Analysis
- max time kernel
140s - max time network
128s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
07/06/2024, 04:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe
Resource
win7-20240215-en
windows7-x64
18 signatures
150 seconds
General
- Target 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe
- Size 2.9MB
- Sample240607-endxvaae26
- SHA256 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db
- MD5 b8bfc6525ed95af219afd7881abf358c
- SHA1 f710a374c6be6ff74c78f6d69a02b1d9a9ee1e17
- SHA512 f37fbda24c627538742ba7159f7eb1a70aa1160f68ead6150d218a44db88a0e33f4a4b63f22f7e91361d6610140b4a7006cc78d223409493fec02ba3d9e44739
- SSDEEP 49152:XwYVpgR1OMrNWB00xhAQfhKj/TMR3dIq6lGsB3qSweV9pfXG8F4E5vlh+B3vgI8M:X1psxtMhKj4RNIHLrwexf2e/5vefgIyS
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
-
http://www.klkjwre9fqwieluoi.info/
-
http://kukutrustnet777888.info/
Signatures
- Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 18 IoCs
resource yara_rule behavioral2/memory/4632-1-0x0000000002710000-0x000000000379E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4632-6-0x0000000002710000-0x000000000379E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4632-14-0x0000000002710000-0x000000000379E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4632-9-0x0000000002710000-0x000000000379E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4632-7-0x0000000002710000-0x000000000379E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4632-15-0x0000000002710000-0x000000000379E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4632-18-0x0000000002710000-0x000000000379E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4632-23-0x0000000002710000-0x000000000379E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4632-10-0x0000000002710000-0x000000000379E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4632-8-0x0000000002710000-0x000000000379E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4632-117-0x0000000002710000-0x000000000379E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4632-93-0x0000000002710000-0x000000000379E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4632-120-0x0000000002710000-0x000000000379E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4632-121-0x0000000002710000-0x000000000379E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4632-122-0x0000000002710000-0x000000000379E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4632-124-0x0000000002710000-0x000000000379E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4632-125-0x0000000002710000-0x000000000379E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4632-128-0x0000000002710000-0x000000000379E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 19 IoCs
resource yara_rule behavioral2/memory/4632-1-0x0000000002710000-0x000000000379E000-memory.dmp UPX behavioral2/memory/4632-6-0x0000000002710000-0x000000000379E000-memory.dmp UPX behavioral2/memory/4632-14-0x0000000002710000-0x000000000379E000-memory.dmp UPX behavioral2/memory/4632-9-0x0000000002710000-0x000000000379E000-memory.dmp UPX behavioral2/memory/4632-7-0x0000000002710000-0x000000000379E000-memory.dmp UPX behavioral2/memory/4632-15-0x0000000002710000-0x000000000379E000-memory.dmp UPX behavioral2/memory/4632-18-0x0000000002710000-0x000000000379E000-memory.dmp UPX behavioral2/memory/4632-23-0x0000000002710000-0x000000000379E000-memory.dmp UPX behavioral2/memory/4632-10-0x0000000002710000-0x000000000379E000-memory.dmp UPX behavioral2/memory/4632-8-0x0000000002710000-0x000000000379E000-memory.dmp UPX behavioral2/memory/4632-117-0x0000000002710000-0x000000000379E000-memory.dmp UPX behavioral2/memory/4632-93-0x0000000002710000-0x000000000379E000-memory.dmp UPX behavioral2/memory/4632-120-0x0000000002710000-0x000000000379E000-memory.dmp UPX behavioral2/memory/4632-121-0x0000000002710000-0x000000000379E000-memory.dmp UPX behavioral2/memory/4632-122-0x0000000002710000-0x000000000379E000-memory.dmp UPX behavioral2/memory/4632-124-0x0000000002710000-0x000000000379E000-memory.dmp UPX behavioral2/memory/4632-125-0x0000000002710000-0x000000000379E000-memory.dmp UPX behavioral2/memory/4632-128-0x0000000002710000-0x000000000379E000-memory.dmp UPX behavioral2/memory/4632-145-0x0000000001000000-0x00000000012F8000-memory.dmp UPX - Executes dropped EXE 1 IoCs
pid Process 4184 update.exe - Loads dropped DLL 1 IoCs
pid Process 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe -
resource yara_rule behavioral2/memory/4632-1-0x0000000002710000-0x000000000379E000-memory.dmp upx behavioral2/memory/4632-6-0x0000000002710000-0x000000000379E000-memory.dmp upx behavioral2/memory/4632-14-0x0000000002710000-0x000000000379E000-memory.dmp upx behavioral2/memory/4632-9-0x0000000002710000-0x000000000379E000-memory.dmp upx behavioral2/memory/4632-7-0x0000000002710000-0x000000000379E000-memory.dmp upx behavioral2/memory/4632-15-0x0000000002710000-0x000000000379E000-memory.dmp upx behavioral2/memory/4632-18-0x0000000002710000-0x000000000379E000-memory.dmp upx behavioral2/memory/4632-23-0x0000000002710000-0x000000000379E000-memory.dmp upx behavioral2/memory/4632-10-0x0000000002710000-0x000000000379E000-memory.dmp upx behavioral2/memory/4632-8-0x0000000002710000-0x000000000379E000-memory.dmp upx behavioral2/memory/4632-117-0x0000000002710000-0x000000000379E000-memory.dmp upx behavioral2/memory/4632-93-0x0000000002710000-0x000000000379E000-memory.dmp upx behavioral2/memory/4632-120-0x0000000002710000-0x000000000379E000-memory.dmp upx behavioral2/memory/4632-121-0x0000000002710000-0x000000000379E000-memory.dmp upx behavioral2/memory/4632-122-0x0000000002710000-0x000000000379E000-memory.dmp upx behavioral2/memory/4632-124-0x0000000002710000-0x000000000379E000-memory.dmp upx behavioral2/memory/4632-125-0x0000000002710000-0x000000000379E000-memory.dmp upx behavioral2/memory/4632-128-0x0000000002710000-0x000000000379E000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe - Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\q: 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe File opened (read-only) \??\t: 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe File opened (read-only) \??\x: 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe File opened (read-only) \??\v: 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe File opened (read-only) \??\y: 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe File opened (read-only) \??\r: 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe File opened (read-only) \??\z: 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe File opened (read-only) \??\E: 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe File opened (read-only) \??\a: 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe File opened (read-only) \??\e: 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe File opened (read-only) \??\o: 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe File opened (read-only) \??\p: 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe File opened (read-only) \??\j: 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe File opened (read-only) \??\m: 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe File opened (read-only) \??\s: 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe File opened (read-only) \??\w: 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe File opened (read-only) \??\G: 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe File opened (read-only) \??\g: 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe File opened (read-only) \??\i: 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe File opened (read-only) \??\l: 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe File opened (read-only) \??\u: 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe File opened (read-only) \??\b: 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe File opened (read-only) \??\h: 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe File opened (read-only) \??\k: 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe File opened (read-only) \??\n: 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe File opened for modification C:\Windows\KB829558.log update.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe Token: SeDebugPrivilege 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe - Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 4632 wrote to memory of 780 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe 8 PID 4632 wrote to memory of 788 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe 9 PID 4632 wrote to memory of 316 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe 13 PID 4632 wrote to memory of 2532 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe 44 PID 4632 wrote to memory of 2564 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe 45 PID 4632 wrote to memory of 2812 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe 51 PID 4632 wrote to memory of 3448 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe 56 PID 4632 wrote to memory of 3576 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe 57 PID 4632 wrote to memory of 3744 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe 58 PID 4632 wrote to memory of 3840 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe 59 PID 4632 wrote to memory of 3908 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe 60 PID 4632 wrote to memory of 3992 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe 61 PID 4632 wrote to memory of 432 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe 62 PID 4632 wrote to memory of 2456 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe 74 PID 4632 wrote to memory of 4396 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe 76 PID 4632 wrote to memory of 4468 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe 77 PID 4632 wrote to memory of 3352 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe 78 PID 4632 wrote to memory of 2392 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe 79 PID 4632 wrote to memory of 3208 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe 80 PID 4632 wrote to memory of 2920 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe 81 PID 4632 wrote to memory of 3144 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe 83 PID 4632 wrote to memory of 4944 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe 88 PID 4632 wrote to memory of 3976 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe 89 PID 4632 wrote to memory of 4184 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe 91 PID 4632 wrote to memory of 4184 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe 91 PID 4632 wrote to memory of 4184 4632 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe 91 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:316
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2532
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2564
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2812
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe"C:\Users\Admin\AppData\Local\Temp\9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4632 -
\??\c:\8e713109baaf8a656f938311b11984\update\update.exec:\8e713109baaf8a656f938311b11984\update\update.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4184
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3576
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3744
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3840
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3908
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3992
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:432
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:2456
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window1⤵PID:4396
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.118 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.80 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffcb30dceb8,0x7ffcb30dcec4,0x7ffcb30dced02⤵PID:4468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2284,i,17096020621006928097,15544233752327415349,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:22⤵PID:3352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1948,i,17096020621006928097,15544233752327415349,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:32⤵PID:2392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2464,i,17096020621006928097,15544233752327415349,262144 --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:82⤵PID:3208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4584,i,17096020621006928097,15544233752327415349,262144 --variations-seed-version --mojo-platform-channel-handle=4008 /prefetch:82⤵PID:4984
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2920
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3144
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:4944
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:3976
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\8e713109baaf8a656f938311b11984\_sfx_.dll
- Size 25KB
- SHA256 cf64c95e9a2d02967efc22b00efb3736156b913a95231eb63c1df45d43475e64
- MD5 ee207e35aea4d5df41d90221e1b66efa
- SHA1 757469cf9ad2f21f267bbe730560114fdf8a89a5
- SHA512 43e9f75725daa4f3428b2d9cee2c2cc8b2f2e991b8e58d72d2f429fbdfb614c86d172f03d3f9da98756bd4e245643d9a57c6efa422d6c60ad364a2322245542d
- SSDEEP 768:SCndDb8sAGCMXZ7MnjT2SusEjyoGilYr:lNjNMjSS1EM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\8e713109baaf8a656f938311b11984\update\update.exe
- Size 555KB
- SHA256 afa17a7e9c98295bfc981d37d1ebc35540aa81495c4c3a0b58a6f7270fc2408d
- MD5 b15cbd20ca3b997543713122e05d8884
- SHA1 f4555d56f79933f63d27401278bf9f44da4719fd
- SHA512 41e84ebfd116b5b8f9593930b73c068de98dd77d49756767b1c41c88c698c12342a97e4c22829e049e998e4d0c05718d6bfa98cb2f36efac4c58c95a6bdd8661
- SSDEEP 12288:BbTxETT7VYUZyVO0BZSEtTK6a6PN/bM3H+EZR:BXxwNY4yVO0B4Etja6PO3xR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\0E57EA9E_Rar\9b521d67390b4abb6d71b51729444d5fdc4c82032e7f63ebb2584e8eecf5e7db.exe
- Size 2.8MB
- SHA256 9594829b852d9562589f7123f2e1d9881e9d314cc29ab6dcd12cf064e952316d
- MD5 d6a09a96862d6e46e3d06470d9792f6e
- SHA1 6815dcc1d6768cf83add296a48158c1691cf0fbd
- SHA512 ae268fbf8b3244ce0aca1208146cab895ea3bb8af7c7d485e9645a665b9a0eca0316efdf287dddf1a4b7ed16163f4ecc933a258ec4e5da5e1ab5f0a72b74b794
- SSDEEP 49152:5TYVpgR1OMrNWB00xhAQfhKj/TMR3dIq6lGsB3qSweV9pfXG8F4E5vlh+B3vgI8N:50psxtMhKj4RNIHLrwexf2e/5vefgIyH
- MD5 SHA1 SHA512 SSDEEP