Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
11/06/2024, 22:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5d6316649c5b485b1ff441fbdd88f70d28caa1a4ff60f0e96ad94969ef515003.dll
Resource
win7-20240221-en
windows7-x64
17 signatures
150 seconds
General
- Target 5d6316649c5b485b1ff441fbdd88f70d28caa1a4ff60f0e96ad94969ef515003.dll
- Size 120KB
- Sample240611-2cre5athmb
- SHA256 5d6316649c5b485b1ff441fbdd88f70d28caa1a4ff60f0e96ad94969ef515003
- MD5 461db55701d25600254b1458e4641f0d
- SHA1 9351d65ab651693b0bb2707d9e190c60b6027fc9
- SHA512 f6d55162f6b2b73f867c7a732174326025154620a827aa0facc996d69ff2ba53af4e7091a7ea2631a906c0c6f38644a0afed8bf6cb9739f36c77fd028d15b1c7
- SSDEEP 3072:u+lk0BvNmHC/JUDFWQ7tEAYyWN+M1FuyB0:tZNmsUDcQREFT1MJ
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57a0b4.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57a0b4.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e5767f1.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e5767f1.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e5767f1.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57a0b4.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5767f1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57a0b4.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5767f1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57a0b4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57a0b4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57a0b4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57a0b4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57a0b4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5767f1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5767f1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5767f1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5767f1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5767f1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57a0b4.exe - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 28 IoCs
resource yara_rule behavioral2/memory/4412-10-0x00000000008C0000-0x000000000197A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4412-18-0x00000000008C0000-0x000000000197A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4412-28-0x00000000008C0000-0x000000000197A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4412-20-0x00000000008C0000-0x000000000197A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4412-19-0x00000000008C0000-0x000000000197A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4412-12-0x00000000008C0000-0x000000000197A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4412-9-0x00000000008C0000-0x000000000197A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4412-11-0x00000000008C0000-0x000000000197A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4412-6-0x00000000008C0000-0x000000000197A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4412-31-0x00000000008C0000-0x000000000197A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4412-37-0x00000000008C0000-0x000000000197A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4412-38-0x00000000008C0000-0x000000000197A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4412-39-0x00000000008C0000-0x000000000197A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4412-43-0x00000000008C0000-0x000000000197A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4412-45-0x00000000008C0000-0x000000000197A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4412-47-0x00000000008C0000-0x000000000197A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4412-56-0x00000000008C0000-0x000000000197A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4412-58-0x00000000008C0000-0x000000000197A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4412-64-0x00000000008C0000-0x000000000197A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4412-66-0x00000000008C0000-0x000000000197A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4412-67-0x00000000008C0000-0x000000000197A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4412-68-0x00000000008C0000-0x000000000197A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4412-70-0x00000000008C0000-0x000000000197A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3584-101-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3584-98-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3584-111-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3584-95-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3584-148-0x00000000007F0000-0x00000000018AA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 31 IoCs
resource yara_rule behavioral2/memory/4412-10-0x00000000008C0000-0x000000000197A000-memory.dmp UPX behavioral2/memory/4412-18-0x00000000008C0000-0x000000000197A000-memory.dmp UPX behavioral2/memory/4412-28-0x00000000008C0000-0x000000000197A000-memory.dmp UPX behavioral2/memory/4412-20-0x00000000008C0000-0x000000000197A000-memory.dmp UPX behavioral2/memory/4412-19-0x00000000008C0000-0x000000000197A000-memory.dmp UPX behavioral2/memory/4412-12-0x00000000008C0000-0x000000000197A000-memory.dmp UPX behavioral2/memory/4412-9-0x00000000008C0000-0x000000000197A000-memory.dmp UPX behavioral2/memory/4412-11-0x00000000008C0000-0x000000000197A000-memory.dmp UPX behavioral2/memory/4412-6-0x00000000008C0000-0x000000000197A000-memory.dmp UPX behavioral2/memory/4412-31-0x00000000008C0000-0x000000000197A000-memory.dmp UPX behavioral2/memory/4412-37-0x00000000008C0000-0x000000000197A000-memory.dmp UPX behavioral2/memory/4412-38-0x00000000008C0000-0x000000000197A000-memory.dmp UPX behavioral2/memory/4412-39-0x00000000008C0000-0x000000000197A000-memory.dmp UPX behavioral2/memory/4412-43-0x00000000008C0000-0x000000000197A000-memory.dmp UPX behavioral2/memory/4412-45-0x00000000008C0000-0x000000000197A000-memory.dmp UPX behavioral2/memory/4412-47-0x00000000008C0000-0x000000000197A000-memory.dmp UPX behavioral2/memory/4412-56-0x00000000008C0000-0x000000000197A000-memory.dmp UPX behavioral2/memory/4412-58-0x00000000008C0000-0x000000000197A000-memory.dmp UPX behavioral2/memory/4412-64-0x00000000008C0000-0x000000000197A000-memory.dmp UPX behavioral2/memory/4412-66-0x00000000008C0000-0x000000000197A000-memory.dmp UPX behavioral2/memory/4412-67-0x00000000008C0000-0x000000000197A000-memory.dmp UPX behavioral2/memory/4412-68-0x00000000008C0000-0x000000000197A000-memory.dmp UPX behavioral2/memory/4412-70-0x00000000008C0000-0x000000000197A000-memory.dmp UPX behavioral2/memory/4412-90-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/2884-94-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/3584-101-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/3584-98-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/3584-111-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/3584-95-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX behavioral2/memory/3584-147-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/3584-148-0x00000000007F0000-0x00000000018AA000-memory.dmp UPX - Executes dropped EXE 3 IoCs
pid Process 4412 e5767f1.exe 2884 e5769c6.exe 3584 e57a0b4.exe -
resource yara_rule behavioral2/memory/4412-10-0x00000000008C0000-0x000000000197A000-memory.dmp upx behavioral2/memory/4412-18-0x00000000008C0000-0x000000000197A000-memory.dmp upx behavioral2/memory/4412-28-0x00000000008C0000-0x000000000197A000-memory.dmp upx behavioral2/memory/4412-20-0x00000000008C0000-0x000000000197A000-memory.dmp upx behavioral2/memory/4412-19-0x00000000008C0000-0x000000000197A000-memory.dmp upx behavioral2/memory/4412-12-0x00000000008C0000-0x000000000197A000-memory.dmp upx behavioral2/memory/4412-9-0x00000000008C0000-0x000000000197A000-memory.dmp upx behavioral2/memory/4412-11-0x00000000008C0000-0x000000000197A000-memory.dmp upx behavioral2/memory/4412-6-0x00000000008C0000-0x000000000197A000-memory.dmp upx behavioral2/memory/4412-31-0x00000000008C0000-0x000000000197A000-memory.dmp upx behavioral2/memory/4412-37-0x00000000008C0000-0x000000000197A000-memory.dmp upx behavioral2/memory/4412-38-0x00000000008C0000-0x000000000197A000-memory.dmp upx behavioral2/memory/4412-39-0x00000000008C0000-0x000000000197A000-memory.dmp upx behavioral2/memory/4412-43-0x00000000008C0000-0x000000000197A000-memory.dmp upx behavioral2/memory/4412-45-0x00000000008C0000-0x000000000197A000-memory.dmp upx behavioral2/memory/4412-47-0x00000000008C0000-0x000000000197A000-memory.dmp upx behavioral2/memory/4412-56-0x00000000008C0000-0x000000000197A000-memory.dmp upx behavioral2/memory/4412-58-0x00000000008C0000-0x000000000197A000-memory.dmp upx behavioral2/memory/4412-64-0x00000000008C0000-0x000000000197A000-memory.dmp upx behavioral2/memory/4412-66-0x00000000008C0000-0x000000000197A000-memory.dmp upx behavioral2/memory/4412-67-0x00000000008C0000-0x000000000197A000-memory.dmp upx behavioral2/memory/4412-68-0x00000000008C0000-0x000000000197A000-memory.dmp upx behavioral2/memory/4412-70-0x00000000008C0000-0x000000000197A000-memory.dmp upx behavioral2/memory/3584-101-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/3584-98-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/3584-111-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/3584-95-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/3584-148-0x00000000007F0000-0x00000000018AA000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57a0b4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57a0b4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5767f1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5767f1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5767f1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57a0b4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5767f1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57a0b4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57a0b4.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57a0b4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5767f1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5767f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e5767f1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57a0b4.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5767f1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57a0b4.exe - Enumerates connected drives 3 TTPs 11 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: e5767f1.exe File opened (read-only) \??\I: e5767f1.exe File opened (read-only) \??\E: e57a0b4.exe File opened (read-only) \??\H: e57a0b4.exe File opened (read-only) \??\E: e5767f1.exe File opened (read-only) \??\H: e5767f1.exe File opened (read-only) \??\J: e5767f1.exe File opened (read-only) \??\K: e5767f1.exe File opened (read-only) \??\G: e57a0b4.exe File opened (read-only) \??\I: e57a0b4.exe File opened (read-only) \??\J: e57a0b4.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e57683f e5767f1.exe File opened for modification C:\Windows\SYSTEM.INI e5767f1.exe File created C:\Windows\e57c8de e57a0b4.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4412 e5767f1.exe 4412 e5767f1.exe 4412 e5767f1.exe 4412 e5767f1.exe 3584 e57a0b4.exe 3584 e57a0b4.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe Token: SeDebugPrivilege 4412 e5767f1.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3592 wrote to memory of 2384 3592 rundll32.exe 80 PID 3592 wrote to memory of 2384 3592 rundll32.exe 80 PID 3592 wrote to memory of 2384 3592 rundll32.exe 80 PID 2384 wrote to memory of 4412 2384 rundll32.exe 81 PID 2384 wrote to memory of 4412 2384 rundll32.exe 81 PID 2384 wrote to memory of 4412 2384 rundll32.exe 81 PID 4412 wrote to memory of 816 4412 e5767f1.exe 9 PID 4412 wrote to memory of 824 4412 e5767f1.exe 10 PID 4412 wrote to memory of 404 4412 e5767f1.exe 13 PID 4412 wrote to memory of 2548 4412 e5767f1.exe 42 PID 4412 wrote to memory of 2580 4412 e5767f1.exe 43 PID 4412 wrote to memory of 2684 4412 e5767f1.exe 45 PID 4412 wrote to memory of 3544 4412 e5767f1.exe 56 PID 4412 wrote to memory of 3668 4412 e5767f1.exe 57 PID 4412 wrote to memory of 3856 4412 e5767f1.exe 58 PID 4412 wrote to memory of 3948 4412 e5767f1.exe 59 PID 4412 wrote to memory of 4016 4412 e5767f1.exe 60 PID 4412 wrote to memory of 692 4412 e5767f1.exe 61 PID 4412 wrote to memory of 3556 4412 e5767f1.exe 62 PID 4412 wrote to memory of 1848 4412 e5767f1.exe 74 PID 4412 wrote to memory of 4248 4412 e5767f1.exe 75 PID 4412 wrote to memory of 4236 4412 e5767f1.exe 77 PID 4412 wrote to memory of 440 4412 e5767f1.exe 78 PID 4412 wrote to memory of 3592 4412 e5767f1.exe 79 PID 4412 wrote to memory of 2384 4412 e5767f1.exe 80 PID 4412 wrote to memory of 2384 4412 e5767f1.exe 80 PID 2384 wrote to memory of 2884 2384 rundll32.exe 82 PID 2384 wrote to memory of 2884 2384 rundll32.exe 82 PID 2384 wrote to memory of 2884 2384 rundll32.exe 82 PID 4412 wrote to memory of 816 4412 e5767f1.exe 9 PID 4412 wrote to memory of 824 4412 e5767f1.exe 10 PID 4412 wrote to memory of 404 4412 e5767f1.exe 13 PID 4412 wrote to memory of 2548 4412 e5767f1.exe 42 PID 4412 wrote to memory of 2580 4412 e5767f1.exe 43 PID 4412 wrote to memory of 2684 4412 e5767f1.exe 45 PID 4412 wrote to memory of 3544 4412 e5767f1.exe 56 PID 4412 wrote to memory of 3668 4412 e5767f1.exe 57 PID 4412 wrote to memory of 3856 4412 e5767f1.exe 58 PID 4412 wrote to memory of 3948 4412 e5767f1.exe 59 PID 4412 wrote to memory of 4016 4412 e5767f1.exe 60 PID 4412 wrote to memory of 692 4412 e5767f1.exe 61 PID 4412 wrote to memory of 3556 4412 e5767f1.exe 62 PID 4412 wrote to memory of 1848 4412 e5767f1.exe 74 PID 4412 wrote to memory of 4248 4412 e5767f1.exe 75 PID 4412 wrote to memory of 4236 4412 e5767f1.exe 77 PID 4412 wrote to memory of 440 4412 e5767f1.exe 78 PID 4412 wrote to memory of 3592 4412 e5767f1.exe 79 PID 4412 wrote to memory of 2884 4412 e5767f1.exe 82 PID 4412 wrote to memory of 2884 4412 e5767f1.exe 82 PID 4412 wrote to memory of 3792 4412 e5767f1.exe 84 PID 4412 wrote to memory of 3120 4412 e5767f1.exe 85 PID 2384 wrote to memory of 3584 2384 rundll32.exe 86 PID 2384 wrote to memory of 3584 2384 rundll32.exe 86 PID 2384 wrote to memory of 3584 2384 rundll32.exe 86 PID 3584 wrote to memory of 816 3584 e57a0b4.exe 9 PID 3584 wrote to memory of 824 3584 e57a0b4.exe 10 PID 3584 wrote to memory of 404 3584 e57a0b4.exe 13 PID 3584 wrote to memory of 2548 3584 e57a0b4.exe 42 PID 3584 wrote to memory of 2580 3584 e57a0b4.exe 43 PID 3584 wrote to memory of 2684 3584 e57a0b4.exe 45 PID 3584 wrote to memory of 3544 3584 e57a0b4.exe 56 PID 3584 wrote to memory of 3668 3584 e57a0b4.exe 57 PID 3584 wrote to memory of 3856 3584 e57a0b4.exe 58 PID 3584 wrote to memory of 3948 3584 e57a0b4.exe 59 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5767f1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57a0b4.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:816
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:824
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:404
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2548
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2580
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2684
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3544
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5d6316649c5b485b1ff441fbdd88f70d28caa1a4ff60f0e96ad94969ef515003.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5d6316649c5b485b1ff441fbdd88f70d28caa1a4ff60f0e96ad94969ef515003.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\e5767f1.exeC:\Users\Admin\AppData\Local\Temp\e5767f1.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4412
-
-
C:\Users\Admin\AppData\Local\Temp\e5769c6.exeC:\Users\Admin\AppData\Local\Temp\e5769c6.exe4⤵
- Executes dropped EXE
PID:2884
-
-
C:\Users\Admin\AppData\Local\Temp\e57a0b4.exeC:\Users\Admin\AppData\Local\Temp\e57a0b4.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3584
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3668
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3856
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3948
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4016
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:692
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3556
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:1848
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4248
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:4236
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:440
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3792
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3120
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\e5767f1.exe
- Size 97KB
- SHA256 10463f0db938f1989e7264609d4ca56712cce37d0c060a8dfbc4323cf828b916
- MD5 c53a766b928f7055887fd04c8e8f4e16
- SHA1 43a41fc186dc4f1f0e3609fee210296f081a5d5f
- SHA512 e246ce5111bf18683ed3636aeae123bce6afeeddc67e59dadf4ec1dca45d574a22a4ef3744fddf6995ea58af77dc68a43673e96f268d331b274baccc6e5b01d8
- SSDEEP 1536:/LyJTOgW7zZCnaLm4e6GF9/ymX+suCCJAV11:jWSBHdkUG1uCA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SYSTEM.INI
- Size 257B
- SHA256 5b9e24b77b2c4a10270798b864009d29c3ca1ac5adcc6a27ca3c58680781532b
- MD5 42ad66d070e91a66f8a9118b4be21f88
- SHA1 7e87b7aed41a91d141fff077c23eb0055f716e9a
- SHA512 ad35515b774d420e710ff8b0f690d1a288b0916e64e9cd1544fe46dda9057139cdb5c066b92b7b0886c4226e9428e1fe5c0bfd5eaeafbaec1cc14be8f06600f5
- MD5 SHA1 SHA512