000000333E000-memory.dmp upx behavioral2/memory/3460-64-0x00000000022B0000-0x000000000333E000-memory.dmp upx behavioral2/memory/3460-66-0x00000000022B0000-0x000000000333E000-memory.dmp upx behavioral2/memory/3460-76-0x00000000022B0000-0x000000000333E000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe - Enumerates connected drives 3 TTPs 8 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe File opened (read-only) \??\G: 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe File opened (read-only) \??\H: 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe File opened (read-only) \??\I: 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe File opened (read-only) \??\J: 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe File opened (read-only) \??\K: 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe File opened (read-only) \??\L: 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe File opened (read-only) \??\M: 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 664 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe Token: SeDebugPrivilege 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe - Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 3460 wrote to memory of 784 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe 8 PID 3460 wrote to memory of 792 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe 9 PID 3460 wrote to memory of 336 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe 13 PID 3460 wrote to memory of 2708 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe 45 PID 3460 wrote to memory of 2736 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe 46 PID 3460 wrote to memory of 2808 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe 48 PID 3460 wrote to memory of 3504 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe 55 PID 3460 wrote to memory of 3680 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe 57 PID 3460 wrote to memory of 3856 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe 58 PID 3460 wrote to memory of 3948 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe 59 PID 3460 wrote to memory of 4016 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe 60 PID 3460 wrote to memory of 780 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe 61 PID 3460 wrote to memory of 3792 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe 62 PID 3460 wrote to memory of 4480 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe 64 PID 3460 wrote to memory of 5012 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe 74 PID 3460 wrote to memory of 2300 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe 75 PID 3460 wrote to memory of 3396 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe 80 PID 3460 wrote to memory of 1012 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe 82 PID 3460 wrote to memory of 1012 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe 82 PID 3460 wrote to memory of 1012 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe 82 PID 3460 wrote to memory of 784 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe 8 PID 3460 wrote to memory of 792 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe 9 PID 3460 wrote to memory of 336 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe 13 PID 3460 wrote to memory of 2708 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe 45 PID 3460 wrote to memory of 2736 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe 46 PID 3460 wrote to memory of 2808 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe 48 PID 3460 wrote to memory of 3504 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe 55 PID 3460 wrote to memory of 3680 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe 57 PID 3460 wrote to memory of 3856 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe 58 PID 3460 wrote to memory of 3948 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe 59 PID 3460 wrote to memory of 4016 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe 60 PID 3460 wrote to memory of 780 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe 61 PID 3460 wrote to memory of 3792 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe 62 PID 3460 wrote to memory of 4480 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe 64 PID 3460 wrote to memory of 5012 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe 74 PID 3460 wrote to memory of 2300 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe 75 PID 3460 wrote to memory of 1012 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe 82 PID 3460 wrote to memory of 1012 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe 82 PID 3460 wrote to memory of 884 3460 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe 84 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:792
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:336
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2708
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2736
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2808
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe"C:\Users\Admin\AppData\Local\Temp\554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PCICFG.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\PCICFG.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1012
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3680
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3856
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3948
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4016
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:780
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3792
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4480
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:5012
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2300
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:3396
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:884
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\0E573B15_Rar\554cb8b3caf4d6d934cb9678091ade43c95c243f184235c0b59d47f31206d4ee.exe
- Size 160KB
- SHA256 8a80775e018f1c0148f6b4901272df488cca3cc0cfb2fc0090c866e60e6a4dc5
- MD5 264cefb27e96cb10f0ba86bf8af85dc1
- SHA1 b4b06218a0c39b4a98a83f22fb96dda69d10d48f
- SHA512 60a4120736e42e617de75e1b8131c257ad449fc6a5727ab4eb20dc20596208f51f9af4306a559a96f41cee094adb8af38c755d8601245aa3499bd1b76740fa25
- SSDEEP 3072:Z8U2yJN5f661xRZbALxB1Ojdgx8GY4EJkY9eUYxDrewAqDajkOgEsGvjqiZ/:Z8U2qy6rRZb7jxGY4EJeUY9ewAqDaJ1l
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\GENPDLL.dll
- Size 80KB
- SHA256 41a30270cf917317ff4dfa8f90336d500c630a9381479e3016f3ef8774edc2c7
- MD5 0c86e81c71d28114baf8b9d639881b02
- SHA1 7bd086fc10f263eac9293d99f3a7ffea426e105e
- SHA512 3ef4be1c8e787cc5839ef5f8d405fec94f85b132913ab0951eecb0d0817905463c59664b06372036a99ddef1e41a147f8199abcac45cea362ce1f4ecca12c101
- SSDEEP 768:x/YuGes4su7p/Mvdqw5NndTgpsyWouDuWcA9+NXiHGTiB9sGr6xdaC/po41PQH7B:1f7epdTg6o1Wcezmmr6fxo0u7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\PCICFG.exe
- Size 72KB
- SHA256 45ac57d1e3716d22662b3d3438311ca8608796dc46ef457c903c604fa54a7aa0
- MD5 2d01d83520016e8bd6759628683a8f36
- SHA1 37aac8a7aa9d9f7a6803b8b15e9c52ed57010e64
- SHA512 244390dd339d9a24d9c95131812f436bad249f95441c1d0f9af3ec7addcc478b9886c205a061f3f232b4116f7ea27feccc2032243fbe052116d9c595a21c3cb3
- SSDEEP 768:KTfSGs1xJVRqj/d0XAEyfMwWjTYfIx91La9kYTZwm3yZJiB9tKfBqHqA+F1oMfcP:IjVyt9UkAymaEIBqKACoMm
- MD5 SHA1 SHA512 SSDEEP