Analysis
- max time kernel
91s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
09/06/2024, 02:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7a24d36e02d5e47558238324012fc8c6451848ce1c0949ce76e08d4dbb306cf0.dll
Resource
win7-20240508-en
windows7-x64
17 signatures
150 seconds
General
- Target 7a24d36e02d5e47558238324012fc8c6451848ce1c0949ce76e08d4dbb306cf0.dll
- Size 120KB
- Sample240609-c6t1nsdb35
- SHA256 7a24d36e02d5e47558238324012fc8c6451848ce1c0949ce76e08d4dbb306cf0
- MD5 91e805476f0b556ae29499c19a0515b7
- SHA1 20c591a471e9fd8a0633b1c52eb2e75891804339
- SHA512 b213346d7e6ea655da63df58c3a8ee1e6739d0d5f6ff619c2f231011c0a2cf96f71725ba7e55001ea1ec18942d384a858fb9bfd1a757dce8eeed4f4fef6bb3e9
- SSDEEP 1536:7aUeJS6T/2lNdFutdDAmoY2jC2/ptDjkpBhOk+94pZO+UZVjT+hwF3Xk4URxtYrY:7abzquc0MC2/fjkX4No5GVvSt4yxm
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e576699.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e576699.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e576699.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e576699.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e576699.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e576699.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e576699.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e576699.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e576699.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e576699.exe - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 31 IoCs
resource yara_rule behavioral2/memory/4408-6-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4408-9-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4408-10-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4408-20-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4408-31-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4408-22-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4408-21-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4408-12-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4408-11-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4408-8-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4408-35-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4408-36-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4408-37-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4408-38-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4408-39-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4408-41-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4408-42-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4408-51-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4408-53-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4408-54-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4408-65-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4408-66-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4408-69-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4408-71-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4408-72-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4408-74-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4408-73-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4408-77-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4408-79-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4408-81-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4408-85-0x0000000000740000-0x00000000017FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 34 IoCs
resource yara_rule behavioral2/memory/4408-6-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4408-9-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4408-10-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4408-20-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4408-31-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4408-22-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4408-21-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4408-12-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4408-11-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4408-8-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4408-35-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4408-36-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4408-37-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4408-38-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4408-39-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4408-41-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4408-42-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4408-51-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4408-53-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4408-54-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4408-65-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4408-66-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4408-69-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4408-71-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4408-72-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4408-74-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4408-73-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4408-77-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4408-79-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4408-81-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/4408-102-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/5076-106-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4408-85-0x0000000000740000-0x00000000017FA000-memory.dmp UPX behavioral2/memory/2960-110-0x0000000000400000-0x0000000000412000-memory.dmp UPX - Executes dropped EXE 3 IoCs
pid Process 4408 e576699.exe 5076 e576774.exe 2960 e57825f.exe -
resource yara_rule behavioral2/memory/4408-6-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4408-9-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4408-10-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4408-20-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4408-31-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4408-22-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4408-21-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4408-12-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4408-11-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4408-8-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4408-35-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4408-36-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4408-37-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4408-38-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4408-39-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4408-41-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4408-42-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4408-51-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4408-53-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4408-54-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4408-65-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4408-66-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4408-69-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4408-71-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4408-72-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4408-74-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4408-73-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4408-77-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4408-79-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4408-81-0x0000000000740000-0x00000000017FA000-memory.dmp upx behavioral2/memory/4408-85-0x0000000000740000-0x00000000017FA000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e576699.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e576699.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e576699.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e576699.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e576699.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e576699.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e576699.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e576699.exe - Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: e576699.exe File opened (read-only) \??\R: e576699.exe File opened (read-only) \??\H: e576699.exe File opened (read-only) \??\J: e576699.exe File opened (read-only) \??\K: e576699.exe File opened (read-only) \??\L: e576699.exe File opened (read-only) \??\M: e576699.exe File opened (read-only) \??\I: e576699.exe File opened (read-only) \??\S: e576699.exe File opened (read-only) \??\N: e576699.exe File opened (read-only) \??\Q: e576699.exe File opened (read-only) \??\E: e576699.exe File opened (read-only) \??\G: e576699.exe File opened (read-only) \??\O: e576699.exe - Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe e576699.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e576699.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e576699.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe e576699.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\e5766e8 e576699.exe File opened for modification C:\Windows\SYSTEM.INI e576699.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4408 e576699.exe 4408 e576699.exe 4408 e576699.exe 4408 e576699.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe Token: SeDebugPrivilege 4408 e576699.exe - Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 4256 wrote to memory of 1592 4256 rundll32.exe 84 PID 4256 wrote to memory of 1592 4256 rundll32.exe 84 PID 4256 wrote to memory of 1592 4256 rundll32.exe 84 PID 1592 wrote to memory of 4408 1592 rundll32.exe 85 PID 1592 wrote to memory of 4408 1592 rundll32.exe 85 PID 1592 wrote to memory of 4408 1592 rundll32.exe 85 PID 4408 wrote to memory of 800 4408 e576699.exe 9 PID 4408 wrote to memory of 808 4408 e576699.exe 10 PID 4408 wrote to memory of 380 4408 e576699.exe 13 PID 4408 wrote to memory of 2456 4408 e576699.exe 42 PID 4408 wrote to memory of 2484 4408 e576699.exe 43 PID 4408 wrote to memory of 2736 4408 e576699.exe 48 PID 4408 wrote to memory of 3488 4408 e576699.exe 56 PID 4408 wrote to memory of 3672 4408 e576699.exe 57 PID 4408 wrote to memory of 3860 4408 e576699.exe 58 PID 4408 wrote to memory of 3948 4408 e576699.exe 59 PID 4408 wrote to memory of 4016 4408 e576699.exe 60 PID 4408 wrote to memory of 768 4408 e576699.exe 61 PID 4408 wrote to memory of 788 4408 e576699.exe 62 PID 4408 wrote to memory of 4496 4408 e576699.exe 74 PID 4408 wrote to memory of 4944 4408 e576699.exe 75 PID 4408 wrote to memory of 4836 4408 e576699.exe 82 PID 4408 wrote to memory of 4256 4408 e576699.exe 83 PID 4408 wrote to memory of 1592 4408 e576699.exe 84 PID 4408 wrote to memory of 1592 4408 e576699.exe 84 PID 1592 wrote to memory of 5076 1592 rundll32.exe 86 PID 1592 wrote to memory of 5076 1592 rundll32.exe 86 PID 1592 wrote to memory of 5076 1592 rundll32.exe 86 PID 1592 wrote to memory of 2960 1592 rundll32.exe 94 PID 1592 wrote to memory of 2960 1592 rundll32.exe 94 PID 1592 wrote to memory of 2960 1592 rundll32.exe 94 PID 4408 wrote to memory of 800 4408 e576699.exe 9 PID 4408 wrote to memory of 808 4408 e576699.exe 10 PID 4408 wrote to memory of 380 4408 e576699.exe 13 PID 4408 wrote to memory of 2456 4408 e576699.exe 42 PID 4408 wrote to memory of 2484 4408 e576699.exe 43 PID 4408 wrote to memory of 2736 4408 e576699.exe 48 PID 4408 wrote to memory of 3488 4408 e576699.exe 56 PID 4408 wrote to memory of 3672 4408 e576699.exe 57 PID 4408 wrote to memory of 3860 4408 e576699.exe 58 PID 4408 wrote to memory of 3948 4408 e576699.exe 59 PID 4408 wrote to memory of 4016 4408 e576699.exe 60 PID 4408 wrote to memory of 768 4408 e576699.exe 61 PID 4408 wrote to memory of 788 4408 e576699.exe 62 PID 4408 wrote to memory of 4496 4408 e576699.exe 74 PID 4408 wrote to memory of 4944 4408 e576699.exe 75 PID 4408 wrote to memory of 5076 4408 e576699.exe 86 PID 4408 wrote to memory of 5076 4408 e576699.exe 86 PID 4408 wrote to memory of 952 4408 e576699.exe 88 PID 4408 wrote to memory of 2288 4408 e576699.exe 89 PID 4408 wrote to memory of 2960 4408 e576699.exe 94 PID 4408 wrote to memory of 2960 4408 e576699.exe 94 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e576699.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:800
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:808
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:380
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2456
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2484
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2736
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3488
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7a24d36e02d5e47558238324012fc8c6451848ce1c0949ce76e08d4dbb306cf0.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7a24d36e02d5e47558238324012fc8c6451848ce1c0949ce76e08d4dbb306cf0.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\e576699.exeC:\Users\Admin\AppData\Local\Temp\e576699.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4408
-
-
C:\Users\Admin\AppData\Local\Temp\e576774.exeC:\Users\Admin\AppData\Local\Temp\e576774.exe4⤵
- Executes dropped EXE
PID:5076
-
-
C:\Users\Admin\AppData\Local\Temp\e57825f.exeC:\Users\Admin\AppData\Local\Temp\e57825f.exe4⤵
- Executes dropped EXE
PID:2960
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3672
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3860
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3948
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4016
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:768
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:788
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4496
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4944
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:4836
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:952
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2288
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\e576699.exe
- Size 97KB
- SHA256 3deb7b895f46ef4d330e0bdfe546646337f129fe63782b36ea9107a0bdb3c361
- MD5 60ab6f6b3c9211852a5f4c33cc3f5e73
- SHA1 d790c5883c4d87238ee537bbd19aa21b050806f8
- SHA512 a6a9583d6845274fd99f35c017c0409996a684e5ccbb91a7af705275f9993cd8e6e78d3c670b6e03767a9da4e7dd9c144d27821ed2faded734c834edcdc9a9f6
- SSDEEP 1536:9FOZaSr3EB81XhvraPU7Kfi/ciBxXkwSgwYOH7ubLLGJELGd6x:9F1yC6r+U+afTShbWgEi
- MD5 SHA1 SHA512 SSDEEP